Can you help?
Can you perform a security analysis?
Do you know security and cryptography?
| 🤨 | Was switching from PBKDF2 to a single salted SHA‑256 the right call for this threat model? |
| 🤔 | Is the two‑transaction model cryptographically sufficient, or does ACME’s extra initiation step close an attack vector I haven’t considered? |
| 🤔 | Should receiving services validate the entropy, uniqueness and freshness of the Unus value? |
| 🤔 | Is using a fixed, public salt with SHA‑256 appropriate for this protocol’s goals? |
| âť“ | Are there any attack scenarios where an adversary could trick the server into fetching a malicious verification hash URL? |
| 🧙‍ | Does the protocol adequately protect against replay attacks if the client publishes the same verification hash twice? |
| 🤔 | Is the verification hash sufficiently bound to the intended destination host? Is the "Host" value in the JSON enough? |
| 🤨 | Is it safe to assume that TLS identity guarantees are symmetric between client and server in all deployment environments? |
| 🤦‍ | Are there any risks if the either side is behind a reverse proxy or CDN that terminates TLS? |
| âť” | Is a fixed salt ever a liability? |
| âť” | Should the salt be versioned or rotated over time? |
| âť“ | Should the JSON claim include an explicit expiration time or maximum validity window? |
| 🤦‍ | Should the JSON claim include a client identifier beyond the verification URL? |
| ❔ | Should servers rate‑limit or throttle verification‑hash fetches to avoid abuse? Could throttling enable a denial-of-service attack? |
| 🕵️‍ | Should clients delete verification hashes after successful authentication? |
| 🤔 | Is this protocol simple enough to be formally modelled and would that be worthwhile? |
| ❔ | Are there any weaknesses or issues I haven’t considered? |
If you've found any issues with my draft, please raise an issue on the project's GitHub.
🦔 Hashbert says: “If anything looks suspicious, prod it gently. Preferably with a stick.”
Write a library
I've made a start with a dot-net library that implements the core of the exchange. I plan to extend this into a reusable module you can drop into any dot-net web service. Can you help the project by implementing the exchange into other frameworks?
🦔 Hashbert says: “I dream of a world where every language has a HashBack library and none of them segfault.”
Sponsor me! 💰💲🤑💲💰
Would you like to support ongoing development?
The exact mechanism is still to be discussed — but if you're interested, please let me know.
🦔 Hashbert says: “If you help HashBack, you help me. And I am adorable.”