I am considering two login procedures, both via HTTPS GET API:
procedure A:
Reuqest:
https://host/login?id={identity}&time={client_timestamp}&nonce={ramdon_string}&sign={signature}
Response:
{"stat": 0, "token": "token_string"}
Where:
- id: identity of the request client, which is public (a hardware identity printed on label)
- time: unix timestamp of the client, which must be in-sync with server clock (with allowed error about +/- 5 minutes). This is added to prevent replay attack.
- sign: an hmac-sha256 of
nonce+time+<shared-secret>
. nonce is saved at server-side for a period of time, within which re-use of same nonce is not allowed.
procedure B:
Request:
https://host/login?id={identity}
Response:
{"stat": 0, "token": "encrypted&base64 encoded token"}
In this scheme:
- server will generate a token (if id is valid), encrypt
<token><salt>
withshared-secret
using AES cipher. - server will lookup cache to prevent re-encrypt of same token. The cache will be valid for a period of time to save server CPU resource.
- client will decrypt the token using
shared-secret
and use the firstN
byte as token (token length is pre-defined).
My question is, considering that the channel is HTTPS, encryption key is pre-shared, which procedure is considered more secure, and why? Thanks.