I want to sign the calls to my REST API with a message authentication code(MAC), which algorithm is easily and comfortable to use in Java, php, Ruby and C#?
The longer Story:
My application(Play Framework 2.0) provides a very simple REST API, just a couple services that will be accessible by a limited and known* group of clients. Security is important here, also is ease of use for the clients.
(* known means they have to register with the application first, this is where they get there secret for the MAC, I have no Idea who they are and what technologies they use.)
I want to implement the following approach:
- Use SSL
- Sign the REST messages with a MAC
I implemented a test case where I used my password encrypter(Similar to the example code here) with PBKDF2WithHmacSHA1 for the signing. It took me some time to get the signing working, especially because I want to send the signature as an URL parameter and had to encode it two times to get it in the correct format.
The generated signature is a byte[] which I convert to a UTF-8 encoded String with org.apache.commons.codec.binary.StringUtils and then encode it again with java.net.URLEncoder to get a correct URL parameter. The solution works, but feels kind of stupid and overly complicated.
This experience brought me to this question, I want to make it easily and comfortable for my clients to use the service, but also very secure. So, what crypto algorithm do I choose for my signature? What is easy to implement for the most common web plattforms like Java, php, Ruby, C# and at least somehow usable in less common languages.
byte[]converted to a hexString is probably the easiest format to use for the signatures – hex characters [0-9a-f] don’t need special encoding. Apache Commons codec provides conversion methods under theHexclass.HMAC-SHA256 is the gold standard of HMAC algorithms, and should be present on any platform worth using.