I have a server and a client that need to authenticate to that server.
The idea is that we have
pass and the authentication generates a token that can later be used.
An important factor here is that I want to reduce the number of network round trips as much as possible. I came up with the following scheme:
Client generates a single use
Client sends the server the following:
The server load the relevant user and computes hash(
- It then generates a token that the client will use, and encrypt that token using the
- Client decrypt the token using the
private key, and can then use it.
The issue of token security is not relevant here. It is expected that most users will use this over HTTPS, but we need to avoid sending the password on the clear for cases where users use HTTP internally inside the organization.
As I figure, we prevent replay attacks using this approach because only the client can decrypt the token.
I'm aware that if an attacker can listen to the network they can just sniff the token on the next request after authentication, but that isn't the concern here.
Are there any holes that I'm missing?