Cannot verify KMS signed message

0

So I'm using KMS to sign JWT token. However I have been unable to verify the signature using the SDK. The snippet (in node) is as follows.

let token_components = {
    header: base64url(JSON.stringify(headers)),
    payload: base64url(JSON.stringify(payload)),
};
let message = Buffer.from(token_components.header + "." + token_components.payload)

let res1 = await kms.sign({
     KeyId: 'arn:xxx',
    Message: message,
    SigningAlgorithm: 'RSASSA_PKCS1_V1_5_SHA_256',
    MessageType: 'RAW'
}).promise()

token_components.signature = res1.Signature.toString("base64")
.replace(/\+/g, '-')
.replace(/\//g, '_')
.replace(/=/g, '')
let res2 = await kms.verify({
   KeyId: 'arn:xxx',
   Message: message,
   Signature: token_components.signature,
   SigningAlgorithm: 'RSASSA_PKCS1_V1_5_SHA_256',
   MessageType: 'RAW'
}).promise()

With third party library the signature produced from sign can be verified using public key. But using KMS SDK the kms.verify method always fails with invalid signature exception. Referring from the documentation I think it should work as message and signature need to be either in Buffer (node's byte array) or String encoded in Base64. I'm not sure what went wrong and any help is greatly appreciated.

Edited by: inmyth on Mar 5, 2021 7:27 AM

Edited by: inmyth on Mar 5, 2021 7:28 AM

inmyth
preguntada hace 3 años600 visualizaciones
1 Respuesta
0

Figured it out. Basically the signature must not be url encoded (backslashes, dashes, equals have to be preserved). The input argument for verify should be its decoded base64 in byte array.

inmyth
respondido hace 3 años
profile picture
EXPERTO
revisado hace 6 meses
  • This comment helped a lot. In NodeJs you would need to get the signature first as byte array: const signatureArray = Uint8Array.from(Buffer.from(token_components.signature, 'base64'))

    and then pass it to verify method as Signature: Buffer.from(signatureArray ),

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas