Examples with SignResult com.azure.security.keyvault.keys.cryptography.models.SignResult used on opensource projects

Example 1 with SignResult

use of com.azure.security.keyvault.keys.cryptography.models.SignResult in project mssql-jdbc by Microsoft.

the class SQLServerColumnEncryptionAzureKeyVaultProvider method AzureKeyVaultSignHashedData.

/**
 * Generates signature based on RSA PKCS#v1.5 scheme using a specified Azure Key Vault Key URL.
 *
 * @param dataToSign
 *        - Text to sign.
 * @param masterKeyPath
 *        - Azure Key Vault key url.
 * @return Signature
 * @throws SQLServerException
 */
private byte[] AzureKeyVaultSignHashedData(byte[] dataToSign, String masterKeyPath) throws SQLServerException {
    assert ((null != dataToSign) && (0 != dataToSign.length));
    CryptographyClient cryptoClient = getCryptographyClient(masterKeyPath);
    SignResult signedData = cryptoClient.sign(SignatureAlgorithm.RS256, dataToSign);
    return signedData.getSignature();
}

Example 2 with SignResult

use of com.azure.security.keyvault.keys.cryptography.models.SignResult in project signers by ConsenSys.

the class AzureKeyVaultSigner method sign.

@Override
public Signature sign(byte[] data) {
    final AzureKeyVault vault;
    try {
        vault = createUsingClientSecretCredentials(config.getClientId(), config.getClientSecret(), config.getTenantId(), config.getKeyVaultName());
    } catch (final Exception e) {
        LOG.error("Failed to connect to vault", e);
        throw new SignerInitializationException(INACCESSIBLE_KEY_ERROR, e);
    }
    final CryptographyClient cryptoClient = vault.fetchKey(config.getKeyName(), config.getKeyVersion());
    final byte[] dataToSign = needsToHash ? Hash.sha3(data) : data;
    final SignResult result = cryptoClient.sign(signingAlgo, dataToSign);
    final byte[] signature = result.getSignature();
    if (signature.length != 64) {
        throw new RuntimeException("Invalid signature from the key vault signing service, must be 64 bytes long");
    }
    // reference: blog by Tomislav Markovski
    // https://tomislav.tech/2018-02-05-ethereum-keyvault-signing-transactions/
    // The output of this will be a 64 byte array. The first 32 are the value for R and the rest is
    // S.
    final BigInteger R = new BigInteger(1, Arrays.copyOfRange(signature, 0, 32));
    final BigInteger S = new BigInteger(1, Arrays.copyOfRange(signature, 32, 64));
    // The Azure Signature MAY be in the "top" of the curve, which is illegal in Ethereum
    // thus it must be transposed to the lower intersection.
    final ECDSASignature initialSignature = new ECDSASignature(R, S);
    final ECDSASignature canonicalSignature = initialSignature.toCanonicalised();
    // Now we have to work backwards to figure out the recId needed to recover the signature.
    final int recId = recoverKeyIndex(canonicalSignature, dataToSign);
    if (recId == -1) {
        throw new RuntimeException("Could not construct a recoverable key. Are your credentials valid?");
    }
    final int headerByte = recId + 27;
    return new Signature(BigInteger.valueOf(headerByte), canonicalSignature.r, canonicalSignature.s);
}

Example 3 with SignResult

use of com.azure.security.keyvault.keys.cryptography.models.SignResult in project mssql-jdbc by microsoft.

the class SQLServerColumnEncryptionAzureKeyVaultProvider method AzureKeyVaultSignHashedData.

/**
 * Generates signature based on RSA PKCS#v1.5 scheme using a specified Azure Key Vault Key URL.
 *
 * @param dataToSign
 *        - Text to sign.
 * @param masterKeyPath
 *        - Azure Key Vault key url.
 * @return Signature
 * @throws SQLServerException
 */
private byte[] AzureKeyVaultSignHashedData(byte[] dataToSign, String masterKeyPath) throws SQLServerException {
    assert ((null != dataToSign) && (0 != dataToSign.length));
    CryptographyClient cryptoClient = getCryptographyClient(masterKeyPath);
    SignResult signedData = cryptoClient.sign(SignatureAlgorithm.RS256, dataToSign);
    return signedData.getSignature();
}