Support for SHA256withECDSA signing algorithm in hashicorp vault transit sign api

Question

We have created a encryption key of type ecdsa-p256 using /v1/transit/keys/ api and further we are signing using /v1/transit/sign/ api and trying to verify using vault it is successfully verified with valid as true but while verifying the signature using java program with SHA256withECDSA algo and public key, input and signature recieved while creation getting Exception as

java.security.SignatureException: Invalid encoding for signature

So is SHA256withECDSA signing algo supported for ecdsa-p256 encryption key in transit engine

here is the curl used for signing :

curl --location 'http://localhost:8200/v1/transit/sign/test' \ --header 'X-Vault-Token: hvs.GJjDLDxW1iikrJfjK9PJgXTa' \ --header 'Content-Type: text/plain' \ --data '{ "input": "c2FtcGxlIHRleHQ=" } '

The result we are expecting is successfully verification of signature, public key and inputs using SHA256withECDSA signing algo if it is supported by vault .

Answer 1

You need to remove vault:v1: and base64 decode the rest of the signature and use these bytes in Java.

So if Vault gives you:

vault:v1:MEQCICWuieeB8UhFdoP+dN59uaeiFpdkRPS3FpEN/ZotE11mAiB3MD/U39uXmKEBhJ/Vc8rZcwrDMY4EB9A4fXQ+uVXNzA==

You will end up with these bytes (not characters, line wrapped for pretty printing):

3044022025ae89e781f148457683fe74de7db9a7a216976444f4b716910d
fd9a2d135d66022077303fd4dfdb9798a101849fd573cad9730ac3318e04
07d0387d743eb955cdcc

This openssl and xxd command will provide you with those bytes (ymmv):

$ openssl base64 -d -A <<< 'MEQCICWuieeB8UhFdoP+dN59uaeiFpdkRPS3FpEN/ZotE11mAiB3MD/U39uXmKEBhJ/Vc8rZcwrDMY4EB9A4fXQ+uVXNzA==' | xxd -p