Basically, I want to know why all the extra encryption steps if the communication is over HTTPS?
ie. For identity:
User authenticates, give that user an identity token over HTTPS they can use to do whatever you allow. If they are badly behaved I can revoke rights and disallow future tokens to that account.
ie. For anonymous:
Well if I’m giving anonymous tokens out, we really shouldn’t let them do anything potentially harmful at all… just give them the token and hope they don’t abuse it. If abuse is detected simply revoke the rights and black list them by IP (I mean that’s really the only thing I could do at that point right?).
What’s with all the other complexities above beyond what I described above? ie. “Encryption using a secret key passed over https using the Advanced Encryption Standard”, “a cryptographic signature made up of an HMAC hash generated from the timestamp, using the secure secret key derived from the password”
Is this really necessary? What benefits are to be had? Won’t I still have to practice active monitoring of the usage of the tokens and do I what I described above for badly behaved users?
I work on the AWS Mobile SDKs. The Anonymous and Identity TVMs are meant as sample reference applications for communicating AWS tokens to mobile devices. You should modify the TVMs to meet your specific needs. At a minimum, you should update the policy applied to tokens to limit the mobile app’s access to ONLY those AWS resources it needs. Limiting who can access the TVM in the Identity TVM as you mention is also a critical aspect of properly operating the TVM.
We added the additional layers of encryption to provide better overall security. The use of SSL is one of the layers in use here – it serves to protect the delivery of the token itself to the device, as well as the keys used to encrypt the token.
Please note that once a token is issued it not possible to revoke it. Tokens have a configurable time limit of 1 – 36 hours, therefore setting the appropriate policy and duration is an important security consideration for the TVM and the application it serves.
If it helps, the following article provides an example of a customized Identity TVM with specific policy objects applied to tokens:
http://aws.amazon.com/code/4598681430241367
Hope this helps,
Glenn