Comments (5)
I looked at the code today after seeing the korben post, wondered a little time about the treatment of nonces, was about to send a mail to [email protected] then saw this already has an issue. So posting here instead.
Could you also provide a clean treatment for nonces ? I don't feel it's an easy task.
For example,
Client Side :
how do you choose the nonce to send from the client side, so that it won't be rejected by the server ?
How to do so from multiple browser tabs ?
Once you have resolved the two above problems : How do you keep the nonce small (so that you can compare and store it fast ? )
If you make the nonce finite size, how do you handle the finite size of the nonce (once there are no more nonce ? (new SIN creation ? )
Server Side
How to store the nonce ? It seems to me that we need a transactionnal (no mongo here, or traditional session no-sql store) persistent store.
How can we use this with a distributed architecture ?
Does "bitauth" break REST architecture ?
Additional note (my current view of the problem ): It seems to me that bitauth is just (not) implementing a nonce mechanism over standard Elliptic Curve Cryptography authentification. It seems to me it doesn't implement "perfect forward secrecy", so that for me :
using bitauth < encrypting with ECC an http request then sending this request over SSL <
over SSL : using ECCDH to create a temporary session key from stored public keys then using this keys to encrypt with and http request then sending
< NOT DOING CRYPTOGRAPHY IN JS IN THE BROWSER until there is proper browser module support.
from bitauth.
Why don't we forget having the client pick the nonces?
- User requests access
- Server issues nonce challenge
- User signs nonce, returns signature and public key
- Server checks signature, checks if public key / SIN is allowed access to requested resource
Maybe I'm missing something, but it seems like we could get away without having to remember anything for longer than a session (just issue a new random number), and it avoids the possibility of someone intercepting a previous signature for a higher nonce and using that to login.
from bitauth.
@snakecharmer1024 It's almost a month since I looked to bitauth, so I may have not understood you.
Even if "User requests access" is encrypted, it is still subject to replay attacks.
And it seems your solution need one more round-trip every time, which will have to be handled by the common developper.
from bitauth.
@darkblue346 Ok I think I see what you mean. Like this?
- User requests access over SSL
- Server issues nonce challenge
- User signs nonce, sends signature and public key
- Attacker intercepts message and resends it, gaining access
- User is unable to access due to attackers access
Is that roughly what you mean? This stuff is challenging to think about clearly.
from bitauth.
@martindale is this still relevant
from bitauth.
Related Issues (20)
- Implementation Specification Paper HOT 1
- Browser build on Post-Install
- Node 0.12.0 has 'bad decrypt' error HOT 2
- Add encryption HOT 1
- signed responses? HOT 1
- Recover Public Key From Signed Message HOT 1
- Support for Web Cryptography API HOT 3
- make-dist.sh doesn't check command path or success of bundle creation and minification
- 𝒰nicode 𝔖upport? HOT 2
- Provide Browserified & Minified Code In Releases HOT 3
- Make A Tagged Release For 0.3.1 HOT 2
- BIP43 "purpose" number for bitauth key generation from a BIP32 seed HOT 2
- Broken Browserify HOT 1
- Version 0.3.1 Breaks Google Closure Compiler Support HOT 1
- Installation error HOT 1
- How is this different from a signed JWT?
- I failed to build android
- Please release a new version HOT 4
- Invalid character in header content ["x-signature"] HOT 2
- [email protected]
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from bitauth.