HMAC? Hmac is a mandatory field which should be prepared following the steps below: 1. Concatenate App Id, Mobile number and Device Id with the separator “|”. 2. Create a hash of the concatenated string using SHA-256 algorithm. 3. Encrypt the hash with the token as key using AES-256 algorithm. 4. Populate HMAC with the encrypted string.
HMAC? Hmac is a mandatory field which should be prepared following the steps below: 1. Concatenate App Id, Mobile number and Device Id with the separator “|”. 2. Create a hash of the concatenated string using SHA-256 algorithm. 3. Encrypt the hash with the token as key using AES-256 algorithm. 4. Populate HMAC with the encrypted string.
HMAC? Hmac is a mandatory field which should be prepared following the steps below: 1. Concatenate App Id, Mobile number and Device Id with the separator “|”. 2. Create a hash of the concatenated string using SHA-256 algorithm. 3. Encrypt the hash with the token as key using AES-256 algorithm. 4. Populate HMAC with the encrypted string.
PCI-DSS 101 3.2 Do not store sensitive authentication data after authorization (even if encrypted). If sensitive authentication data is received, render all data unrecoverable upon completion of the authorization process.
Learnings 1. Don’t roll your own Crypto. 2. Don’t overengineer security a. Rely on TLS / PGP / Bcrypt / HMAC 3. Use standard authentication i. JWT (Json Web Tokens) ii. Token Auth iii. Use “standard” HMAC for signatures 4. Use NaCl for encryption
captn3m0
k1low
orgachem
coconala_engineer
niftycorp
yoshimi0227
leveragestech
ouchi2501
nayuts
you
knsg16
bryan
moore
bluesmoon
lara
chriscoyier
addyosmani
paulrobertlloyd
shpigford
robhawkes
frogandcode
tammielis