-
Notifications
You must be signed in to change notification settings - Fork 681
External signing with Google Cloud KMS #926
-
I am working on a PoC to use ExternalSignature with Google Cloud KMS Asymmetric signing. My efforts have ended up creating corrupt signatures. Doesn't any one have any idea how to resolve this issue?
@Override public byte[] sign(byte[] message) throws GeneralSecurityException { try { String encoded = Base64.getEncoder().encodeToString(message); System.out.println(encoded);; // Create SHA-256 MessageDigest instance MessageDigest sha256Digest = MessageDigest.getInstance("SHA256"); // Hash the input message byte[] hashedMessage = sha256Digest.digest(message); Digest digest = Digest.newBuilder().setSha256(ByteString.copyFrom(hashedMessage)).build(); // Set the GCP credentials KeyManagementServiceSettings settings = KeyManagementServiceSettings.newBuilder() .build(); try (KeyManagementServiceClient client = KeyManagementServiceClient.create(settings)) { AsymmetricSignResponse response = client.asymmetricSign(keyId, digest); return response.getSignature().toByteArray(); } } catch (Exception e) { throw new GeneralSecurityException("Error while signing PDF", e); } }
My signature has the following error:
Beta Was this translation helpful? Give feedback.
All reactions
Replies: 6 comments
-
More info about the signature:
image
Beta Was this translation helpful? Give feedback.
All reactions
-
Can you share an example PDF signed by your poc for analysis?
That being said, you talk about ExternalSignature - that sounds like an interface from OpenPDF5, not OpenPDF...
Beta Was this translation helpful? Give feedback.
All reactions
-
Thanks, @mkl-public. Here is the signed file: signed-document-1.pdf
Beta Was this translation helpful? Give feedback.
All reactions
-
There are two certificates embedded:
- Subject: CN=Bob's key,O=Dealer A,L=Agoura Hills,ST=California,C=US
Issuer: C=US,ST=California,L=Agoura Hills,O=Vitu,OU=IT,CN=Vitu Trust
Serial: 2579306353 - Subject: C=US,ST=California,L=Agoura Hills,O=Vitu,OU=IT,CN=Vitu Trust
Issuer: C=US,ST=California,L=Agoura Hills,O=Vitu,OU=IT,CN=Vitu Trust
Serial: 1689184570
The claimed signer certificate is the first one but validation succeeds with the second one.
Thus, you appear to call KMS for the wrong private key, the wrong keyId.
Beta Was this translation helpful? Give feedback.
All reactions
-
Hi @arashnikoo , any feedback if the problem still unsolved?
Beta Was this translation helpful? Give feedback.
All reactions
-
I haven't had time to test that again. I'll try again and report it here.
Beta Was this translation helpful? Give feedback.
All reactions
-
👍 1