I am signing a short message using the base64 of an HMAC, like this (python):
import hashlib import hmac import base64 raw = hmac.new("key", msg="secret", digestmod=hashlib.sha1).digest() base64.urlsafe_b64encode(raw)
That last line returns
'ux5F7Ye-rpwvysbzUBLu-wGaYXA=', which I use as the signature. To verify a signature we sign the data again, and compare with the user provided signature.
How risky would it be to do the comparison case insensitive? e.g. the signature above would also allow
'ux5f7ye-rpwvysbzublu-wgayxa=' and many others.
Motivation is I am using the signature in an email address, which is case insensitive, which as you can imagine doesn't work. I can change to a different encoding (suggestions?), but that would require everyone updating the email addresses they use. I'm asking this question to see whether I can safely avoid making everyone do that.