Broker

<a href='#crh-start'></a><a href='#crh-data-%7B%22processed%22%3A%20%5B%22https%3A//github.com/AzureAD/azure-activedirectory-library-for-objc/pull/232%23discussion_r21695061%22%5D%2C%20%22comments%22%3A%20%7B%22Pull%20b1af80b6a90386ea9a85f16634df8220643b54fe%20ADALiOS/ADALiOS/ADAuthenticationContext.m%2051%22%3A%20%7B%22html_url%22%3A%20%22https%3A//github.com/AzureAD/azure-activedirectory-library-for-objc/pull/232%23discussion_r21695061%22%2C%20%22comments%22%3A%20%5B%7B%22body%22%3A%20%22No%20action%20but%20to%20think%20about%3A%20This%20is%20a%20digest%20hash%20check.%20Caller%20could%20replace%20hash%20and%20modify%20message.%20Adal%20will%20say%20hashes%20are%20ok%20and%20move%20to%20decrypt%20step.%20Caller%20can%20make%20up%20multiple%20fake%20calls%20to%20get%20more%20infor%20about%20app%27s%20key.%20hmac%20gives%20more%20security%20since%20it%20will%20fail%20to%20validate%20if%20message%20changed.%22%2C%20%22created_at%22%3A%20%222014-12-11T18%3A07%3A59Z%22%2C%20%22user%22%3A%20%7B%22avatar_url%22%3A%20%22https%3A//avatars.githubusercontent.com/u/466805%3Fv%3D3%22%2C%20%22html_url%22%3A%20%22https%3A//github.com/omercs%22%7D%7D%5D%2C%20%22title%22%3A%20%22File%3A%20ADALiOS/ADALiOS/ADAuthenticationContext.m%3AL192-245%22%7D%7D%7D'></a>
<a href='https://www.codereviewhub.com/'><img src='http://www.codereviewhub.com/site/github-bar.png' height=40></a>
- [ ] <a href='#crh-comment-Pull b1af80b6a90386ea9a85f16634df8220643b54fe ADALiOS/ADALiOS/ADAuthenticationContext.m 51'></a> <img src='http://www.codereviewhub.com/site/github-remaining.png' height=16 width=60>&nbsp;<b><a href='https://github.com/AzureAD/azure-activedirectory-library-for-objc/pull/232#discussion_r21695061'>File: ADALiOS/ADALiOS/ADAuthenticationContext.m:L192-245</a></b>
- <a href='https://github.com/omercs'><img border=0 src='https://avatars.githubusercontent.com/u/466805?v=3' height=16 width=16'></a> No action but to think about: This is a digest hash check. Caller could replace hash and modify message. Adal will say hashes are ok and move to decrypt step. Caller can make up multiple fake calls to get more infor about app's key. hmac gives more security since it will fail to validate if message changed.


<a href='https://www.codereviewhub.com/AzureAD/azure-activedirectory-library-for-objc/pull/232?mark_as_completed=1'><img src='http://www.codereviewhub.com/site/github-mark-as-completed.png' height=26></a>&nbsp;<a href='https://www.codereviewhub.com/AzureAD/azure-activedirectory-library-for-objc/pull/232?approve=1'><img src='http://www.codereviewhub.com/site/github-approve.png' height=26></a>&nbsp;<a href='https://github.com/AzureAD/azure-activedirectory-library-for-objc/pull/232'><img src='http://www.codereviewhub.com/site/github-refresh.png' height=26></a>
<a href='#crh-end'></a>
wrong key