-
Notifications
You must be signed in to change notification settings - Fork 7
Description
Per Gavin's Discord message, consider adding the example of the actual signing code to the documentation.
Brian Morton wrote:
I just saw the updated version 0.5.0 released over the summer. I'm trying to implement a remote signer with AWS KMS. In this example, what should be returned by the private_sign function? I understand that it's bytes, but is it just the signature? What encoding should be used?
From KMS docs:
When used with the supported RSA signing algorithms, the encoding of this value is defined by PKCS #1 in RFC 8017.
When used with the ECDSA_SHA_256, ECDSA_SHA_384, or ECDSA_SHA_512 signing algorithms, this value is a DER-encoded object as defined by ANSI X9.62–2005 and RFC 3279 Section 2.2.3. This is the most commonly used signature format and is appropriate for most uses.
https://opensource.contentauthenticity.org/docs/c2pa-python/#add-a-signed-manifest-to-a-media-file-or-stream
Gavin said:
It looks like we left the example of the actual signing code out of the documentation.
There are two implementation examples in this file:
https://github.com/contentauth/c2pa-python/blob/main/c2pa/c2pa_api/c2pa_api.py
# Example of using python crypto to sign data using openssl with Ps256
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
def sign_ps256(data: bytes, key_path: str) -> bytes:
with open(key_path, "rb") as key_file:
private_key = serialization.load_pem_private_key(
key_file.read(),
password=None,
)
signature = private_key.sign(
data,
padding.PSS(
mgf=padding.MGF1(hashes.SHA256()),
salt_length=padding.PSS.MAX_LENGTH
),
hashes.SHA256()
)
return signature