0

I was playing around with Go's rsa library, attempting to generate key pairs for a paid api service. That was when I noticed that rsa key pairs come back really long and with multiple components (modulus, exponent, primes).

I'm wondering how companies like Amazon generate a key and secret that are 20 and 40 characters respectively? Are they using a hashing algorithm on the base64(key components), or are they using a different method to come up with these api keys?

  • 1
    None, API keys are pretty much just passwords, they just need to match whatever is in their database. Some services may allow asymmetric keys through client certificates, but then they shouldn't be generating the private key for you. – Marc Feb 14 '18 at 17:36
  • @Marc ah okay I see. I was confusing encryption with api key authentication. So I can just generate random/unique 20 and 40 character strings and use those as api keys and secrets. Then clients can use those to sign messages. – The Puma Feb 14 '18 at 17:42
  • 1
    API keys have nothing to do with signing messages, they're purely used to authenticate incoming requests, much the same way that a username and password is used to login, it still doesn't let you sign anything. – Marc Feb 14 '18 at 17:50
  • @Marc I've seen apis where each request contains the api key and a "signature", which is the hmac of private key + nonce + data. Are you saying this is incorrect? – The Puma Feb 14 '18 at 18:01
  • Most APIs do not do those types of signatures, they only rely on TLS for transport security. If you're talking about AWS requests, you can see how they derive signing keys here. Note that there's nothing private about any of it, AWS knows all your credentials. – Marc Feb 14 '18 at 18:09
2

I'm wondering how companies like Amazon generate a key and secret that are 20 and 40 characters respectively?

Random string generation. They just need to be sufficiently difficult to guess, nothing more complicated than that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.