title: private key protection for Online signatures
body: <p>Let's say we have a group of id/signature pairs like:</p>
  
  <pre><code>https://picasaweb.google.com/${ID1}?authkey=${SIGNATURE1}
  https://picasaweb.google.com/${ID2}?authkey=${SIGNATURE2}
  https://picasaweb.google.com/${ID3}?authkey=${SIGNATURE3}
  https://picasaweb.google.com/${ID4}?authkey=${SIGNATURE4}
  ....
  </code></pre>
  
  <p>It is one way picasa shares the links, so they are all persistent.</p>
  
  <p>If we can collect thousands or millions of those id/signature pairs, does it make the private key vulnerable? That we can generate signature for any new ID?</p>
  
  <p>( Assuming the encryption method is sha1 or sha256. What if there is a salt or not?)</p>
  
  <p>( picasa is just an example, please don't target at picasa. It is a general question as we saw many sites are using this method. )</p>
  
  <p>( Let's say the signature is generated by this method: <a href="https://stackoverflow.com/questions/10859526/hmac-sha1-signature-in-java">HMAC SHA1 Signature in Java</a> )</p>