Geek asks and answers

How to create a time-limited hash / key?

I am trying to create a time-limited key for use in one of my applications. The key is used to unlock certain bits of functionality in the application.

My thinking so far

for generation: cryptographic hash various bits of information, I need + key generation date

for verification: cryptographic hash various bits of information that I need + date now

if all information is the same and given the same, I get the same value

But,

this means that the key will only work on a specific date. What I want is a key valid for the next 24 hours (or renewal of this, a few days / week / month).

I can extend the period, but it is always possible to generate a key shortly before the end of the period, for example, the last day of the month for the month.

Firstly, is this an acceptable way in general? If so, how to do it?

I know that "winding" hours ago will defeat the system - but I'm still interested in getting some opinions

I read How to create a time-limited key or password without saving data , which is a similar problem.

+3
source share
1 answer

You can make part of the token expiration date and authenticate all data with a MAC , such as HMAC:

token = data ":" expiration ":" HMAC(key, data ":" expiration)

, , , MAC .

- , MAC , MAC .

+5

More articles:


All Articles