3 ms·
Why SigV4 is insufficient? It works across AWS’s SDK and seems to be safe as it is time bound (limited time to serve the request and each request signature incl
by niros_valtos 5y ago
Why SigV4 is insufficient? It works across AWS’s SDK and seems to be safe as it is time bound (limited time to serve the request and each request signature includes the timestamp).
- mhio 5y agoThe draft isn't AWS authorisation specific, Signature Version 4 is.
- orf 5y agoI think the question being asked is “why isn’t the spec just Sigv4”?
- mhio 5y agoThat was the information I was trying to (too quickly) highlight. AWS sig v4 is specifically for authorising AWS requests, it's not portable. The concepts in the draft are very similar so this looks like the generic internet version of the AWS signing concept. It looks like the draft involves Amazon people too but I'm not sure which one was chicken or egg. NovemberWhiskey's comment highlights the specific differences better than I.
- NovemberWhiskey 5y agoSigV4 is limited to symmetric HMAC-type signatures which require a shared secret; and many of the specifics are tightly linked to AWS concepts like regions, service names, amz headers and so on. Conceptually, SigV4 is not a whole lot different from a symmetric implementation of this draft; but the draft has support for public key signatures and binds to fewer AWS specificities.