I've implemented an API for one of my clients, it relies on nonces and a shared secret. The structure:
- Client's Site (CS) requests nonce from My App (MA), posting their username
- MA verifies the username is valid, then generates a nonce in response
- The nonce is only valid for the given username and is only valid for 1 minute.
- CS uses the nonce to make a userful API call; the post looks like this:
- username, nonce (from step 2), cnonce (Generated by CS), payload (Useful API call), and hash Which is a sha1 hash of the nonce, payload, shared secret, and the client nonce.
MA confirms that the nonce is valid for the given username (and then invalidates the nonce for future use), and then uses the shared secret for the given username along with the nonce and provided client nonce to hash the payload and confirm the hash matches the given hash.
If it matches, it executes the API call specified in the payload.
My question: Am I using the idea of a cnonce correctly? I'm having a hard time seeing its usefulness.