Sign

Available in Classic and VPC

Create a data signature of up to 8 KB. It can only be requested as an RSA2048 or ECDSA key type.

Request

This section describes the request format. The method and URI are as follows:

Method	URI
POST	API Gateway request signature v1: /keys/v1/{keyTag}/sign API Gateway request signature v2: /keys/v2/{keyTag}/sign

Request headers

For information about the request headers common to all Key Management Service APIs, see Key Management Service request headers.

Request path parameters

You can use the following path parameters with your request:

Field	Type	Required	Description
`keyTag`	String	Required	Key tag Unique identifier for the key derived from the key name. See Get key list. Use to request encryption or decryption with REST APIs. Key tags are not treated as confidential information.

Request body

You can include the following data in the body of your request:

Field	Type	Required	Description
`data`	String	Required	Base64-encoded string data to create the signature value from Up to 8 KB can be entered.

Request example

The request example is as follows:

API Gateway request signature v1 request

curl --location --request POST 'https://kms.apigw.ntruss.com/keys/v1/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6/sign' \
--header 'x-ncp-apigw-timestamp: {Timestamp}' \
--header 'x-ncp-apigw-api-key: {API Gateway API Key}' \
--header 'x-ncp-iam-access-key: {Sub Account Access Key}' \
--header 'x-ncp-apigw-signature-v1: {API Gateway Signature}' \
--data '{
  "data": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=="
}'

API Gateway request signature v2 request

curl --location --request POST 'https://kms.apigw.ntruss.com/keys/v2/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6/sign \
--header 'x-ncp-apigw-timestamp: {Timestamp}' \
--header 'x-ncp-iam-access-key: {Sub Account Access Key}' \
--header 'x-ncp-apigw-signature-v2: {API Gateway Signature}' \
--data '{
  "data": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=="
}'

Response

This section describes the response format.

Response body

The response body includes the following data:

Field	Type	Required	Description
`code`	String	-	Success or Failure
`msg`	String	-	Description of the response code (`code`) Display an empty value ("") on request success (`SUCCESS`).
`data`	Object	-	Response result
`data.signature`	String	-	Created signature value

Response status codes

For information about the response status codes common to all Key Management Service APIs, see Key Management Service response status codes.

Response example

The response example is as follows:

{
    "code": "SUCCESS",
    "msg": "",
    "data": {
        "signature": "{SIGNATURE}"
    }
}

Signature parameters

The signature algorithm parameters for each key type are as follows:

Key type	Signature algorithm	Hash	MGF	Salt length	Trailer field	Signature value encoding
`RSA2048`	RSASSA-PSS	SHA-256	MGF1(SHA-256)	222 bytes	1	256 bytes (fixed)
`ECDSA`	SHA256withECDSA	SHA-256	-	-	-	ASN.1 DER

The salt length of 222 bytes is the maximum for RSA-PSS, and is calculated as ceil((2048 - 1) / 8) - 32 - 2 = 222.
The signature subject is the original bytes obtained by Base64 decoding the data in the request body.

Signature value format

data.signature is a string in the following format.

ncpkms:v{key version}:{Base64-encoded signature value}

When making a Verify request, you must pass the format exactly as shown above. However, when validating directly by looking up the public key, you must remove the ncpkms:v{key version}: prefix before Base64 decoding.

Note

When validating directly with the public key, you must specify the signature parameter exactly as shown above. OpenSSL, Go, and Node.js automatically infer the salt length from the signature value during validation, but Java (JCA) does not support automatic inference, so you must explicitly specify the salt length in PSSParameterSpec. To avoid having to configure the signature parameters manually, use Verify.