Question

I’m writing a web service and I need to make sure only valid applications will use it (before I start managing a session for their users).

In order to achieve that I thought of using asymmetric key algorithm, but I’m not really sure how – what data to encrypt, how to manage the keys, etc. (my web service’s data isn’t that sensitive, I’m just trying to block casual trouble-makers).

Side note: I’m using .NET and found this class- RSACryptoServiceProvider to be useful, but any framework independent idea would be much appreciated.

Thanks.

Answer 1

Generally speaking, your web service could send a random value of some bytes (challenge) and expect a valid answer for it (response).
E.g. the response could be the SHA256 digest for the challenge and some secret bytes embedded in the application (salt).
.NET-Code sample here.