3 ms·
Can you expand on that? For example AWS uses HMACs for signatures, what kind of scheme would you propose?
by aschobel 16y ago
Can you expand on that?
For example AWS uses HMACs for signatures, what kind of scheme would you propose?
- dekz 16y agoYou digest and sign, not just digest.
- Xk 16y agoThe key difference here is one between a message authentication code [1] and digital signature [2]. A digital signature uses public key cryptography: one person can generate and sign messages, everyone else can verify. A common one is the DSA[3] -- but there are many others, including freakishly fast elliptical curve versions. [1] http://en.wikipedia.org/wiki/Message_authentication_code http://en.wikipedia.org/wiki/Message_authentication_code [2] http://en.wikipedia.org/wiki/Digital_signature http://en.wikipedia.org/wiki/Digital_signature [3] http://en.wikipedia.org/wiki/Digital_Signature_Algorithm http://en.wikipedia.org/wiki/Digital_Signature_Algorithm
- aschobel 16y agoThanks for the clarification, I guess folks (AWS) have gotten sloppy with semantics.
- throw_away 16y agoI think the difference between AWS and the PS3 is that in the PS3's case, every single PS3 has to be able to validate the authentication code, whereas in AWS's case, only AWS needs to validate the code, so the secret material is only shared between a particular customer and AWS, but not with everyone else. It's not the same use case. I agree, though, that they have been a little sloppy with the terminology. Some of their APIs refer to "Signature"s, when they should say "Authentication Code"s. I think, though, that this may have led to even more customer confusion than the current situation, as most people aren't aware of the difference between HMACs and signatures.