This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Client Secret
Client Secret

Version management

Difference between version and

At line 1 added 32 lines
!!! Overview
[{$pagename}] ([OAuth 2.0] client_secret) is a [secret] used by the [OAuth Client] to [Authenticate] to the [Authorization Server].
The [{$pagename}] is a [secret] known only to the [OAuth Client] and the [Authorization Server].
[{$pagename}] must be sufficiently [random] to not be guessable.
Developers never include their [{$pagename}] in [OAuth Public Clients] (mobile or browser-based) [App]. Some folks suggest by using a longer string for the [{$pagename}] is a good way to indicate this, or prefixing the [{$pagename}] with “secret” or “private”.[2]
!! [{$pagename}] and [Entropy][1]
A method to generate a secure [{$pagename}] is to use a [cryptographically secure pseudorandom number generator] library to generate a 256-bit value and converting it to a [hexadecimal] representation.
A good sample [{$pagename}] which is 86 characters:
%%prettify
{{{
GBAyfVL7YWtP6gudLIjbRZV_N0dW4f3xETiIxqtokEAZ6FAsBtgyIq0MpU1uQ7J08xOTO2zwP0OuO3pMVAUTid
}}} /%
The reason for this length is that I wanted to support 512 [bits] for symmetric signature and [encryption] algorithms. For instance, I wanted to support [HS512] as a signature algorithm for [JSON Web Encryption]. Because [{$pagename}] have to have [entropy] of 512 bits or more to support [HS512], the length of the example above is 86, which is a result of encoding 512-bit data using [base64] [URL].
Regarding [entropy] for [symmetric Key Cryptography] [signature|Digital Signature] and [encryption] [algorithms], 16.19 Symmetric Key Entropy in [OpenID Connect Core 1.0] states as follows.
''In Section 10.1 and Section 10.2, keys are derived from the client_secret value. Thus, when used with symmetric signing or encryption operations, client_secret values [MUST] contain sufficient [entropy] to generate cryptographically strong keys. Also, client_secret values [MUST] also contain at least the minimum of number of octets required for [MAC] keys for the particular [algorithm] used. So for instance, for [HS256], the client_secret value [MUST] contain at least 32 octets (and almost certainly [SHOULD] contain more, since client_secret values are likely to use a restricted alphabet).''
And, 3.1. [alg] (Algorithm) Header Parameter Values for [JSON Web Signature] in [RFC 7518] (JSON Web Algorithms) states that [HS256] ([HMAC] using [SHA-256]) must be supported as a signature algorithm for [JWS]. As a logical consequence, any implementation claiming compliance with [OpenID Connect] is __required__ to generate client secrets with [entropy] of 256 [bits] or more.
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [Full-Scratch Implementor of OAuth and OpenID Connect Talks About Findings|https://medium.com/@darutk/full-scratch-implementor-of-oauth-and-openid-connect-talks-about-findings-55015f36d1c3|target='_blank'] - based on information obtained 2017-05-29-
* [#2] - [Client Secret|https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/|target='_blank'] - based on information obtained 2017-07-02
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop