How does AWS authentication work?

Question

AWS APIs use access key ID and secret access key for authenticating the API calls. How exactly does it work and how is it different from SSH ?

Answer 1

The AWS API requires you to sign every HTTP request. The signature gives you two properties: authenticity and integrity.

It authenticates you because a valid signature can only be produced by someone who has the keyID/secret pair. It gives you integrity since the the request is first canonicalized (transformed to a standard form) and then signed using HMAC. Any modification to the message will result in the original signature being invalidated.

AWS signatures provide a defense in depth mechanism to TLS's integrity.

Some key differences follow. SSH is using asymmetric crypto as well while the AWS API is using a symmetric only. SSH will use key exchange and cipher negotiation while AWS does no such thing apart from using TLS. AWS authentication is "bolted on" HTTP while SSH is a complete protocol.

About how it works. This is all in the AWS docs, but here is a short summary. You construct your request, then you calculate a canonicalized form and finally use your key/secret to sign it. You add the signature to your original request and send it to AWS. The server will process your request: calculate the canonicalized form, fetch your secret from their storage, calculate the signature and compare it to the one you sent. If they match you are almost good to go.

Another thing they do is check the time and make sure this request is not being replayed. When you calculate the canonicalized form you also need to add the current date to it. AWS will check this date to make sure it is within an acceptable window. This limits replay to the given window.

Answer 2

Here's some docs from AWS that directly answer your question:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAuthentication.html

https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html

Here's a copy / paste of a very quick summary of the authentication techniques:

Authorization = "AWS" + " " + AWSAccessKeyId + ":" + Signature;

Signature = Base64( HMAC-SHA1( UTF-8-Encoding-Of(YourSecretAccessKey), UTF-8-Encoding-Of( StringToSign ) ) );

StringToSign = HTTP-Verb + "\n" +
    Content-MD5 + "\n" +
    Content-Type + "\n" +
    Date + "\n" +
    CanonicalizedAmzHeaders +
    CanonicalizedResource;

CanonicalizedResource = [ "/" + Bucket ] +
    <HTTP-Request-URI, from the protocol name up to the query string> +
    [ subresource, if present. For example "?acl", "?location", or "?logging"];

CanonicalizedAmzHeaders = <described below>

This serves as much as a reference for me as it does for you and others.

Answer 3

SSH key pairs are used just to authenticate against a SSH server. You need a public private key pair to successfully authenticate. The encryption otherwise happens via a key established using key exchange.

AWS access key ID and the secret key are not for simply authenticating against AWS authentication service. My guess is its the case as API calls are stateless. Remember that the key pair consists of a key ID and a secret access key. Plainly speaking, your key ID is something like a username(and not a public/private key) while your secret access key is used to sign the requests made by your client.

Just like SSH, if you have a valid access key but not a valid secret key, your requests will fail because they won't be correctly signed. You can refer the AWS documentation for reference.

I would say that the AWS Keys are also based on the same concept (PKI) as SSH or even SSL but the eventual implementation of the authentication system would be different.