3 ms·
> Serialize the array and encrypt it with AES using a key that you keep in the server. When you receive a POST, decrypt the token and check if the information i
by AnIrishDuck 13y ago
> Serialize the array and encrypt it with AES using a key that you keep in the server. When you receive a POST, decrypt the token and check if the information it contains matches the client's details. If it matches, you know that it was you who generated that token.
No. You want to use a MAC for this, not encryption. Encryption does not guarantee authenticity, MACs do. It is very possible to predictably alter the contents of encrypted text; many of the early Matasano cryptopals challenges revolve around doing precisely this.
- kijin 13y agoEncryption does not preclude the use of MAC, and MAC does not replace the use of encryption. My preferred solution is to add a MAC to my data and encrypt them both.
- AnIrishDuck 13y agoBetter, but still slightly wrong. You really want to encrypt, then MAC the ciphertext. Then, before decrypting, check that MAC and don't act at all if it is invalid [1]. 1. http://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-encrypt-then-mac http://crypto.stackexchange.com/questions/202/should-we-mac-...