mardi 22 décembre 2015

Is the nonce in a HMAC useful to increase the security, to generate a random number based on the seed?

To generate a number based on a seed, I written this code:

var crypto = require('crypto'),

//generate the crypto random token
clientToken = crypto.createHash("sha256").update(crypto.randomBytes(128)).digest('hex')
serverToken = crypto.createHash("sha256").update(crypto.randomBytes(128)).digest('hex'),

//generate the seed
hmac = crypto.createHmac('sha512', serverToken);
hmac.update(clientToken);
var seed = hmac.digest('hex');

//generate the random number
var Random = require("random-js"),
random = new Random(Random.engines.mt19937().seedWithArray(seed));

//log the results
console.log("clientToken: ", clientToken);
console.log("serverToken: ", serverToken);
console.log("Seed     :   ", seed);
console.log("Random number:", random.integer(1, 10000000));

As you can see, I don't HMAC a nonce value and I would to know if digesting it, will add more security.

This could be the code updated with the nonce implementation added:

//generate the nonce
nonce = (+new Date()).toString(); //timestamp
nonce = crypto.createHash("sha1").update(nonce).digest('hex');

//generate the seed
var hmac = crypto.createHmac('sha512', serverToken);
hmac.update(clientToken);
hmac.update(nonce);
var seed = hmac.digest('hex');

Adding the nonce, will increase the security ? An user that only knows the client token, could guess the hmac seed ? (With and without the nonce implementation)




Aucun commentaire:

Enregistrer un commentaire