For an example of just how non-trivial this is, take a look at the version history of how AWS requires signing API requests. Version 1 had a serious flaw [0] r

For an example of just how non-trivial this is, take a look at the version history of how AWS requires signing API requests. Version 1 had a serious flaw [0] related to how the string to be HMAC'd was constructed. It used an appropriate and well-studied cryptographic building block (HMAC-SHA1) and is an excellent case study in why using the right building blocks isn't sufficient to have a secure protocol. Version 2 fixed the issues with version 1, but it in turn has been superseded by v4 [1] (no idea what happened to v3). A v4 signature uses a derived key for the HMAC, and included in the derivation is the current date as well as the AWS region you're making the call to. Beyond time-based replay attacks, this also prevents an attacker from capturing a valid request to eg US-EAST-1 and replaying that request in a different AWS region. 0: http://www.daemonology.net/blog/2008-12-18-AWS-signature-version-1-is-insecure.html http://www.daemonology.net/blog/2008-12-18-AWS-signature-ver... 1: https://docs.aws.amazon.com/general/latest/gr/sigv4_changes.html https://docs.aws.amazon.com/general/latest/gr/sigv4_changes....