REST authentication S3 like hmac sha1 signature vs symetric data encryption.

Posted by coulix on Stack Overflow See other posts from Stack Overflow or by coulix
Published on 2010-05-28T22:57:09Z Indexed on 2010/05/28 23:02 UTC
Read the original article Hit count: 193

Filed under:

security

|

architecture

|

rest

|

encryption

Hello stackers,

I was arguing about an S3 like aproach using authorization hash with a secret key as the seed and some data on the request as the message signed with hmac sha1 (Amazon S3 way) vs an other developer supporting symetric encryption of the data with a secret key known by the emiter and the server.

What are the advantage of using signed data with hmac sha1 vs symetric key other than the fact that with the former, we do not need to encrypt the username or password.

What would be the hardest to break ? symetric encryption or sha1 hashing at la S3 ?

If all big players are using oauth and similar without symetric key it is sure that there are obvious advantages, what are those ?

© Stack Overflow or respective owner

Related posts about security

sudo apt-get update errors

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Here is what I get on my terminal when running sudo apt-get update errors. I dont know if the issue is from my sources.list or my proxy setup(have not made any changes to proxies). Thank you for any help in advanced. Ign http://security.ubuntu.com oneiric-security Release.gpg Ign http://security… >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Devx - Search for 'Devx'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Internet.com - Search for 'Internet.com'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
StackOverFlowError while creating Mac object on AS400/Java

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am a newbie to AS400-Java programming. I am trying to create my first program to test the implementation of Message Authentication Code (MAC). I am trying to use the HMACSHA1 hash function. My (Java 1.4) program runs fine on a dev box (V5R4).But fails terribly on the QA box (V5R3). My… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More

Related posts about architecture

3-tier architecture v. 3-server architecture

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm building a traditional .NET MVC site, so I've got a natural 3-tier software architecture setup (presentation in the form of Views, business layer in the controller, and data layer in the models and data access layer). When I've deployed such sites, it usually goes either on one server (where… >>> More
"cloud architecture" concepts in a system architecture diagrams

as seen on Stack Overflow - Search for 'Stack Overflow'
If you design a distributed application for easy scale-out, or you just want to make use of any of the new “cloud computing” offerings by Amazon, Google or Microsoft, there are some typical concepts or components you usually end up using: distributed blob storage (aka S3) asynchronous, durable message… >>> More
Is the PowerPC (G4) architecture better than Intel x86 architecture for certain types of application

as seen on Super User - Search for 'Super User'
I have a PowerMac G4 from around the year 2000. It's a serviceable Unix machine but I don't do much with it since I have plenty of Pentium 4 machines around with Linux on them. I was wondering if the PowerPC based machine is capable of handling certain tasks faster or "better" than Intel based machines… >>> More
SAAS architecture and salesforce database architecture

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am architecting a software project and I want to create a SAAS (Software As a service) one. I want to model my application along the lines of Salesforce. I really like there customization features but I am not sure how they really go about it. I read that they create an ID for every… >>> More
Is there a Telecommunications Reference Architecture?

as seen on Oracle Blogs - Search for 'Oracle Blogs'
@font-face { font-family: "Arial"; }@font-face { font-family: "Courier New"; }@font-face { font-family: "Wingdings"; }@font-face { font-family: "Cambria"; }p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: "Times New Roman"; }p.MsoListParagraph… >>> More