I'm trying to understand how the AWS signature 4 works. I read the docs and I found a Python example where a signature is computed. I also ran into this answer which explains HMAC a bit.
I'm curious to understand what AWS does on the server side to "believe" in the request.
Are they running the same code as the example but setting the date with the parameter passed by the request and then matching the two hashes (HMAC seems to work that way)? If so, why are there so many values and two-step hash in the request (my guess is that is something related to the hash clash)?.
PS: since the approach (HMAC) uses ACCESS and SECRET keys as keys (it's symmetric key) it can be implemented only on a server side. This can't be done safely in a mobile app since the keys can be easily accessed. Is there a way to do so in a "less closed" (compared to server) environment such as a client app/mobile/etc. app?
signing_keyusing HMAC over 4 variables, and then compute
signatureusing HMAC over the
signing_keyand other variables.