You don't need any special tool but just a little fantasy. A secret key could be any file (even an image could do the job) with any length that should be really hard to guess and protected from untrusted access. The authentication procedure needs to compute an MD5 hash for that file and it's complexity (time of execution) is linear with the length of the secret key file. For this reason, as long as the size of the secret key is not known, even a few dozen bytes would do the job perfectly without security hazards and will reduce the authentication overhead. Note that both the module and the servlet engine must use exactly the same secret key (binary copy).
|