Isn't that like ACME?
Two related ideas, different jobs
ACME, the protocol behind Let's Encrypt, is designed to establish TLS certificates. HashBack, in contrast, is simpler in operation because both sides already have TLS working.
| Question | ACME | HashBack |
|---|---|---|
| Number of transactions needed | 3 | 2 |
| General-purpose API authentication | No | Yes |
| Works without TLS already configured | Yes | No |
| Useful for establishing TLS | Yes | No |
🦔 Hashbert says: “ACME helps put the lock on the door. HashBack uses the lock. Both jobs matter, but they are not the same job. Also, I strongly recommend the lock.”
HashBack needs TLS first
HashBack relies on TLS to reassure the server that the verification hash came from the site the client controls. Without valid TLS on both sides, the protocol cannot provide its intended identity check.
In that sense, HashBack only works because ACME and Let's Encrypt made it possible. HashBack only works because TLS protection is now widespread and automated, giving it the trustworthy channel it needs to build on.
Thank you ACME!
🦔 Hashbert says: “HashBack is just like ACME, only fewer coyotes are maimed.”