jeudi 24 décembre 2015

Is the nonce in a HMAC useful to increase the security, to generate a random number based on the seed?

To generate a number based on a seed, I written this code:

var crypto = require('crypto'),

//generate the crypto random token
clientToken = crypto.createHash("sha256").update(crypto.randomBytes(128)).digest('hex')
serverToken = crypto.createHash("sha256").update(crypto.randomBytes(128)).digest('hex'),

//generate the seed
hmac = crypto.createHmac('sha512', serverToken);
hmac.update(clientToken);
var seed = hmac.digest('hex'),

//generate the random number with a PRNG algorithm
prng = new require("seedrandom")(seed),
random = Math.floor(prng() * (100000000 - 10000)) + 10000;

//log the results
console.log("clientToken: ", clientToken);
console.log("serverToken: ", serverToken);
console.log("Seed     :   ", seed);
console.log("Random number:", random);

As you can see, I don't HMAC a nonce value and I would to know if digesting it, will add more security.

This could be the code updated with the nonce implementation added:

//generate the nonce by using a nanosecond timestamp
var hrtime = process.hrtime(),
nonce = (hrtime[0] * 1e9 + hrtime[1]).toString();
nonce = crypto.createHash("sha1").update(nonce).digest('hex');

//generate the seed
var hmac = crypto.createHmac('sha512', serverToken);
hmac.update(clientToken);
hmac.update(nonce);
var seed = hmac.digest('hex');

Adding the nonce, will increase the security ? An user that only knows the client token, could guess the hmac seed ? (With and without the nonce implementation)




Aucun commentaire:

Enregistrer un commentaire