> i know almost nothing about security-related issues - 90% of what i know > about cookie security i learned from grokking fossil's login cookie (i had to > for the JSON login implementation). That means: i'll use whatever code i can > get to do this, as long as i don't actually have to come up with a custom > security mechanism or write the hashing implementation :).
I have attached a patch to sha.c with HMAC implementation, and double-signing.
Basically, if zKey is a random secret string stored in the database, and zRest
is a concatenation of the values you want to store in the cookie (e.g.
login/ip-address/project-code):
zSignature = hmac_double_sign(zKey, zRest);
Append or prepend this signature to zRest, so it will look like this:
ac474c1a90651e71b36c1cf5f29f884fe773707e/login/ip-address/project-code
Set this as a cookie.
To authenticate a user, get his/her zKey from database, split the cookie to
zSignature and the rest of it (zRest = "login/ip-address/project-code"), and do:
if ( hmac_double_verify(zSignature, zKey, zRest) == 0 ) {
// User successfully authenticated
}else{
// failure
}
--
Dmitry Chestnykh
hmac.patch
Description: Binary data
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
