0

Looking into Amazon AWS KMS (Key Management System).

Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/Welcome.html). However, I want to sign data (JWT in particular).

My questions:

1) Is signing barely encryption of the hash of the content?

2) In JWT case, if I hash the content of JWT and encrypt it and put it in signature field, will it be correct signing?

Thanks,

1

KMS + JWT is confusing and easily misused. This question is about pragmatics, so summary answers below, happy to expand on them but the details are intricate.

1) Is signing barely encryption of the hash of the content?

It is not.

2) In JWT case, if I hash the content of JWT and encrypt it and 
   put it in signature field, will it be correct signing?

It will not.

If you are using JWTs for authorization tokens, here's the short version of what you likely want to do:

  • Use KMS to generate a 256 bit Data Key, in both encrypted and plaintext forms: https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html
  • Save the encrypted form of the data key, along with the CMK key-id under which it was minted, in your database or with application configuration
  • Use the 256 bit plaintext Data Key as the "secret" with your language platform's preferred JWT library to sign and validate JWTs.
  • When your application restarts, get the encrypted Data Key from the database, call KMS Decrypt on it to get the plaintext version of the Data Key, and use as above for JWT signing and validation

Hope that helps.

  • You mention JWT for authorization, but I thought you meant authentication. OK so pretty much I should use the envelope encryption approach, which is also what AWS suggested. Thanks for your answer! – dev Jun 29 '18 at 10:02
  • Yeah, that's the right takeaway, cheers and good luck. Re: authn vs authz, a JWT is usually something you assign to encode entitlements and claims, following an earlier proof of identity, not something on its own that serves as an initial proof of identity. – Jonah Benton Jun 29 '18 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.