All Products
Search

This Product

    Key Management Service:Sign

    Document Center

    Key Management Service:Sign

    Last Updated:Jan 30, 2024

    Signs data using an asymmetric key.

    Usage notes

    For more information about key specifications and encryption modes, see Key types and specifications.

    Usage notes

    After all request parameters are encoded by using Protocol Buffers, the request body cannot exceed 3 MB in length. If the request body exceeds 3 MB, the server rejects the request and returns an HTTP 413 status code. If the size of a message to sign is large, we recommend that you locally generate a digest of the message and then call the Sign or Verify operation for signing and verification.

    Request parameters

    Parameter

    Type

    Required

    Example

    Description

    KeyId

    string

    Yes

    1234abcd-12ab-34cd-56ef-12345678****

    The globally unique ID of the key. You can also set this parameter to an alias that is bound to the key.

    Algorithm

    string

    Yes

    RSAES_OAEP_SHA_256

    The signature algorithm. Valid values:

    • RSA_PSS_SHA_256

    • RSA_PKCS1_SHA_256

    • ECDSA_SHA_256

    • SM2DSA

    MessageType

    string

    Yes

    RAW

    The message type. Valid values:

    • RAW: the raw data. This is the default value.

    • DIGEST: the message digest of the raw data. Key Management Service (KMS) does not process the message digest of the raw data. KMS directly uses a private key to sign data.

    Message

    bytes

    Yes

    Binary data

    The message to sign.

    • The MessageType parameter is set to RAW: The hash algorithm that is specified by the Algorithm parameter is used to generate a digest for the raw data, and the digest is signed.

    • The MessageType parameter is set to DIGEST: The digest can be up to 32 bytes in length.

    Response parameters

    Parameter

    Type

    Example

    Description

    Signature

    bytes

    Binary data

    The calculated signature value.

    KeyId

    string

    1234abcd-12ab-34cd-56ef-12345678****

    The globally unique ID of the key. If the KeyId parameter is set to an alias of the key, the ID of the key to which the alias is bound is returned.

    Algorithm

    string

    RSAES_OAEP_SHA_256

    The signing algorithm.

    MessageType

    string

    RAW

    The type of the message.

    RequestId

    string

    475f1620-b9d3-4d35-b5c6-3fbdd941423d

    The request ID.

    Error codes

    For a list of error codes, see Service error codes.