I'm building an application where users can be a part of groups, and can obtain and distribute URLs from the group page that allow anyone who clicks on them to join said group. Groups should not otherwise be join-able without a proper URL (or an invite from within the system, but that's another matter).

Currently, I have it set up so a URL to a group looks something like "host/JoinGroup?groupKey=ABCDEF", where the groupKey is a ciphertext created by encrypting the group's ID# using AES with a static key and IV across all groups (which I know is normally bad). Doing this, I can decrypt the key on the server and use it to determine which group the user should join so I can update the database. My goal with this is not to hide what is being encrypted, but rather to make sure it is very hard to generate a valid groupKey and join any group they want.

With this in mind, is this method insecure? I know the standard IV reuse attack allows someone to find the XOR'd plaintext, but I'm not trying to hide the plaintext, just the key itself and valid ciphertexts, so that an attacker can't generate valid URLs. Should I change the IV used for each group, but continue using a static key? Would using a keyed hash (i.e., "host/JoinGroup?groupId=5&groupKey=hmac_of_groupId") be better?

  • 2
    $\begingroup$ After thinking about it for a while I think what I really should be using is an HMAC, because I don't actually need to care about decrypting. It was never the point. Also saves me a bunch of crypto concerns related to key use. $\endgroup$ – Owen K. Mar 15 '15 at 2:23
  • 1
    $\begingroup$ You beat me to the punch; a Message Authentication Code (or MAC) is what you're looking for. An HMAC is a good choice (assuming you use a reasonable hash function) -- if you prefer to use a block cipher, CMAC is another fine choice. $\endgroup$ – poncho Mar 15 '15 at 2:39
  • $\begingroup$ And if using a single block message (and zero key), your scheme is actually CBC-MAC, of which CMAC is a modification. (CMAC XORs the plaintext with some derived key before encrypting it.) $\endgroup$ – Paŭlo Ebermann Mar 15 '15 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.