1
$\begingroup$

Can someone throw light on the differences between tokens and secret keys? I understand that "tokens" are crypto artefacts "introduced" into a system by an external party in order to authenticate whereas keys can be either generated on the device (for. eg a key pair in case of asymmetric cryptography & corresponding public key can be used externally to authenticate) or a secret symmetric key can be imported or generated on device and shared with an external party for authentication. Are tokens then "wrapped" secret keys? How are they structurally dfferent to keys( a string of random bits)?

Thanks

Improve this question
$\endgroup$
2
  • $\begingroup$ You specifically mean tokens in the sense of message authentication (MAC/HMAC)? A version 4 UUID is also a kinda token, and cryptographically generated too. $\endgroup$
    – Paul Uszak
    Nov 16, 2021 at 13:37
  • $\begingroup$ I was looking from a device authentication perspective $\endgroup$
    – tweet
    Nov 18, 2021 at 9:48

1 Answer 1

Reset to default
1
$\begingroup$

Are tokens then "wrapped" secret keys?

Tokens encode information needed to authenticate someone and/or authorize some action. These information are protected by a secret key, but public-key-based tokens aren't excluded.

At least that's how my organization use cryptographic tokens.

How are they structurally dfferent to keys (a string of random bits)?

Tokens are structured (i.e. having format), keys are unstructured (symmetric) or structured according to the algorithm (public-key).

Improve this answer
$\endgroup$
2
  • $\begingroup$ IF symmetric key based tokens are used, then does it not restrict the device holding the token to be authenticated only by the party which also shares this secret? As in, from a security perspective it only makes sense to have a one-one authentication right? Probably the person who put the secret into the device is the only one who can authenticate it? I somehow think PKI would be behind such authentication and tokens should be "more" PKI based?? What application does a token have? Terminology wise tokens are only for authentication? $\endgroup$
    – tweet
    Nov 18, 2021 at 9:53
  • 1
    $\begingroup$ @tweet Token can be either symmetric-key based or public-key based, this is an engineering choice, my organization just happen to choose symmetric key. Token have many applications, an exhausive listing would be overly verbose for this answer, authentication and authorization are the best-known applications of it. $\endgroup$
    – DannyNiu
    Nov 18, 2021 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.