How are cryptographic tokens and secret keys different?

3/16/23, 12:30 PM

Can someone throw light on the differences between tokens and secret keys? I understand that "tokens" are crypto artefacts "introduced" into a system by an external party in order to authenticate whereas keys can be either generated on the device (for. eg a key pair in case of asymmetric cryptography & corresponding public key can be used externally to authenticate) or a secret symmetric key can be imported or generated on device and shared with an external party for authentication. Are tokens then "wrapped" secret keys? How are they structurally dfferent to keys( a string of random bits)?

Thanks

0 + 0

keys

Paul Uszak

3/16/23, 1:37 PM

You specifically mean tokens in the sense of message authentication (MAC/HMAC)? A version 4 UUID is also a kinda token, and cryptographically generated too.

3/18/23, 9:48 AM

I was looking from a device authentication perspective

Score:0

Crypto

DannyNiu

3/16/23, 1:37 PM

Are tokens then "wrapped" secret keys?

Tokens encode information needed to authenticate someone and/or authorize some action. These information are protected by a secret key, but public-key-based tokens aren't excluded.

At least that's how my organization use cryptographic tokens.

How are they structurally dfferent to keys (a string of random bits)?

Tokens are structured (i.e. having format), keys are unstructured (symmetric) or structured according to the algorithm (public-key).

0 + 0

3/18/23, 9:53 AM

IF symmetric key based tokens are used, then does it not restrict the device holding the token to be authenticated only by the party which also shares this secret? As in, from a security perspective it only makes sense to have a one-one authentication right? Probably the person who put the secret into the device is the only one who can authenticate it? I somehow think PKI would be behind such authentication and tokens should be "more" PKI based?? What application does a token have? Terminology wise tokens are only for authentication?

DannyNiu

3/18/23, 10:43 AM

@tweet Token can be either symmetric-key based or public-key based, this is an engineering choice, my organization just happen to choose symmetric key. Token have many applications, an exhausive listing would be overly verbose for this answer, authentication and authorization are the best-known applications of it.