Sign

Available in Classic and VPC

Create a data signature of up to 8 KB. It can only be requested as an RSA2048 or ECDSA key type.

Request

This section describes the request format. The method and URI are as follows:

Method	URI
POST	API Gateway request signature v1: /keys/v1/{keyTag}/sign API Gateway request signature v2: /keys/v2/{keyTag}/sign

Request headers

For information about the headers common to all Key Management Service APIs, see Key Management Service request headers.

Request path parameters

You can use the following path parameters with your request:

Field	Type	Required	Description
`keyTag`	String	Required	Key tag Unique identifier for the key derived from the key name See Get key list Use to request encryption or decryption with REST APIs Key tags are not treated as confidential information

Request body

You can include the following data in the body of your request:

Field	Type	Required	Description
`data`	String	Required	Base64-encoded string data to create the signature value from Up to 8 KB can be entered

Request example

The request example is as follows:

API Gateway request signature v1 request

curl --location --request POST 'https://kms.apigw.ntruss.com/keys/v1/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6/sign' \
--header 'x-ncp-apigw-timestamp: {Timestamp}' \
--header 'x-ncp-apigw-api-key: {API Gateway API Key}' \
--header 'x-ncp-iam-access-key: {Sub Account Access Key}' \
--header 'x-ncp-apigw-signature-v1: {API Gateway Signature}' \
--data '{
  "data": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=="
}'

API Gateway request signature v2 request

curl --location --request POST 'https://kms.apigw.ntruss.com/keys/v2/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6/sign \
--header 'x-ncp-apigw-timestamp: {Timestamp}' \
--header 'x-ncp-iam-access-key: {Sub Account Access Key}' \
--header 'x-ncp-apigw-signature-v2: {API Gateway Signature}' \
--data '{
  "data": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=="
}'

Response

This section describes the response format.

Response body

The response body includes the following data:

Field	Type	Required	Description
`code`	String	-	Success or Failure
`msg`	String	-	Description of the response code (`code`) Display an empty value ("") on request success (`SUCCESS`)
`data`	Object	-	Response result
`data.signature`	String	-	Created signature value

Response status codes

For information about the HTTP status codes common to all Key Management Service APIs, see Key Management Service response status codes.

Response example

The response example is as follows:

{
    "code": "SUCCESS",
    "msg": "",
    "data": {
        "signature": "{SIGNATURE}"
    }
}

Signature parameters

The signature algorithm parameters for each key type are as follows:

Key type	Signature algorithm	Hash	MGF	Salt length	Trailer field	Signature encoding
`RSA2048`	RSASSA-PSS	SHA-256	MGF1(SHA-256)	222 bytes	1	Fixed 256 bytes
`ECDSA`	SHA256withECDSA	SHA-256	-	-	-	ASN.1 DER

The salt length of 222 bytes is the maximum RSA-PSS salt length, calculated as ceil((2048 - 1) / 8) - 32 - 2 = 222.
The data to be signed is the raw bytes obtained by Base64-decoding the data field of the request body.

Signature value format

data.signature is a string in the following format:

ncpkms:v{key version}:{Base64-encoded signature value}

Pass this format as-is when calling Verify. If you verify the signature directly with the public key, remove the ncpkms:v{key version}: prefix and Base64-decode the remaining value.

Note
To verify directly with the public key, you must specify the same signature parameters as above. OpenSSL, Go, and Node.js can automatically infer the salt length from the signature value during verification, but Java (JCA) doesn't support this inference, so you must explicitly specify the salt length in PSSParameterSpec. To avoid setting the signature parameters yourself, use Verify instead.