1
$\begingroup$

I'm a newbie and an idiot to boot. I've a question in relation to tokenizing: is there a methodology out there that would allow you reidentify without using a token to value lookup? I'd have thought no but have a developer claiming something different. I contend that what he's talking about is an encryption process.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

You could use for example an asymmetric keys pair, where the private key is stored on the user's device, and where the public key is saved in the server side.

At sign-in, the server send a challenge request (random bytes + current timestamp), the client need to sign the challenge and the server can verify the signature.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.