IV key as a salt?

[egberts]

add a random salt to the encrypted epoch time, so you can verify that they validated the key?

I am not a cyrptography expert but I would like to think that I visualize some semblance of replayability there.

[62726164]

Hi. Thanks for the comment. The web service itself stores used signatures. Once a signature is used to login, it cannot be re-used later.

[hut8]

What if two websites use this? If a user has the same public key stored on both sites and logs in to site 1, then couldn't site 1 log into site 2 as the user?

[62726164]

Yes, that would be true. If the current time signing scheme was used on multiple websites and the user used the same keypair for both sites then that would work. I plan to switch to having users sign a nonce rather than the current time. In that case, only site 1 (and the user) would have the nonce. Thanks for the feedback.