tencent cloud

Key Management Service

문서Key Management Service

SM2 Signature Verification

다운로드
포커스 모드
폰트 크기
마지막 업데이트 시간: 2026-07-30 16:52:53
AI 번역
This document describes how to use the SM2 signature verification algorithm.

Operation Steps

Step 1: Creating an Asymmetric Signature Key

Attention:
When you call the Create Master Key API in KMS to create a customer master key, you must specify the correct key usage KeyUsage=ASYMMETRIC_SIGN_VERIFY_SM2 to use the signature feature.
Request:
tccli kms CreateKey --Alias test --KeyUsage ASYMMETRIC_SIGN_VERIFY_SM2
Returned results:
{
    "Response": {
        "KeyId": "22d79428-61d9-11ea-a3c8-525400******",
        "Alias": "test",
        "CreateTime": 1583739580,
        "Description": "",
        "KeyState": "Enabled",
        "KeyUsage": "ASYMMETRIC_SIGN_VERIFY_SM2",
        "TagCode": 0,
        "TagMsg": "",
        "RequestId": "0e3c62db-a408-406a-af27-dd5ced******"
    }
}

Step 2: Downloading the Public Key

Request:
tccli kms GetPublicKey  --KeyId 22d79428-61d9-11ea-a3c8-525400******
Returned results:
{
    "Response": {
        "RequestId": "408fa858-cd6d-4011-b8a0-653805******",
        "KeyId": "22d79428-61d9-11ea-a3c8-525400******",
        "PublicKey":  "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJahujq+PvM***************bBs/f3axWbvgvHx8Jmqw==",
        "PublicKeyPem": "-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJa\\nhujq+PvM***************bBs/f3axWbvgvHx8Jmqw==\\n-----END PUBLIC KEY-----\\n"
    }
}
Convert the public key PublicKeyPem to pem format and save it to the public_key.pem file:
echo "-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJa
hujq+PvM***************bBs/f3axWbvgvHx8Jmqw==
-----END PUBLIC KEY-----" > public_key.pem
Note:
Alternatively, you can log in to the KMS console, click Customer Keys > Key ID/Key Name to go to the key details page, and directly download the asymmetric key public key.

Step 3: Creating a Plaintext File for the Message

Create a test plaintext file:
echo "test" > test_verify.txt
Attention:
If the generated file contains invisible characters (such as line breaks), you must truncate the file (for example, using truncate -s -1 test_verify.txt) to ensure signature accuracy.

Step 4: Calculating the Message Digest

If the message to be signed is no longer than 4096 bytes, you can skip this step and go directly to Step 5.
If the message to be signed exceeds 4096 bytes, you must first calculate the message digest locally on the client side. Use gmssl to calculate the digest of the test_verity.txt file content:
gmssl sm2utl -dgst -in ./test_verify.txt -pubin -inkey ./public_key.pem -id 1234567812345678 > digest.bin

Step 5: Generating a Signature via the KMS Signing API

Call the KMS Sign API to calculate the signature of the message.
1. Before calculating the signature for the original message or message digest, you must first perform base64 encoding.
//Base64-encode the message digest.
gmssl enc -e -base64 -A -in digest.bin -out encoded.base64
//Base64-encode the original message.
gmssl enc -e -base64 -A -in test_verify.txt -out encoded.base64
2. Calculate the signature. Request:
//Use the content of the encoded.base64 file as the Message parameter for SignByAsymmetricKey to sign it as a message digest.
tccli kms SignByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm SM2DSA --Message "qJQj83hSyOuU7Tn0SRReGCk4yuuVWaeZ44BP******==" --MessageType DIGEST

//Sign the message as the original text (the original text must be Base64-encoded).
tccli kms SignByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm SM2DSA --Message "dG***Ao=" --MessageType RAW
Returned results:
{
        "Response": {
            "Signature": "U7Tn0SRReGCk4yuuVWaeZ4******",
            "RequestId": "408fa858-cd6d-4011-b8a0-653805******"
        }
}
Save the signature content Signature to the signContent.sign file:
echo "U7Tn0SRReGCk4yuuVWaeZ4******" | base64 -d > signContent.bin

Step 6: Verifying the Signature

Verify the signature using the KMS signature verification API (We recommend using this method for signature verification). Request:
//Verify the original message (the original text must be Base64-encoded).
tccli kms VerifyByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --SignatureValue "U7Tn0SRReGCk4yuuVWaeZ4******" --Message "dG***Ao=" --Algorithm SM2DSA --MessageType RAW
//Verify the message digest (use the content of the encoded.base64 file from step 4 as the Message parameter for VerifyByAsymmetricKey to verify the signature as a message digest).
tccli kms VerifyByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --SignatureValue "U7Tn0SRReGCk4yuuVWaeZ4******" --Message "QUuAcNFr1Jl5+3GDbCxU7te7Uekq+oTxZ**********=" --Algorithm SM2DSA --MessageType DIGEST
Note:
The values for the Message and MessageType parameters used in the signature and verification APIs must be consistent.
Returned results:
{
    "Response": {
          "SignatureValid": true,
          "RequestId": "6758cbf5-5e21-4c37-a2cf-8d47f5******"
    }
}
Verify the signature locally using the KMS public key and the signature content. Request:
gmssl  sm2utl -verify -in ./test_verify.txt -sigfile ./signContent.bin -pubin -inkey ./public_key.pem -id 1234567812345678
Returned results:
Signature Verification Successful

다음 주제: 개인 정보 보호 정책

도움말 및 지원

문제 해결에 도움이 되었나요?

피드백

키워드로 검색
    Enter keywords to search documentation