title: Digital signature with node.js crypto
body: <p>Could someone provide a basic walkthrough on how to implement digital signature with node.js? I've googled but didn't get it yet. Say, I have an API and I wanna sign and verify every http request to it and response from it. That's how I currently imagine it, plz correct me where I'm wrong:</p>
  
  <p>1) I need to generate a random enough key for client, which will be used to sign requests;</p>
  
  <p>2) Resulting signature (provided via header) is an encrypted with that key hash of a string, which has to include:</p>
  
  <ul>
  <li>hash of the request body (to prevent tampering);</li>
  <li>timestamp;</li>
  <li>nonce;</li>
  <li>url;</li>
  <li>HTTP verb</li>
  </ul>
  
  <p>Then, the server would be able to check the authenticity of a message.</p>
  
  <p>Questions:</p>
  
  <p>1) What is the difference in this context between a nonce (some random value) and a timestamp (I've read a post where using both at the same time was advised)?</p>
  
  <p>2) Do I need to include eTag header to that string?</p>
  
  <p>3) What else, not listed above, should be included?</p>
  
  <p>4) Should I keep the same key on the API server, as on client and decrypt and check requests with it, or should the key, stored on the API server, and the key, stored on the server, which communicates with API for a private-public keys pair? If they do need to be a private-public keys keypair, how do I decrypt what was encrypted with private key, using public key (and vice versa) in node?</p>
  
  <p>Plz, correct what was wrong in my description and add, what I've missed. Thank you.</p>