Sign and verify data

The AO performs sign and verify operations through Google Distributed Cloud (GDC) air-gapped to the KMS through a gRPC client.

Before you begin

To get the required permissions to sign data, ask your Organization IAM Admin to grant you the KMS Developer (kms-developer) role in your project namespace.

Sign data

To sign data, use the gdcloud kms keys asymmetric-sign command. This command creates a digital signature of an input file using the Signing key, and saves the base64 encoded signature.

• To sign your data, pass in the key name and the following:

  gdcloud kms keys asymmetric-sign \
  namespaces/NAMESPACE/signingKeys/KEY_NAME \
  --input-file=INPUT_PATH \
  --signature-file=SIGNATURE_FILE
  

  Replace the following variables:

  • NAMESPACE: the project namespace—for example: kms-test1.
  • KEY_NAME: the name of the key used to sign—for example: key-1.
  • INPUT_PATH: the path of the input file you want to have signed.
  • SIGNATURE_FILE: the path of the output file to save the base64 encoded signature.

  After running the command, you see an output file you specified in the --signature-file flag that contains the base64 encoded signature.

Verify data

After signing your data, verify the base64 digital signature using the gdcloud kms keys asymmetric-verify command. This command verifies whether or not the base64 encoded digital signature you receive after running the gdcloud kms keys asymmetric-sign command is valid.

• To verify the signature, pass in the signature file and the following:

  gdcloud kms keys asymmetric-verify \
  namespaces/NAMESPACE/signingKeys/KEY_NAME \
    --input-file=INPUT_PATH \
    --signature-file=SIGNATURE_FILE
  

  After running the command, you see the output Verification OK if successful. If not successful, you see the failure output Verification Failure.