-1
$\begingroup$

I have to pass a 6 digit number which has to be kept very secret through a unsecured netwok.

I am thinking to hash it using hmac and a secret key which only me and the reciever knows

So the code for hashing is

key = b'SOME_SECRET_KEY'
message = b'6_DIGIT_NUMBER' # eg: b'123456'
hash = hmac.new(key, message, sha1)

I heard that this will have same hashes if the message is same.

To keep the hash unique I read that we have to use something called nonce. I'm completely new to nonce and have no idea how to use it in my case. Can someone help how to implement here

Improve this question
$\endgroup$
5
  • $\begingroup$ That's only if you need it to be unique. And it is "nonce" not "nounce", which simply stands for number used once. We cannot really tell you how to use something unique without knowing more about your use case: i.e. what you intent to do with this all. $\endgroup$ – Maarten Bodewes♦ Feb 6 '20 at 5:04
  • $\begingroup$ It can be for any usecase where i want share a 6 digit secret code with my client $\endgroup$ – Santhosh Feb 6 '20 at 5:09
  • $\begingroup$ Also nonce (number used once) - For this should i store the numbers i used in my database to verify i am using a unique number $\endgroup$ – Santhosh Feb 6 '20 at 5:13
  • $\begingroup$ The general idea is a poor way "to pass a 6 digit number which has to be kept very secret through a unsecured network". The best way for the receiving party to find the number from hash and key is to try the numbers until there's a math; sure that's very feasible, and (unless the hash is truncated) there likely will we a single solution. But why the complication? If we assume the key or hash won't leak, we simply could encipher the number and use the result instead of the hash. And if we assume the key and hash leak, well the number is compromised. $\endgroup$ – fgrieu♦ Feb 6 '20 at 6:48
  • $\begingroup$ So the only way is to use a secure connection. $\endgroup$ – Santhosh Feb 6 '20 at 7:27
1
$\begingroup$

Here at Crypto.SE, acquainted members would suggest you to look at AEAD - Authenticated Encryption with Associated Data. This is a type of encryption that guarantees the secrecy of your message, in addition to which, a "header" and their integrity. AEAD algorithms also help identify malformed ciphertext messages by including a "Tag" when performing encryption and verifying it at decryption.

Typical AEAD algorithms include AES-GCM, ChaCha20-Poly1305, etc. There should by python modules available for use in django (I went to your SO profile). At client-side JS however, only AES-GCM is usually available.

See https://tools.ietf.org/html/rfc5116

Now, needing encryption at application level is probably not as good a solution as having encryption at transport level - in this case, you should consider securing your connection with TLS (ver 1.2 or 1.3). This needs a certificate, which is around 1k USD for wildcard domain names, but could be cheaper for single-domain cases.

What you're describing looks more like a password-hashing algorithm, in which case, your nonce should be salt (nonce is only unique, where as salt must be random). There should also be a bcrypt or argon python module you can use.

Improve this answer
$\endgroup$
1
  • $\begingroup$ What i understand for fixed digits hashing is not recommended. Its not similar to a hashing a strong password. Hashing of strong messages is safer but dictionary time or only fixed digits type can be risky $\endgroup$ – Santhosh Feb 7 '20 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.