External signing with Google Cloud KMS

[arashnikoo]

I am working on a PoC to use ExternalSignature with Google Cloud KMS Asymmetric signing. My efforts have ended up creating corrupt signatures. Doesn't any one have any idea how to resolve this issue?

 @Override
    public byte[] sign(byte[] message) throws GeneralSecurityException {
        try {
            String encoded = Base64.getEncoder().encodeToString(message);
            System.out.println(encoded);;
            
            // Create SHA-256 MessageDigest instance
            MessageDigest sha256Digest = MessageDigest.getInstance("SHA256");
            
            // Hash the input message
            byte[] hashedMessage = sha256Digest.digest(message);

            Digest digest = Digest.newBuilder().setSha256(ByteString.copyFrom(hashedMessage)).build();

            // Set the GCP credentials
            KeyManagementServiceSettings settings = KeyManagementServiceSettings.newBuilder()
                    .build();

            try (KeyManagementServiceClient client = KeyManagementServiceClient.create(settings)) {
                AsymmetricSignResponse response = client.asymmetricSign(keyId, digest);
                return response.getSignature().toByteArray();
            }
        } catch (Exception e) {
            throw new GeneralSecurityException("Error while signing PDF", e);
        }
    }

My signature has the following error:

[arashnikoo]

More info about the signature:

[mkl-public]

Can you share an example PDF signed by your poc for analysis?

That being said, you talk about ExternalSignature - that sounds like an interface from OpenPDF5, not OpenPDF...

[arashnikoo]

Thanks, @mkl-public. Here is the signed file: signed-document-1.pdf

[mkl-public]

There are two certificates embedded:

• Subject: CN=Bob's key,O=Dealer A,L=Agoura Hills,ST=California,C=US
  Issuer: C=US,ST=California,L=Agoura Hills,O=Vitu,OU=IT,CN=Vitu Trust
  Serial: 2579306353
• Subject: C=US,ST=California,L=Agoura Hills,O=Vitu,OU=IT,CN=Vitu Trust
  Issuer: C=US,ST=California,L=Agoura Hills,O=Vitu,OU=IT,CN=Vitu Trust
  Serial: 1689184570

The claimed signer certificate is the first one but validation succeeds with the second one.

Thus, you appear to call KMS for the wrong private key, the wrong keyId.

[asturio]

Hi @arashnikoo , any feedback if the problem still unsolved?

[arashnikoo]

I haven't had time to test that again. I'll try again and report it here.