Question

I have a competition that people can enter with a secret code they discover in an Android app. The method I have chosen to ensure only people who have purchased the app can enter the competition is to use shared secret encoded(encrypted?) with HMAC SHA256.

So my secret will be encrypted in C in the Android app (using Crypto++, do you have any suggestions of a beter SHA library? I am finding Crypto++ really hard to use).

This is just an example:

Unencrypted shared secret = "my shared secret"  
Unencrypted secret code   = "abcdef"  
Encrypted shared secret   = "dsgdfgdfgdfgfdgf"   
Encrypted shared secret   = "ddffgdgdf"

So when the user discovers the secret code they will be taken to a webpage(python script) & the HMAC encrypted shared secret will be passed as a CGI parameter:

http://mysite/competition.py?encodedSecret=3dfdfdg343jkfjk390kl

Then my python script will look at the CGI parameter & decrypt it to get the shared secret(to verify that the competition entry is from a user who has the app) & the secret code(to see if the user has won anything).

My Question is: Is it possible for a python script(using hashlib module) to decrypt something that was encrypted in C using Crypto++?

Answer 1

When using a hash that way, normally you would pass the secret code (in plaintext) and the hash of both the secret code and the shared secret to your web site. The web site can then perform the same hash (as it knows the shared secret), and verify that the result is the same.

‘Cracking’ the hash on your server is a lot of extra work, and I don’t see how it adds any security.

If you must not transmit the code in plaintext, it would be much more efficient to use your shared secret as the key in a symmetric encryption algorithm (e.g. AES).