Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In OAuth 1.0a and 2.0 using MAC Authorization, I need to generate a hash of all the QueryString Parameters, which requires normalization (alphabetical ordering) of them.

I'm trying to understand what this offers from a security perspective over just generating a hash of Secret Key + Nonce + Timestamp?

My guess is that the additional entropy makes it harder to brute force the secret key, but I'm not really sure if that is the case.

Does anyone know what QueryString hashing offers in terms of security on top of simpler hashing?

share|improve this question
I'd speculate that they want to protect the querystring parameters from tampering/modification. If they weren't included in the hash/MAC input, an attacker could change them freely and the modification would go undetected. – D.W. Mar 20 '14 at 7:29
@D.W. That's actually a REALLY good point, I never thought about that, Men-In-The-Middle may not just listen but also mess with the data. – Michael Stum Mar 20 '14 at 7:36
up vote 0 down vote accepted

I asked @eranhammer on Twitter and the idea is to protect the URL from tampering.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.