Secure Message API

Messages are authenticated with HMAC-SHA256... or are they?

Hint: The signing key is 16 bytes long.

API

• GET /sign?data=BASE64 — returns MAC for your data
• GET /verify?data=BASE64&mac=HEX — verifies MAC; if data contains admin=true, returns flag

Example

Signed message:

data: dXNlcj1kZW1vJnJvbGU9dmlld2Vy
mac:  b8ce6a59d3a3ff568c7b00cbb3a1a4b34e9b7bbb0c3fa2a2b6e474e871a61ada
decoded: user=demo&role=viewer

To get the flag, you need to verify a message containing admin=true with a valid MAC — but you don't have the key.