0

How does Amazon Web Services generate SSH Keys? Does it generate the key pair completely in the browser or does it generate the keys in the server and send us the private key over HTTPS?

I tried to find out what's happening by looking at the requests and response in the development console on Firefox. But I couldn't understand what was going on.

First, there's a POST call to https://console.aws.amazon.com/ec2/ecb?call=createKeyPair?&mbtc=1337542060 with the following data

{"keyName":"testkey", "region":"us-east-1"}

The response to the call is the private key pair itself

{"keyFingerprint":"0a:93:6b:50:95:cc:2e:7c:ac:67:b1:c2:4b:ea:c5:72:dd:23:28:ea","keyMaterial":"-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAs49qE5S4YEX0zgVyCMl1zaU26c7bJ4GpgerP0uEkNOS9oJ7lleP+S6JmszBy\nvsZn2XCv1bwj/Yi4/Pqxd+38WFJRzYNh8bqfe4e3BoSCubCW2mGlTehf8Bzkhhkh/JilHj4UlTQK[..snip..]\n4S5HcZrTeMkVukx8nXmchdI7sy16LHQEwdOdKaLemDynwljdQ2nYMq382wgdV1aRyvM=\n-----END RSA PRIVATE KEY-----","keyName":"testkey"}

There's a second POST call to https://console.aws.amazon.com/ec2/ecb?call=getKeyPairList?&mbtc=1337542060 where the response is a list of keynames and fingerprint ID matching the search term that I had put in

POST DATA:

{"filters":[{"name":"search", "values":["testkey"]}], "start":0, "count":50, "sorting":[{"name":"keyName", "direction":"ASC"}], "region":"us-east-1"}

The response to this is a JSON array of a list of keys and their corresponding fingerprints.

Finally, there's yet another POST call to https://console.aws.amazon.com/ec2/v2/downloadKeyPair with my private key as a form-data payload (!!) with the header:

Content-disposition attachment; filename=testkey.pem

This returns a plaintext key file, neatly formatted and all. Why is the third request necessary? Couldn't AWS have generated the key on the browser without POST ing it the key to itself?

I tried switching to Offline Mode (big shout out to Mozilla for this) and key pair creation failed. But this could not conclusively prove to me that the key pair is being generated on AWS server because the failure could be due to AWS not having received the public key, fingerprint and keyname. Atomicity of key creation even if done in the browser could include AWS getting (and ack-ing) the public key, fingerprint and keyname which my offline mode would have blocked.

Finally, does it make sense worrying about this since AWS ostensibly has complete control over the hypervisor including contents of the physical RAM from which they could in theory dump my keys?

Improve this question

1 Answer 1

Reset to default
3

Finally, does it make sense worrying about this since AWS... could dump my keys

No, it doesn't make sense. The keys you are discussing are for protecting communications from your client to Amazon's servers. The keys protect you against a network-based attacker such as a MITM on the network. It doesn't make sense to change the question/threat model and treat Amazon itself as a local attacker, that's not what the keys are to protect against.

Improve this answer
2
  • This makes sense. With this threat model in mind, would you say AWS sending private key over TLS to be secure enough for businesses?
    – eternaltyro
    Commented Sep 5, 2018 at 3:50
  • 1
    Yes, protecting against a network-based MITM attack using TLS is secure enough for business as long as the version of TLS is up to date (See, e.g., www.howsmyssl.com) and the server certificate has been verified to have been signed by a trusted CA (e.g., if using a chrome web browser you would see a green lock icon and green word "Secure").
    – hft
    Commented Sep 5, 2018 at 17:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .