I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard practice? This is a Java web app running in a Solaris environment.

Is there any reason why a symmetric key is used, with the attendant pain of secure storage and communication of the shared key, instead of an asymmetric key? I know there is a speed difference, and thus some scaling concern, but what else am I missing?

  • Java keystore allows storing of a symmetric key also. – user93353 Apr 28 '13 at 10:19
  • Thank you user93353. Do you know if this is a scalable solution that is widely in use? My inclination is to investigate ways to store the values securely in a database, but if the keystore offers some significant benefits, I can go that way as well. – user25231 Apr 29 '13 at 12:09
  • 1
    If you're using a Java application, you should be able to store the symmetric keys in a JCEKS keystore. – user25550 May 3 '13 at 19:38

The key used in HMAC is, by definition, symmetric: the same key is used to compute the MAC value, and to verify the MAC value. Digital signature algorithms are asymmetric, which means that the key for verification is distinct from the key used for generation; this "difference" is strong: the key used for generation cannot be recomputed from the key used for verification (at least, nobody found a way to do that in a non-ridiculous time with existing technology).

Digital signatures make sense in situations where the verifier must be able to verify signatures, but without being granted the power to generate other signatures of its own. This is typical of non-repudiation scenarios: only the signer must be able to produce valid signatures, otherwise the signature cannot be unambiguously attributed by third parties (e.g. a judge) to that specific signer. However, in authentication scenarios such as Amazon AWS, there is no third party to convince; there is only the client and Amazon. When a HMAC value is successfully verified, the Amazon server is convinced that someone knowing the HMAC key was involved; since that key is known only to the client and the server itself, and the server remembers not having used the key for that message himself, the server easily concludes that the client computed the HMAC.

Digital signatures imply some overhead:

  • More CPU: generating a digital signature and verifying a digital signature requires more work than HMAC (difference is negligible for big messages, but can be significant for small messages of less than a few kilobytes).

  • More network bandwidth: a very robust HMAC value fits in 16 bytes, whereas an equivalently robust RSA signature will use 256 bytes (this can be lowered to about 64 bytes with DSA or ECDSA). There again, this is significant when processing lots of small messages.

  • More storage size: a RSA public key (for verification) will use 256 bytes; the private key will use more (about one or two kilobytes). ECDSA can help, to some extent (down to about 32 bytes for either key), but it is still larger than the 16 bytes for a HMAC key.

  • Randomness: many digital signatures require some per-signature randomness, which must be obtained from a cryptographically secure PRNG.

  • More complexity: mathematics and code involved in digital signatures are more complex than HMAC (HMAC is just a pair of hash function invocations; digital signatures begin with a hash function invocation, and then do weirder things). For security, complexity is bad.

So you do not want to use digital signatures in contexts which can be equally well served with a simpler HMAC. In my view, the most compelling reason is the last one: complexity should be avoided.

  • 1
    Thank you for the prompt and clear response Thomas. Is there a standard for storing the shared secret symmetric key securely? None of the resources I have found yet go into that aspect with any depth. – user25231 Apr 26 '13 at 13:44
  • 1
    Some people like to store the key only "encrypted" to mitigate consequences of database plunder. Big software I deal with tends to use DPAPI more or less directly (programmatically, or through SQL Server). It is mostly a matter of trying to make a difference between "the attacker dumped the database with a SQL injection or a stolen backup tape" and "the attacker took full control of the machine". – Thomas Pornin Apr 26 '13 at 13:48
  • Thank you again. I will look into a similar tool set in the Java/Solaris space. – user25231 Apr 26 '13 at 13:54
  • "By definition, symmetric" -That point is avoided in most documentation about HMAC, although is pretty obvious. Very clear explanation. – AlexAcc Jan 7 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.