Exact format of ECDSA_SHA_256 public keys

Hi Maurice:

KMS returns the public key as a Subject Public Key Info (SPKI) structure, as defined by RFC 5280 and its various references. We specifically return the key in the binary Distinguished Encoding Rules (DER) ASN.1 format.

This format should be supported by most, if not all, common cryptographic libraries.

Thanks for your feedback on how this wasn't as clear as it should have been - I'm going to work to get the KMS documentation updated to clarify.

Please let me know if I can be of further assistance.

Benjamin
AWS KMS Team