Use Authentication using 2 encrypted strings

Question

so basically I am trying to log user in with a cookie and do not query DB to improve performance

here is a brief idea:

transmit everything via SSL
set a Global secret key A and secret key B
generate a random verification string on registration and password change
encrypt the verification string with A, store it in cookie
encrypt the verification string with B, store it in cookie
when user tries to login, I decrypt each string with A and B, compare if they match

I am wondering if it is a good idea if it is:

how can I actually do the encryption in Java, using bouncycastle ASE-256, Digest or whatever?

how much does this encryption/decryption process affect the performance, when compared with authentication by storing a session variable in a super fast DB like Redis

if it is not: what should I do..

score 2 · Accepted Answer · answered Mar 05 '13 at 17:36

2

You can simply encrypt a known value together with the authentication data, when you decrypt verify that the data is present in the authentication token (the cookie). No need to use two keys.

The speed difference with a database depends on the database configuration as well as the cryptography that is performed. I would rather opt for a proven scheme first and only invent your ownif performance leaves you no other choice.

Schemes as better verified on http://security.stackexchange.com.

answered Mar 05 '13 at 17:36

Maarten Bodewes

90,524
13
150
263

I thought about this first..but wouldn't exposing the known value in the cookie introduce a risk on user cracking out the secret key? – Matthew Yang Mar 05 '13 at 17:41
No, that would be a known plain text attack or replay attack, wich is not possible if crypto is correctly applied (which it never is, hence the remark about taking the other route first) – Maarten Bodewes Mar 05 '13 at 17:48
hmm...so are there any suggestions on a valid method might void the DB access? – Matthew Yang Mar 05 '13 at 17:58
or what encryption method should I be using? – Matthew Yang Mar 05 '13 at 18:02
@MatthewYang some kind of signed time stamp comes to mind, but that's just an initial thought. In other words, it will fail miserably if not worked out well... – Maarten Bodewes Mar 05 '13 at 23:34
You can accepts and promote my answer if it answers your question :) – Michael Apr 25 '13 at 02:57

Use Authentication using 2 encrypted strings

1 Answers1