Skip to content
This repository has been archived by the owner on Jan 20, 2019. It is now read-only.

Commit

Permalink
Switched from HMAC-SHA1 to HMAC-SHA256 signature
Browse files Browse the repository at this point in the history
While both are supported by AWS, the latter is stronger hash function.
It is not believed to contain some security flaws identified in SHA-1.
So sayeth Wikipedia - http://en.wikipedia.org/wiki/SHA-2

Ubuntu Enterprise Cloud (Eucalyptus) doesn't seem to allow requests
using HMAC-SHA1. This is one of the changes I had to make to get
amazon-ec2 gem working against my Eucalyptus cluster.
  • Loading branch information
Mike Bailey committed May 16, 2010
1 parent 29b33c6 commit c1d3fd1
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
4 changes: 2 additions & 2 deletions lib/AWS.rb
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ def AWS.canonical_string(params, host, method="POST", base="/")
# @param [Boolean] urlencode whether or not to url encode the result., true or false
# @return [String] the signed and encoded string.
def AWS.encode(secret_access_key, str, urlencode=true)
digest = OpenSSL::Digest::Digest.new('sha1')
digest = OpenSSL::Digest::Digest.new('sha256')
b64_hmac =
Base64.encode64(
OpenSSL::HMAC.digest(digest, secret_access_key, str)).gsub("\n","")
Expand Down Expand Up @@ -231,7 +231,7 @@ def make_request(action, params, data='')

params.merge!( {"Action" => action,
"SignatureVersion" => "2",
"SignatureMethod" => 'HmacSHA1',
"SignatureMethod" => 'HmacSHA256',
"AWSAccessKeyId" => @access_key_id,
"Version" => api_version,
"Timestamp"=>Time.now.getutc.iso8601} )
Expand Down
4 changes: 2 additions & 2 deletions test/test_EC2.rb
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,8 @@
end

specify "AWS.encode should return the expected string" do
AWS.encode("secretaccesskey", "foobar123", urlencode=true).should.equal "e3jeuDc3DIX2mW8cVqWiByj4j5g%3D"
AWS.encode("secretaccesskey", "foobar123", urlencode=false).should.equal "e3jeuDc3DIX2mW8cVqWiByj4j5g="
AWS.encode("secretaccesskey", "foobar123", urlencode=true).should.equal "CPzGGhtvlG3P3yp88fPZp0HKouUV8mQK1ZcdFGQeAug%3D"
AWS.encode("secretaccesskey", "foobar123", urlencode=false).should.equal "CPzGGhtvlG3P3yp88fPZp0HKouUV8mQK1ZcdFGQeAug="
end

end

0 comments on commit c1d3fd1

Please sign in to comment.