Key Management Service:Asymmetric Digital Signatures

Before You Begin

Call the CreateKey operation in KMS using the Alibaba Cloud CLI. To create an asymmetric key, set the KeySpec parameter to the desired key type and the Usage parameter to SIGN/VERIFY.

• To create an RSA signature key:

  aliyun kms CreateKey --KeySpec=RSA_2048 --KeyUsage=SIGN/VERIFY --ProtectionLevel=HSM

• To create a NIST P-256 signature key:

  aliyun kms CreateKey --KeySpec=EC_P256 --KeyUsage=SIGN/VERIFY --ProtectionLevel=HSM

• To create a secp256k1 signature key:

  aliyun kms CreateKey --KeySpec=EC_P256K --KeyUsage=SIGN/VERIFY --ProtectionLevel=HSM

Signature Pre-processing: Calculate Message Digest

Before you can sign a message using an RSA or ECC key, you must first calculate the digest of the message. You then sign the digest.

The following examples use the SHA-256 digest algorithm.

1. Store the message "this is message" to be signed in the message-file.txt file:

echo "this is message" > message-file.txt

2. Calculate the SHA-256 digest of the message. Store the binary digest in the message-sha256.bin file:

openssl dgst -sha256 -binary -out message-sha256.bin  message-file.txt

Call KMS to Calculate Signature

Call the KMS operation to sign the message digest using the private key.

1. Before you transmit the message digest over the network, you must Base64-encode it:

openssl base64 -in message-sha256.bin

The Base64-encoded digest is as follows:

uCx5YpLfBrqoYMP8Hf9H7j9/1zT+PPxq1qJRW6uQbos=

2. Pass the Base64-encoded digest to KMS to generate the signature.

• RSASSA-PSS

  To sign data with an RSA key using the RSASSA-PSS algorithm and a SHA-256 digest, run the following command:

  aliyun kms AsymmetricSign --KeyId=**** --KeyVersionId=**** \
      --Algorithm=RSA_PSS_SHA_256 --Digest=hRP2cu...
  {
          "KeyId": "****",
          "KeyVersionId": "****",
          "Value": "J7xmdnZ...",
          "RequestId": "70f78da9-c1b6-4119-9635-0ce4427cd424"
  }

  Base64-decode the signature from the Value parameter in the result and save the binary signature to the rsa_pss_signature.bin file:

  echo J7xmdnZ... | openssl base64 -d -out rsa_pss_signature.bin

• RSASSA_PKCS1_V1_5

  To sign data with an RSA key using the RSASSA_PKCS1_V1_5 algorithm and a SHA-256 digest, run the following command:

  aliyun kms AsymmetricSign --KeyId=**** --KeyVersionId=**** \
      --Algorithm=RSA_PKCS1_SHA_256 --Digest=hRP2cu...
  {
          "KeyId": "****",
          "KeyVersionId": "****",
          "Value": "qreBkH/u...",
          "RequestId": "4be57288-f477-4ecd-b7be-ad8688390fbc"
  }

  Base64-decode the signature from the Value parameter in the result and save the binary signature to the rsa_pkcs1_signature.bin file:

  echo qreBkH/u... | openssl base64 -d -out rsa_pkcs1_signature.bin

• NIST P-256

  To sign data with a NIST P-256 key using the ECDSA algorithm and a SHA-256 digest, run the following command:

  aliyun kms AsymmetricSign --KeyId=**** --KeyVersionId=**** \
      --Algorithm=ECDSA_SHA_256 --Digest=hRP2cu...
  {
          "KeyId": "****",
          "KeyVersionId": "****",
          "Value": "MEYCIQD33Y98...",
          "RequestId": "472d789c-d4be-4271-96bb-367f7f0f8ec3"
  }

  Base64-decode the signature from the Value parameter in the result and save the binary signature to the ec_p256_signature.bin file:

  echo MEYCIQD33Y98... | openssl base64 -d -out ec_p256_signature.bin

• secp256k1

  Run the following Alibaba Cloud CLI command:

  aliyun kms AsymmetricSign --KeyId=**** --KeyVersionId=**** \
      --Algorithm=ECDSA_SHA_256 --Digest=hRP2cu...
  {
          "KeyId": "****",
          "KeyVersionId": "****",
          "Value": "MEYCIQDWuuI...",
          "RequestId": "fe41abed-91e7-4069-9f6b-0048f5bf4de5"
  }

  Base64-decode the signature from the Value parameter in the result and save the binary signature to the ec_p256k_signature.bin file:

  echo MEYCIQDWuuI... | openssl base64 -d -out ec_p256k_signature.bin

Get Public Key

Obtain the public key of the corresponding asymmetric key from KMS. For more information, see asymmetric encryption and decryption. For the preceding examples, assume that the public keys are saved to the following files:

• The public key for the RSA key is stored in the rsa_publickey.pub file.
• The public key for the NIST P-256 key is stored in the ec_p256_publickey.pub file.
• The public key for the secp256k1 key is stored in the ec_p256k_publickey.pub file.

Verify Signature Using Public Key

Run the following commands to verify the signature based on the key type and algorithm:

• RSASSA-PSS

  openssl dgst \
      -verify rsa_publickey.pub \
      -sha256 \
      -sigopt rsa_padding_mode:pss \
      -sigopt rsa_pss_saltlen:-1 \
      -signature rsa_pss_signature.bin \
      message-file.txt

• RSASSA_PKCS1_V1_5

  openssl dgst \
      -verify rsa_publickey.pub \
      -sha256 \
      -signature rsa_pkcs1_signature.bin \
      message-file.txt

• NIST P-256

  openssl dgst \
      -verify ec_p256_publickey.pub \
      -sha256 \
      -signature ec_p256_signature.bin \
      message-file.txt

• secp256k1

  openssl dgst \
      -verify ec_p256k_publickey.pub \
      -sha256 \
      -signature ec_p256k_signature.bin \
      message-file.txt

If the verification is successful, the following output is returned:

Verified OK