ExDSA

Those basic cryptography operations allow the calculation and verify ExDSA signatures. ECDSA and EdDSA are supported.

Allowed users

User

Allowed

Alternative

Not allowed

ExtAuth

Allowed

Required access scope

Main

keymgmt:use:<KID>

where <KID> is a Key ID as 32 chars hexadecimal string

Sign

Sign a message

POST https://my.ence.do/api/crypto/exdsa/sign

Return a signature of the given message.

Headers

Name	Type	Description
Authorization*	String	Bearer JWT_TOKEN
Content-Type*	String	application/json

Request Body

Name	Type	Description
alg*	String	Algorithm to use (e.g. Ed25519ctx)
ctx	String	Base64 encoded additional context data
msg*	String	Data message to sign
kid*	String	Key ID, 32 chars hex string

200: OK Operation sucessful

{
  "sign": "4IzdVAZlsNHaUXGNaPMUg139TwnW5QB7WvVKAMEFnHF3JT122JTTnCHuZ1Z6sc2Hvz3WETWJ0ePKUVRJ5HzxDQ=="
}

400: Bad Request Incorrect argument(s)

401: Unauthorized Missing or invalid JWT_TOKEN

403: Forbidden Incorrect access scope

406: Not Acceptable Operation failed

409: Conflict Incorrect internal state

418: I'm a Teapot TLS (https) connection required

Possible alg values

Algorithm	Description
SHA256WithECDSA	Regard to NIST SP 800-186
SHA384WithECDSA	Regard to NIST SP 800-186
SHA512WithECDSA	Regard to NIST SP 800-186
Ed25519	Regard to RFC8032 Section-5.1
Ed25519ph	Regard to RFC8032 Section-5.1
Ed25519ctx	Regard to RFC8032 Section-5.1
Ed448	Regard to RFC8032 Section-5.2
Ed448ph	Regard to RFC8032 Section-5.2

Response data for successful operation

Name	Type	Description
sign	String	Base64 encoded signature

Log entries

Event	Result	Source
LOG_TYPE_FAILED_SCOPE_CHECK	LOG_RESULT_FAILED	403
LOG_TYPE_CRYPTO_EXDSA_SIGN	LOG_RESULT_ERROR	400
LOG_TYPE_CRYPTO_EXDSA_SIGN	LOG_RESULT_FAILED	406
LOG_TYPE_CRYPTO_EXDSA_SIGN	LOG_RESULT_OK	200

Verify

Verify a message signature

POST https://my.ence.do/api/crypto/exdsa/verify

Verify the signature of the given message.

Headers

Name	Type	Description
Authorization*	String	Bearer JWT_TOKEN
Content-Type*	String	application/json

Request Body

Name	Type	Description
alg*	String	Algorithm to use (e.g. Ed25519ctx)
ctx	String	Base64 encoded additional context data
kid*	String	Key ID, 32 chars hex string
msg*	String	Data message to verify
sign*	String	Signature to validate return by sign

200: OK Operation sucessful

400: Bad Request Incorrect argument(s)

401: Unauthorized Missing or invalid JWT_TOKEN

403: Forbidden Incorrect access scope

406: Not Acceptable Operation failed

409: Conflict Incorrect internal state

418: I'm a Teapot TLS (https) connection required

Possible alg values

Check the list here.

Log entries

Event	Result	Source
LOG_TYPE_FAILED_SCOPE_CHECK	LOG_RESULT_FAILED	403
LOG_TYPE_CRYPTO_EXDSA_VERIFY	LOG_RESULT_ERROR	400
LOG_TYPE_CRYPTO_EXDSA_VERIFY	LOG_RESULT_FAILED	406
LOG_TYPE_CRYPTO_EXDSA_VERIFY	LOG_RESULT_OK	200