The Amazon's HMAC schemes includes the hash of the canonical request in the string to sign in order to create the signature, and the canonical request in turn includes the host. What is the security implication of not including the host in this scheme?

  • I'm not sure that we can answer questions about HMAC schemes in general. HMAC is an operation that has many uses. – Neil Smithline Nov 4 '15 at 20:18
  • Good point about HMAC in general, I will modify the question. – nullgraph Nov 4 '15 at 20:42

In general, you use an HMAC to ensure that a value isn't changed (ie: it doesn't lose integrity). So including the URL in the HMAC means that Amazon doesn't want to allow it to be changed once the HMAC is created.

In this case, including the URL ensures that a request targeted for one URL but somehow sent to another can be detected because the recipient's recalculation of the HMAC will use the actual URL, not the original URL, and the HMACs won't match.

This check will be in addition to whatever security is provided by encrypted communications (eg: SSL).

  • I understand that including host in this case adds the extra security, what I don't understand is: what does it protect against? Suppose Amazon doesn't include the host, as an attacker, what does being able to change host give me? – nullgraph Nov 4 '15 at 20:35
  • 1
    Redirecting the message to another host. I don't really see that being a likely scenario, especially with SSL being used, but it adds an extra layer of protection. – Neil Smithline Nov 4 '15 at 20:38
  • But the Amazon scheme authenticates with an access key, suppose the attacker redirect to another host, there will still be a key mismatched. – nullgraph Nov 4 '15 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.