Rolling API Tokens: A Thought Experiment
Daryl Lim and Zhi Kai examines a thought experiment on Rolling API Tokens, leveraging the Double Ratchet Protocol to eliminate long-lived secrets through continuous key rotation.
Summary
Architecture and Background
Daryl Lim, Zhi Kai present 'Rolling API Tokens: A Thought Experiment' at DEF CON SG1 CSIT Village, detailing technical frameworks, attack surfaces, and core methodologies in api-security, token-security, cryptographic-protocols, session-management.
Vulnerability Analysis
The technical analysis dissects structural design flaws, protocol vulnerabilities, and edge cases uncovered during rigorous research.
Exploitation and Demonstrations
A thought experiment on Rolling API Tokens, leveraging the Double Ratchet Protocol to eliminate long-lived secrets through continuous key rotation.
Remediation and Defensive Strategies
Security practitioners and defenders receive actionable defensive controls, hardened configurations, and threat detection strategies to mitigate impact.
Related talks
CSIT Village·22 min
Poh Cai Min · Shawn Pang
Poh Cai Min and Shawn Pang examines grammar-based fuzzing made painless.
BalCCon - Balkan Computer Congress·39 min
Amit Sharma
Explores balCCon2k23 - Amit Sharma - API Security in the world of Microservices and evaluates key implications for security practitioners.
Black Hat·6 min
Analysts investigate attack surfaces and defenses concerning Modernizing API Security.