I need to implement a HMAC signing of requests and I have read this article which explains the basics of what it is and how to achieve on theory. https://blog.andrewhoang.me/how-api-request-signing-works-and-how-to-implement-it-in-nodejs-2/ But I have no idea how the user initially gets their public/private key pair. Is it during login or during registration? Do they change? If yes how do you send them the new private key?


Each site, users and the server, generate their public and private keys and announce them, by sending the public keys. This can be executed during the registration process. The server should not generate the keys for the users, otherwise, the servers must be totally trusted and you have to securely send the private key, somehow.

You can use the Diffie-Hellman Key exchange protocol or the Elliptic-curve Diffie–Hellman to generate the keys to use in HMAC or any other process.

Due to the man in the middle attack, you may need to apply the improved version; Station-to-Station protocol

  • $\begingroup$ How does the server decrypt with its private key the request that the client has encrypted with their private key? $\endgroup$
    – D.Tomov
    Nov 15 '18 at 9:42
  • $\begingroup$ The clients request the server's public key so that they can send a message to the server and then only the server, can decrypt the message. This is the classical Public-Key Cryptography. We use hybrid encryption. that uses public key algorithm to exchange/generate key and use the keys in symmetric encryption decryption. $\endgroup$
    – kelalaka
    Nov 15 '18 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.