Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading How are possible uses for X.509 (SSL) certificates denoted? on IT SE. It begins with:

X.509 certificates can be used for servers, clients, email, code signing and more applications. indicates that a certificate...

The image refers specifically to an incident in 2011, where a rogue certificate from Diginotar had code-signing capability. I wanted to remove dependence on external service Twitpic for the sake of URL persistence. In trying to do so, I noticed something I've seen often, and don't understand. In this context, it refers to I'm guessing that is because Twitpic uses Cloudfront as their content delivery network (CDN)?

I can't (easily) upload the image to IT SE, as Twitpic only offers a 150px square thumbnail I don't know if Twitpic does this for security, or for SEO purposes. If the latter, it would ensure that viewers visit the Twitpic site in order to see a larger version. To view the full sized image in my browser, there is a Cloudfront domain URL several portions appended. This is my question: What do key, Key-Pair-ID and Signature mean?

  1. key=409511&Expires=1358170888&
  3. Signature=ZLwi3pS71nfx0MzKMdFMQZYwYtKjzxnoIgLxDa6X16o3K7pjtywH-Sqm7rvZqe3XH0ELZb4fQffF5lWG2h2PF4ONGCoCL6zQKfr~Ep9raiUPM1pO1LbrUDZEJBoYSURAecyNJsctRd9wJgKoFnEkHnSfvsNexYx-Y91cTVmYPQc_

Is there a standardized nomenclature, and is it analogous to what is used for certificates, such as X.509 (SSL) which contain a keys and a signature? That was why I included so much information about the prior question, in case there were any actual or conceptual similarities.

Or does this pertain to authentication, instead of authorization?

share|improve this question
up vote 2 down vote accepted

It seems that Amazon is using this mechanism for authenticating requests to the CloudFront Servers. Read more here and here.

You generate a key pair using your Amazon account and sign certain URLs that point to private resourcesa and you distribute this signed URLs to the people you want to access your site. The parameters help identify the key that signed the URL(your private key) and the time until the URL can be accessed using this link.

This is how Amazon checks that you authorize the connection at that specific time.

share|improve this answer
Yes, I have seen this for URL's of the form too, which I thought probably meant AWS S3, like you said. Thank you. I need to read through your answer and URLs now! – Ellie Kesselman Jan 14 '13 at 17:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.