title: github-like authentication for api in rails
body: <p>I am creating an API that will only be used by specific devices.  I'd like to authenticate using a public and private key pair, similarly to the way that github authenticates using SSH.</p>
  
  <p>The scheme I think would work is as follows:</p>
  
  <ol>
  <li>The device will request authorization with it's ID.</li>
  <li>The server finds the public key of the device by the provided ID and encrypts a random string.  The string is sent to the device.</li>
  <li>The device receives the encrypted string and decrypts it with its private key, sending the result back to the server.</li>
  <li>The server checks the string to make sure it matches and sets the correct session variables for the device if the check was correct.</li>
  </ol>
  
  <p>All of this is over an SSL connection, so step 3 can't be snooped and used to authenticate again.  Some devices will not need this type of authorization, so the SSL connection can't just verify that the public key of the device was generated by the server's certificate authority and close the connection if it was not.</p>
  
  <p>First of all, does this make sense, or is there a better way?  And second - is there some gem that already does this in rails?  It seems like this would be a somewhat common method of doing things.</p>