Encode/Decode an id using a salt

Question

I have an api that I want allow users to send an id to, but I don't want the id to be visible over a network. I decided that I will then generate a secret for the user which will be used as a salt to hash the id they send. They will then take that id and secret to connect to my api.

The server is written with node.js, and the client will be written in c#, so I need a way so that both languages can encode/decode if they know the secret.

So...

C# will encode the id
Node.js will decode the id

I have never create an salt like this before, so what method(s) can I use to do this? I think eventually I will be using more just C# to encode the id, so methods for other languages would be awesome too!

You said "visible over a network". Exactly what or who are you trying to hide the value from? — Jason P, May 12 '15 at 19:53
I want to hide it from someone on the network and the user using the application. The application will be either a mobile app or a desktop app. — Get Off My Lawn, May 12 '15 at 19:54
You should assume that (unless you're in _total_ control of the machine the client application is running on), that they can see everything on it anyway. — James Thorpe, May 12 '15 at 19:56
`id` refers to a primary key usually the registered application id. So if you see the application Id on the network you could create an app and use that id to write to that application instead of your own application. — Get Off My Lawn, May 12 '15 at 19:56

score 1 · Accepted Answer · edited May 23 '17 at 11:43

1

If you want to hide information from prying eyes, use TLS (as suggested in the comments). Also from the comments, it looks like what you want is not to hide the ID but a way to sign messages so you can make sure the messages you receive are legal messages from your application. In this case, each message you receive will come with a hash, that hash is computed from the message and the secret key. Then your server will try to compute the same hash from the received message and the stored secret key and then compare it to the received hash. A salt has a different use. (this was intended as a comment but didn't fit)

See:

edited May 23 '17 at 11:43

Community

1
1

answered May 12 '15 at 20:10

Josep Valls

5,483
2
33
67

This sound like a legit way to do it, basically I would send a token along with the request that my server could build. – Get Off My Lawn May 12 '15 at 20:13
@TheBoogieMan if that's what you want its called HMAC: http://en.wikipedia.org/wiki/Hash-based_message_authentication_code – Josep Valls May 12 '15 at 20:15

Encode/Decode an id using a salt

1 Answers1