Tag Info

Hot answers tagged


I don't believe there is any way to achieve what you want, within your constraints. You stated as a requirement that a user must be able to get all of their data from the server, without storing anything other than their private key. If an attacker learns the private key, the attacker then knows everything that the user does, so of course the attacker can ...


There is no known inherent weakness in HMAC-SHA256 that requires key rotation for a suitably secret key. However, other aspects of the system in which you are using HMAC-SHA256 may make key rotation necessary. For instance if you don't want the same message to have the same hmac over time for some reason a key rotation would achieve that (but so would a ...

Only top voted, non community-wiki answers of a minimum length are eligible