23

I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard practice? This is a Java web app running in a Solaris environment.

Is there any reason why a symmetric key is used, with the attendant pain of secure storage and communication of the shared key, instead of an asymmetric key? I know there is a speed difference, and thus some scaling concern, but what else am I missing?

3
  • Java keystore allows storing of a symmetric key also.
    – user93353
    Apr 28, 2013 at 10:19
  • Thank you user93353. Do you know if this is a scalable solution that is widely in use? My inclination is to investigate ways to store the values securely in a database, but if the keystore offers some significant benefits, I can go that way as well.
    – user25231
    Apr 29, 2013 at 12:09
  • 1
    If you're using a Java application, you should be able to store the symmetric keys in a JCEKS keystore.
    – user25550
    May 3, 2013 at 19:38

1 Answer 1

34

The key used in HMAC is, by definition, symmetric: the same key is used to compute the MAC value, and to verify the MAC value. Digital signature algorithms are asymmetric, which means that the key for verification is distinct from the key used for generation; this "difference" is strong: the key used for generation cannot be recomputed from the key used for verification (at least, nobody found a way to do that in a non-ridiculous time with existing technology).

Digital signatures make sense in situations where the verifier must be able to verify signatures, but without being granted the power to generate other signatures of its own. This is typical of non-repudiation scenarios: only the signer must be able to produce valid signatures, otherwise the signature cannot be unambiguously attributed by third parties (e.g. a judge) to that specific signer. However, in authentication scenarios such as Amazon AWS, there is no third party to convince; there is only the client and Amazon. When a HMAC value is successfully verified, the Amazon server is convinced that someone knowing the HMAC key was involved; since that key is known only to the client and the server itself, and the server remembers not having used the key for that message himself, the server easily concludes that the client computed the HMAC.

Digital signatures imply some overhead:

  • More CPU: generating a digital signature and verifying a digital signature requires more work than HMAC (difference is negligible for big messages, but can be significant for small messages of less than a few kilobytes).

  • More network bandwidth: a very robust HMAC value fits in 16 bytes, whereas an equivalently robust RSA signature will use 256 bytes (this can be lowered to about 64 bytes with DSA or ECDSA). There again, this is significant when processing lots of small messages.

  • More storage size: a RSA public key (for verification) will use 256 bytes; the private key will use more (about one or two kilobytes). ECDSA can help, to some extent (down to about 32 bytes for either key), but it is still larger than the 16 bytes for a HMAC key.

  • Randomness: many digital signatures require some per-signature randomness, which must be obtained from a cryptographically secure PRNG.

  • More complexity: mathematics and code involved in digital signatures are more complex than HMAC (HMAC is just a pair of hash function invocations; digital signatures begin with a hash function invocation, and then do weirder things). For security, complexity is bad.

So you do not want to use digital signatures in contexts which can be equally well served with a simpler HMAC. In my view, the most compelling reason is the last one: complexity should be avoided.

4
  • 1
    Thank you for the prompt and clear response Thomas. Is there a standard for storing the shared secret symmetric key securely? None of the resources I have found yet go into that aspect with any depth.
    – user25231
    Apr 26, 2013 at 13:44
  • 1
    Some people like to store the key only "encrypted" to mitigate consequences of database plunder. Big software I deal with tends to use DPAPI more or less directly (programmatically, or through SQL Server). It is mostly a matter of trying to make a difference between "the attacker dumped the database with a SQL injection or a stolen backup tape" and "the attacker took full control of the machine". Apr 26, 2013 at 13:48
  • Thank you again. I will look into a similar tool set in the Java/Solaris space.
    – user25231
    Apr 26, 2013 at 13:54
  • "By definition, symmetric" -That point is avoided in most documentation about HMAC, although is pretty obvious. Very clear explanation.
    – AlexAcc
    Jan 7, 2021 at 9:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .