1

A common method of credentialing for an API is to give each use a public/private key pair. The public key is sent in with the request, and the private key is used to sign the request (and is verified by the server re-signing the request and checking that they match).

The user can rotate the keys pretty easily. What I don't understand is why a key rotation involves changing the public key as well (this is done by AWS when an IAM user's key is rotated).

From my understanding the public key is kind of like a persons name, it tells the server who you are. It was never a secret to begin with. What benefit is gained by changing the public key and not just changing the private key?

Edit: Just to clarify, I am not referring to an RSA type encryption key pair which rely on each other. I am referring to key pairs used for API access (such as AWS uses)

Improve this question

3 Answers 3

Reset to default
2

A public key matches a specific private key, it is not "kind of like a person's name". The public key can be used to verify that whomever signed the message has the private key belonging to the public key, because the private key and public key are related in a very specific mathematical way. In theory, there is only ever one person who has that private key, allowing the server to identify you.

However, if the private key is stolen somehow, now anybody could be signing that message. Hence the need to generate a new private key. But since the private key and public key are paired in a specific mathematical way, the new private key is useless without sending the server the corresponding public key that was generated along with it.

Improve this answer
3
  • Why not just pair the old public key with the new private key?
    – yitzih
    Commented Oct 29, 2018 at 15:16
  • 2
    Because that's impossible. A private key and a public key are just numbers. Those numbers are related in a very specific mathematical way. You cannot "pair" a new private key to an existing public key. You generate both together.
    – Ben
    Commented Oct 29, 2018 at 15:19
  • I think you're confusing this with an RSA encryption key pair. Its not a public/private key pair which are used to sign and verify each other. They are API keys. The public key is used to declare who you are, the private key is used to sign the requests being sent to the server.
    – yitzih
    Commented Oct 29, 2018 at 15:41
0

It looks like yitzih you are confusing this. Ben is correct, what you are thinking of in this case is public-key crypto: https://en.wikipedia.org/wiki/Public-key_cryptography. RSA is an implementation of this, as is what you are talking about. That is why Ben's answer is correct.

Improve this answer
5
  • This is the documentation from AWS on how their signatures work: How Signature Version 4 works. 1) Create a canonical request.Use the canonical request and additional metadata to create a string for signing. 2) Derive a signing key from your AWS secret access key. Then use the signing key, and the string from the previous step, to create a signature. 3) Add the resulting signature to the HTTP request in a header or as a query string parameter. 4) When an AWS service receives the request, it performs the same steps that you did to calculate the signature you sent in your request.
    – yitzih
    Commented Oct 29, 2018 at 20:14
  • AWS then compares its calculated signature to the one you sent with the request. If the signatures match, the request is processed. If the signatures don't match, the request is denied.
    – yitzih
    Commented Oct 29, 2018 at 20:14
  • This is from docs.aws.amazon.com/general/latest/gr/signature-version-4.html
    – yitzih
    Commented Oct 29, 2018 at 20:14
  • This sounds like the private key is used only to sign the request with a hash (not encrypt it).
    – yitzih
    Commented Oct 29, 2018 at 20:15
  • I don't know how AWS works, but from your description, it sounds like a pre-shared key. I.e. there is only one key, and it is private. There is no public key. AWS is going to need your key, or something derived from it, to authenticate you.
    – Ben
    Commented Oct 30, 2018 at 1:59
0

AWS API does not use key pair(s) or RSA, it uses derivation from a secret (NOT private, in modern crypto they mean different things) 'access' key (singular) (which is tied to a key id which identifies it) and HMAC-SHA256. It is debatable whether HMAC is properly called a signature or should be called a MAC instead, but AWS calls it a signature. (In any case, neither hash nor MAC nor true signature is encryption, and although Ben's answer mistakenly assumed RSA signature, it had nothing to do with encryption.) This is explained in https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html especially in Task 3.

For the relationship of 'access' keys (and ids) to users, and rotation, see https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys . Note the next section of that same page says explicitly

Key pairs are unrelated to access keys .... Key pairs are used only for Amazon EC2 [SSH] and Amazon CloudFront.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .