tencent cloud

Key Management Service

ドキュメントKey Management Service

ECC Signature Verification

Download
フォーカスモード
フォントサイズ
最終更新日: 2026-07-30 16:52:53
AI翻訳
This document describes how to use the ECC signature verification algorithm.

Operation Steps

Step 1: Creating an Asymmetric Signature Key

Attention:
When you call the Create Master Key API in KMS to create a customer master key, you must specify the correct key usage ASYMMETRIC_SIGN_VERIFY_ECC to use the signature feature.
Request:
tccli kms CreateKey --Alias test_ecc --KeyUsage ASYMMETRIC_SIGN_VERIFY_ECC
Returned results:
{
"Response": {
"KeyId": "22d79428-61d9-11ea-a3c8-525400******",
"Alias": "test_ecc",
"CreateTime": 1583739580,
"Description": "",
"KeyState": "Enabled",
"KeyUsage": "ASYMMETRIC_SIGN_VERIFY_ECC",
"TagCode": 0,
"TagMsg": "",
"RequestId": "0e3c62db-a408-406a-af27-dd5ced******"
}
}

Step 2: Downloading the Public Key

Request:
tccli kms GetPublicKey  --KeyId 22d79428-61d9-11ea-a3c8-525400******
Returned results:
{
"Response": {
"RequestId": "408fa858-cd6d-4011-b8a0-653805******",
"KeyId": "22d79428-61d9-11ea-a3c8-525400******",
"PublicKey":  "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJahujq+PvM***************bBs/f3axWbvgvHx8Jmqw==",
"PublicKeyPem": "-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJa\\nhujq+PvM***************bBs/f3axWbvgvHx8Jmqw==\\n-----END PUBLIC KEY-----\\n"
}
}
Convert the public key PublicKeyPem to pem format and save it to the file public_key.pem.:
echo "-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJa
hujq+PvM***************bBs/f3axWbvgvHx8Jmqw==
-----END PUBLIC KEY-----" > public_key.pem
Attention:
Alternatively, you can log in to the KMS console, click Customer Keys > Key ID/Key Name to go to the key details page, and directly download the asymmetric key public key.

Step 3: Creating a Plaintext File for the Message

Create a test plaintext file.
echo "test" > test_verify.txt
Attention:
When the generated file contains invisible characters (such as line breaks), you must truncate the file (for example, using `truncate -s -1 test_verify.txt`) to ensure signature accuracy.

Step 4: Calculating the Message Digest

Attention:
If the message to be signed is no longer than 4096 bytes, you can skip this step and go directly to Step 5.
If the message to be signed exceeds 4096 bytes, you must first calculate the message digest locally on the client side.
Use openssl to calculate the digest of the content in the test_verity.txt file.
openssl dgst -sha256 -binary -out digest.bin test_verify.txt

Step 5: Generating a Signature via the KMS Signing API

Call the KMS Sign API to calculate the signature of the message.
1. Before calculating the signature for the original message or message digest, you must first perform base64 encoding.
//Base64-encode the message digest.
openssl enc -e -base64 -A -in digest.bin -out encoded.base64
//The original message is base64-encoded.
openssl enc -e -base64 -A -in test_verify.txt -out encoded.base64
2. Calculate the signature.
Request:
//Use the content of the encoded.base64 file as the Message parameter for SignByAsymmetricKey to sign it as a message digest.
tccli kms SignByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm ECC_P256_R1 --Message "qJQj83hSyOuU7Tn0SRReGCk4yuuVWaeZ44BP******==" --MessageType DIGEST
//Sign the message as the original text (the original text must be Base64-encoded).
tccli kms SignByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm ECC_P256_R1 --Message "dG***Ao=" --MessageType RAW
Returned results:
{
"Response": {
  "Signature": "U7Tn0SRReGCk4yuuVWaeZ4******",
  "RequestId": "408fa858-cd6d-4011-b8a0-653805******"
}
}
Save the signature content Signature to the file signContent.sign.
echo "U7Tn0SRReGCk4yuuVWaeZ4******" | base64 -d > signContent.bin

Step 6: Verifying the Signature

1. Verify the signature using the KMS signature verification API. (We recommend using this method for signature verification).
Request:
//Verify the message digest (use the content of the encoded.base64 file from step 4 as the Message parameter for VerifyByAsymmetricKey to verify the signature as a message digest).
tccli kms VerifyByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --SignatureValue "U7Tn0SRReGCk4yuuVWaeZ4******" --Message "QUuAcNFr1Jl5+3GDbCxU7te7Uekq+oTxZ**********=" --Algorithm ECC_P256_R1 --MessageType DIGEST
//Verify the original message (the original text must be Base64-encoded).
tccli kms VerifyByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --SignatureValue "U7Tn0SRReGCk4yuuVWaeZ4******" --Message "dG***Ao=" --Algorithm ECC_P256_R1 --MessageType RAW
Returned results:
{
"Response": {
  "SignatureValid": true,
  "RequestId": "6758cbf5-5e21-4c37-a2cf-8d47f5******"
}
}
Attention:
The values for the Message and MessageType parameters used in the signature and verification APIs must be consistent.
2. Verify the signature locally using the KMS public key and the signature content.
Request:
openssl dgst -verify public_key.pem -sha256 -signature ./signContent.bin ./test_verify.txt
Returned results:
Verified OK

次の記事へ: プライバシーポリシー

ヘルプとサポート

この記事はお役に立ちましたか？

フィードバック