Get Public Key

Available in Classic and VPC

Get a publick key. It can only be requested as an RSA or ECDSA key type.

Request

This section describes the request format. The method and URI are as follows:

Request headers

For information about the request headers common to all Key Management Service APIs, see the token authentication method in Key Management Service request headers.

Request path parameters

You can use the following path parameters with your request:

Request body

You can include the following data in the body of your request:

Request example

The request example is as follows:

curl --location --request POST 'https://ocapi.ncloud.com/kms/v1/keys/a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6/get-pub-key' \
--header 'x-ncp-ocapi-token: {Access Token}' \
--data '{
  "keyVersion": 2
}'

Response

This section describes the response format.

Response body

The response body includes the following data:

Response status codes

For information about the response status codes common to all Key Management Service APIs, see Key Management Service response status codes.

Response example

The response example is as follows:

{
    "code": "SUCCESS",
    "data": {
        "publicKey": "{PUBLIC_KEY_PEM}"
    }
}

Validate signature with public key

This section describes how to manually validate a signature generated in Sign using the retrieved public key.

data.publicKey is a PEM string (-----BEGIN PUBLIC KEY-----) in the X.509 SubjectPublicKeyInfo structure.

During validation, you must specify the following three items according to the requested key type.

The salt length of 222 bytes is the maximum for RSA-PSS, and is calculated as ceil((2048 - 1) / 8) - 32 - 2 = 222. OpenSSL, Go, and Node.js automatically infer the salt length from the signature value during validation. However, Java (JCA) does not support automatic inference, so the salt length must be explicitly specified.

Validation example

The following is an example of validation of a signature value in Java.

// 1. Public key (PEM) parsing
String base64Key = publicKey
        .replace("-----BEGIN PUBLIC KEY-----", "")
        .replace("-----END PUBLIC KEY-----", "")
        .replaceAll("\\s", "");
X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(base64Key));

// 2. Remove the "ncpkms:v{key version}:" prefix from the signature value, then decode it using Base64
byte[] signatureBytes = Base64.getDecoder()
        .decode(signature.substring(signature.lastIndexOf(':') + 1));

// 3. Data to be signed - Original bytes obtained by Base64 decoding the data from the Sign request
byte[] data = Base64.getDecoder().decode(base64Data);

• RSA2048 key

PublicKey key = KeyFactory.getInstance("RSA").generatePublic(keySpec);

Signature verifier = Signature.getInstance("RSASSA-PSS");
verifier.setParameter(new PSSParameterSpec(
        "SHA-256",
        "MGF1",
        MGF1ParameterSpec.SHA256,
        222,    // RSA-PSS maximum salt length (RSA2048 + SHA-256)
        1
));
verifier.initVerify(key);
verifier.update(data);

boolean valid = verifier.verify(signatureBytes);

• ECDSA key

PublicKey key = KeyFactory.getInstance("EC").generatePublic(keySpec);

Signature verifier = Signature.getInstance("SHA256withECDSA");
verifier.initVerify(key);
verifier.update(data);

boolean valid = verifier.verify(signatureBytes);

Encrypt with public key

This section describes how to encrypt data directly using a retrieved public key. This is only available for the RSA2048 key type in NCP KMS. The ECDSA key type is provided exclusively for signing and validation (SIGN_VERIFY) and does not support any encryption features.

You must specify the following conditions when encrypting.

Encryption example

The following is an example of encrypting data using a public key in Java.

// 1. Public key (PEM) parsing
String base64Key = publicKey
        .replace("-----BEGIN PUBLIC KEY-----", "")
        .replace("-----END PUBLIC KEY-----", "")
        .replaceAll("\\s", "");
X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(base64Key));
PublicKey key = KeyFactory.getInstance("RSA").generatePublic(keySpec);

// 2. Encryption - Plaintext up to 190 bytes
OAEPParameterSpec spec = new OAEPParameterSpec(
        "SHA-256", "MGF1", MGF1ParameterSpec.SHA256, PSource.PSpecified.DEFAULT);
Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPPadding");
cipher.init(Cipher.ENCRYPT_MODE, key, spec);
byte[] ciphertextBytes = cipher.doFinal(plaintext);

// 3. To decrypt using the Decrypt API, pass the data with the "ncpkms:v{key version}:" prefix
String ciphertext = "ncpkms:v" + keyVersion + ":" + Base64.getEncoder().encodeToString(ciphertextBytes);