0
$\begingroup$

Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client?

My guess is:

  1. AWS access key ID is a form of unique user/account identifier
  2. AWS secret key is like private key
  3. When AWS CLI sends a API request, the payload is signed by generating an HMAC with the secret key as the key
  4. The HMAC, AccessKeyID and the payload is sent to AWS service
  5. AWS service verifies the identity of the sender and integrity of the message by recomputing the HMAC code.
  6. If it's verified the request is accepted and processed.

Is this accurate? Why does AWS do this instead of asking user to upload a RSA public key? Why is this safer?

EDIT: I think this is how it works -- https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#ConstructingTheAuthenticationHeader

|improve this question
$\endgroup$
  • $\begingroup$ While I don't know whether your description of the scheme is accurate, I can point out one advantage: Speed. HMAC is really fast compared to asymmetric signing algorithms (even when comparing to EcDSA), which obviously uses less ressources on the server side, but also allows small clients like microcontrollers used in IoT to create requests. Furthermore, HMAC is easier to use right than most asymmetric schemes since there are less fatal implementation flaws like nonce reuse. $\endgroup$ – VincBreaker Mar 18 at 11:21
1
$\begingroup$

Your description is accurate. I can't speak on behalf of Amazon but I'm sure the main reason why they chose to use this rather than using X.509 certificates; and I mean it with all due respect: People are stupid.

The main targeted user base has no knowledge about this sort of thing (just look at the thousands of "open" MongoDB-instances where you can read all the personal data of millions of people without authentication), so requiring the creation of private keys and public certificates will lead to a lot of troubles, security and support wise. With the implementation as it is Amazon can provide you with keys that are created by using "good random" and a short documentation how to use it to access their services.

Just google for any description, how to set up TLS-client authentication that includes the creation of the certificates and compare it with the documents explaining how to set up the same for AWS. Amazon wants you to be able to use their services as fast as possible so you can start paying money as fast as possible and don't bother looking for other service providers that might offer the same.

Another reason is that asymmetric ciphers require by large factors more resources than symmetric ciphers or hashing algorithms without any additional benefit for this particular use case. Amazon already knows who you are and doesn't need all the fancy stuff that can be implemented with X.509 (key usages, CRL-lists, etc.)

|improve this answer
$\endgroup$
  • 3
    $\begingroup$ Far be it from me to defend Amazon's unscrupulous business practices and concentration of power—but that's not what this question is about. You say that there's a lot of complexity in X.509 and the tooling around it and computational cost; and you say that it provides no additional benefit for this particular use case over HMAC authenticators. Can you expand on those parts—what would a public-key variant cost_ what properties could it provide, why doesn't the Amazon use case need those properties—and trim the derision of Amazon customers' intelligence? $\endgroup$ – Squeamish Ossifrage Mar 18 at 23:17
1
$\begingroup$

AWS has designed their own custom authentication algorithm. You are referencing the older signature version (v2), a newer one (v4) was released in 2014. Details are outlined here: Authenticating Requests (AWS Signature Version 4) . A major difference is that the request is not signed with the secret itself, but with a signing key which is generated using the secret. It also uses HMAC-SHA256 for signing.

Signature Generation

Why does AWS do this instead of asking user to upload a RSA public key? Why is this safer?

Using asymmetric keys would be safer since AWS would only store a public key instead of the secret, which is stored by both the user and AWS.

|improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.