0

I am implementing an OAuth 2.0 authorisation server. As part of client registration process I want to generate the unique client identifier for this client.

The method I have chosen is to take all the client registration information and hash it using SHA-512. The client information includes:

  1. client password (masked using bcrypt)
  2. client type
  3. client name
  4. client web site uri
  5. application name
  6. url for logo image
  7. client description
  8. redirect uri
  9. legal terms and conditions acceptance flag
  10. registration active flag
  11. create timestamp // when the client registered
  12. update timestamp
  13. deactivated timestamp

My question is whether it is safe to include the encrypted password when producing the SHA digest and whether this is a secure way to produce a unique client identifier.

M.K.
  • 153
  • 5

1 Answers1

1

OAuth documentation states that client identifiers are public and simply need to be unique for all clients of that authorization server. They also advise that the ID not be easily guessable to decrease phishing attacks.

The method you proposed is valid, but doesn't provide any additional security over a randomly generated number.

The client secret is the part that has to be cryptogrically secure.

Daisetsu
  • 5,110
  • 1
  • 14
  • 24