0

I'd like to implement a RESTful API service over HTTP that developers can call from their server side environments.

I intend to use a cryptographically secure pseudo-random number generator (CSPRNG) to generate keys and then convert the bits to a text-friendly encoding format (say base58). e.g. a random 256-bit number of say 0xbcd612439baf13189ee65469306651c341212cfea9b887fd0ce0bb2d4e95e97a would be base58 encoded to Di8yS3NxymgwuaD6Ft4B7Yi6GdW5hbmLdWYJm22YBZRj.

My API endpoint would be use HTTP with TLS (e.g. https://example.com/api/v1). The HTTP request header would be used to send the developer key in the following way:

Authorization: Bearer Di8yS3NxymgwuaD6Ft4B7Yi6GdW5hbmLdWYJm22YBZRj

I aim to store the SHA256 hash of the developer key in an SQL database server-side. I plan uses a constant time comparison to compare the calculated hash to the corresponding hash from the database.

Is the above scenario good/bad practice?

If not, why and what should I learn to make it better?

Any other tips or advice welcome please.

Edit: I posted this on Crypto-SE and another user pointed out I should have a policy for distribution/rotation/blacklisting.

Andy Fusniak
  • 113
  • 4
  • *"Is the above scenario "secure enough" ..."* - secure enough against what? Against guessing the key - yes. Against stealing the key and misusing it - there is no kind of protection against this. Against DoS by lots of requests, even with the wrong key - no protection against this. ... – Steffen Ullrich Dec 02 '21 at 21:14
  • @SteffenUllrich Good point - I’m really trying to establish if the overall strategy of using a fixed key like this is bad practice vs some other protocol that might be more suitable that I don’t yet know of. – Andy Fusniak Dec 02 '21 at 22:26
  • 1
    Take at look at JWT/JWK. It allows to verify tokens without an additional Database round-trip. – Beltway Dec 03 '21 at 11:09
  • @Beltway Thanks. Your comment has led me to look into OAuth 2.0 Client Credentials Flow with a JWT/JWT. – Andy Fusniak Dec 03 '21 at 14:13

0 Answers0