openwall / openwall/john

New algorithm request - Amazon v4 signature - AWS4-HMAC-SHA256

Open
#5,079 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

new format
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

Hello,

I'd like a new algorithm being added to John the Ripper - the Amazon AWS4-HMAC-SHA256

Full documentation of implementing this hash can be found here:
https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html

Here is the example signature calculated and salts:

signature = 7f8ba2f53b6cc0485ed3e93642143fc66c1035b2f31dcb4d987431313b7dd4a3
longdate = 20130524T000000Z
date = 20130524
region = us-east-1
service = s3
canonical = 3bfa292879f6447bbcda7001decf97f4a54dc650c8942174ae0a9121cf58ad04

$stringtosign is AWS4-HMAC-SHA256\n$longdate\n$date/$region/$date/aws4_request\n$canonical

So my stringtosign would be AWS4-HMAC-SHA256\n20130524T000000Z\n20130524/us-east-1/s3/aws4_request\n3bfa292
879f6447bbcda7001decf97f4a54dc650c8942174ae0a9121cf58ad04

The goal is to recover the secret which is 1234 in the above example

How the algorithm works:

kdate = HMACSHA256(key="AWS4"+secret, message=date).digest() // no hex, just raw digest
kregion = HMACSHA256(key=kdate, message=region).digest()
kservice = HMACSHA256(key=kregion, message=service).digest()
signingkey = HMACSHA256(key=kservice, message="aws4_request").digest()

signature =HMACSHA256(key=signingkey, message=stringtosign).hexdigest() // digest hex-encoded

Sincerely

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked AWS SigV4 query-string authentication documentation and verify the supplied signature, salts, and secret example. There is no repository file, test, or entry point identified in the issue; done means John the Ripper can recover the stated secret from AWS4-HMAC-SHA256 signatures using the documented key-derivation steps.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, c
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.