Hi, On Wed, Apr 10, 2019 at 09:40:05AM +0100, Nick Hilliard wrote:
Gert Doering wrote on 10/04/2019 09:22:
Well, it wasn't clear if "store unencrypted" referred to the client or server side. On the server side, yes, please store one-way hashed in a secure fashion.
How though? Again, thinking out loud, it's easy enough if you implement using an unsalted hash except that's not considered to be secure.
The attack vector against unsalted hashes is "rainbow tables"... make the API key something like 80 characters long, and no machine in the world can do anything but brute force. But why store the API key anyway. Have it contain permissions plus a crytographically sane signature, and all you need to know is "in the key". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279