Microid mailing list

[Peter Saint-Andre <stpeter AT jabber.org>]

<snip/>

Regarding HMAC, read this (user-friendly intro):

http://en.wikipedia.org/wiki/HMAC

HMAC is not a hashing algorithm like the SHA family, it is a Message
Authentication Code (MAC) function. So HMAC uses a secret key in the MAC
generation process. For our purposes the question is: whose secret key?
I guess for microid it would be the key of the entity that generates the
microid. So if I visit yedda.com or whatever, the microid is generated
by Yedda and so Yedda uses its key in the microid generation process.
(It could also use a key provided by the other party, naturally, but in
consumer-oriented applications that may be less likely to succeed.)

Thoughts?

Peter

-- 
Peter Saint-Andre
Jabber Software Foundation
http://www.jabber.org/people/stpeter.shtml

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature