1
$\begingroup$

We're implementing a mobile application which communicates with a web service, and on first install the user sends its deviceid to the web service (over TLS, unauthenticated at this point) - which determines if the user's device is known to our system. If the device is not known, the user must authenticate with a username and password to associate the device. When the web service responds to the mobile application requesting a username and password, the response includes a nonce, valid for that request and response only.

Once the Username/Password is requested, the client generates a cnonce and a HMAC:

hash_hmac(sha256, nonce || deviceid || cnonce, nonce)

using the nonce supplied previously as the key. When the response is received by the web service, the supplied nonce is invalidated.

As this mobile app is considered to be on a hostile device, we don't want to be storing a secret key in the app which can be recovered.

Is it safe to use the nonce as the key for the hmac in the above example?

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ What is the purpose of the HMAC in the protocol? What is it meant to prevent an attacker from doing? $\endgroup$
    – otus
    Nov 12, 2015 at 6:27
  • $\begingroup$ The purpose of the HMAC is to purely provide a validation mechanism for the deviceid data being sent from the client to the server. $\endgroup$
    – j-sec
    Nov 12, 2015 at 21:50
  • $\begingroup$ By "unauthenticated TLS" do you mean neither end is authenticated? Or does the server have a certificate/public key that the application can trust? $\endgroup$
    – otus
    Nov 13, 2015 at 10:25

1 Answer 1

Reset to default
2
$\begingroup$

No, the nonce is not fit to be a HMAC key, because anybody can view the nonce in transit. If - on the other hand - the TLS connection does deliver enough security then you would not need the HMAC.

It's fine to use the nonce as one time code, but you don't need the HMAC for that. If an attacker can obtain nonce's send to clients than the attacker can always replace the original nonce with another one by redoing the HMAC calculations.

Note that your solution space may be empty if you cannot trust the client application. That sounds a lot like trying to implement a DRM scheme.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Not sure I agree... The nonce seems to be sent encrypted over TLS. $\endgroup$
    – otus
    Nov 13, 2015 at 10:25
  • $\begingroup$ Yes so the transport layer is responsible for the security. If it breaks the scheme falls down and if it doesn't then it is not required... $\endgroup$
    – Maarten Bodewes ♦
    Nov 13, 2015 at 12:19
  • $\begingroup$ Thanks for confirming my suspicions. Thankfully it's not DRM, but just a Mobile application. I've accepted your answer, but the tick disappeared so I'm not sure it worked (but it could also just be because I'm new to the site). $\endgroup$
    – j-sec
    Nov 17, 2015 at 0:12
  • $\begingroup$ It's there in my browser, but sometimes the site takes some time to update, especially if you hit the back button it might be slightly out of sync. Thanks for the accept. $\endgroup$
    – Maarten Bodewes ♦
    Nov 17, 2015 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.