3 ms·

Where does the nonce go? I skimmed the REST API for S3 uploads and didn't see a mention of one other than possibly the date, and the date only has a granularit

by dfranke 17y ago

Where does the nonce go? I skimmed the REST API for S3 uploads and didn't see a mention of one other than possibly the date, and the date only has a granularity of one second.

cperciva 17y ago
There isn't a nonce in S3-REST, because it doesn't need one. PUT is idempotent -- it doesn't matter if an attacker replaces your data with an exact copy. If you're crazy enough to be issuing PUTs with different data, or PUTs and DELETEs, to the same object name within the time window before the request expires (yes, S3 checks the date/time for validity), an attacker could reorder your operations... but that's not actually a security flaw, since S3 itself is allowed to reorder operations (cf "eventual consistency"). All an attacker would be able to do in that case is break code which is already broken.
- dfranke 17y ago
  Okay, good point about eventual consistency. I maintain that Amazon really ought to do a better job of explaining this, though. I assume the typical window for consistency is significantly shorter than the leeway that they allow for clock skew when validating the date.
  - cperciva 17y ago
    I assume the typical window for consistency is significantly shorter than the leeway that they allow for clock skew when validating the date. As long as S3 remains connected, it should reach consistency immediately (for PUTing an object which doesn't exist yet) or within a few seconds (for PUTing a new version of an object which already exists or DELETEing an object). But there is currently no way to determine if S3 is connected, so you can't rely on the "typical" consistency window. BTW, you can specify how much clock skew S3 should permit when you construct your requests.
- NateLawson 17y ago
  However, if the messaging layer provided ordering and uniqueness guarantees, that same code could not be compromised. Also, your comments seem to be specific to SimpleDB. Is it possible other components that depend on AWS-Auth have related issues?

by dfranke 17y ago

Where does the nonce go? I skimmed the REST API for S3 uploads and didn't see a mention of one other than possibly the date, and the date only has a granularity of one second.

cperciva 17y ago

There isn't a nonce in S3-REST, because it doesn't need one. PUT is idempotent -- it doesn't matter if an attacker replaces your data with an exact copy. If you're crazy enough to be issuing PUTs with different data, or PUTs and DELETEs, to the same object name within the time window before the request expires (yes, S3 checks the date/time for validity), an attacker could reorder your operations... but that's not actually a security flaw, since S3 itself is allowed to reorder operations (cf "eventual consistency"). All an attacker would be able to do in that case is break code which is already broken.

dfranke 17y ago
Okay, good point about eventual consistency. I maintain that Amazon really ought to do a better job of explaining this, though. I assume the typical window for consistency is significantly shorter than the leeway that they allow for clock skew when validating the date.
- cperciva 17y ago
  I assume the typical window for consistency is significantly shorter than the leeway that they allow for clock skew when validating the date. As long as S3 remains connected, it should reach consistency immediately (for PUTing an object which doesn't exist yet) or within a few seconds (for PUTing a new version of an object which already exists or DELETEing an object). But there is currently no way to determine if S3 is connected, so you can't rely on the "typical" consistency window. BTW, you can specify how much clock skew S3 should permit when you construct your requests.
NateLawson 17y ago
However, if the messaging layer provided ordering and uniqueness guarantees, that same code could not be compromised. Also, your comments seem to be specific to SimpleDB. Is it possible other components that depend on AWS-Auth have related issues?