To generate a number based on a seed, I written this code:
var crypto = require('crypto'),
//generate the crypto random token
clientToken = crypto.createHash("sha256").update(crypto.randomBytes(128)).digest('hex')
serverToken = crypto.createHash("sha256").update(crypto.randomBytes(128)).digest('hex'),
//generate the seed
hmac = crypto.createHmac('sha512', serverToken);
hmac.update(clientToken);
var seed = hmac.digest('hex');
//generate the random number
var Random = require("random-js"),
random = new Random(Random.engines.mt19937().seedWithArray(seed));
//log the results
console.log("clientToken: ", clientToken);
console.log("serverToken: ", serverToken);
console.log("Seed : ", seed);
console.log("Random number:", random.integer(1, 10000000));
As you can see, I don't HMAC a nonce value and I would to know if digesting it, will add more security.
This could be the code updated with the nonce implementation added:
//generate the nonce
nonce = (+new Date()).toString(); //timestamp
nonce = crypto.createHash("sha1").update(nonce).digest('hex');
//generate the seed
var hmac = crypto.createHmac('sha512', serverToken);
hmac.update(clientToken);
hmac.update(nonce);
var seed = hmac.digest('hex');
Adding the nonce, will increase the security ? An user that only knows the client token, could guess the hmac seed ? (With and without the nonce implementation)
Aucun commentaire:
Enregistrer un commentaire