ExDSA

Those basic cryptography operations allow the calculation and verify ExDSA signatures. ECDSA and EdDSA are supported.

Allowed users

User

Allowed

Alternative

ExtAuth

Required access scope

Main

keymgmt:use:<KID>

where <KID> is a Key ID as a 32-character hexadecimal string

Sign

Sign a message

POST https://my.ence.do/api/crypto/exdsa/sign

Return a signature of the given message.

Headers

Name	Type	Description
Authorization*	String	Bearer JWT_TOKEN
Content-Type*	String	application/json

Request Body

Name	Type	Description
alg*	String	Algorithm to use (e.g. Ed25519ctx)
ctx	String	Base64 encoded additional context data
msg*	String	Data message to sign (max. 2048 bytes)
kid*	String	Key ID, 32 chars hex string

Response status code

200: Operation successful

{
  "sign": "4IzdVAZlsNHaUXGNaPMUg139TwnW5QB7WvVKAMEFnHF3JT122JTTnCHuZ1Z6sc2Hvz3WETWJ0ePKUVRJ5HzxDQ=="
}

400: Bad Request Incorrect argument(s)

401: Unauthorized Missing or invalid JWT_TOKEN

403: Forbidden Incorrect access scope

406: Not Acceptable Operation failed

409: Conflict Incorrect internal state

418: I'm a Teapot TLS (https) connection required

Possible alg values

Algorithm	Description
SHA256WithECDSA	Regarding NIST SP 800-186
SHA384WithECDSA	Regarding NIST SP 800-186
SHA512WithECDSA	Regarding NIST SP 800-186
Ed25519	Regarding RFC8032 Section-5.1
Ed25519ph	Regarding RFC8032 Section-5.1
Ed25519ctx	Regarding RFC8032 Section-5.1
Ed448	Regarding RFC8032 Section-5.2
Ed448ph	Regarding RFC8032 Section-5.2

Response data for successful operation

Name	Type	Description
sign	String	Base64 encoded signature

Log entries

Event	Result	Source
LOG_TYPE_FAILED_SCOPE_CHECK	LOG_RESULT_FAILED	403
LOG_TYPE_CRYPTO_EXDSA_SIGN	LOG_RESULT_ERROR	400
LOG_TYPE_CRYPTO_EXDSA_SIGN	LOG_RESULT_FAILED	406
LOG_TYPE_CRYPTO_EXDSA_SIGN	LOG_RESULT_OK	200

Verify

Verify the message signature

POST https://my.ence.do/api/crypto/exdsa/verify

Verify the signature of the given message.

Headers

Name	Type	Description
Authorization*	String	Bearer JWT_TOKEN
Content-Type*	String	application/json

Request Body

Name	Type	Description
alg*	String	Algorithm to use (e.g. Ed25519ctx)
ctx	String	Base64 encoded additional context data
kid*	String	Key ID, 32 chars hex string
msg*	String	Data message to verify (max. 2048 bytes)
sign*	String	Signature to validate return by sign

Response status code

200: Operation successful

400: Incorrect argument(s)

401: Missing or invalid JWT_TOKEN

403: Incorrect access scope

406: Operation failed

409: Incorrect internal state

418: TLS connection required

Possible alg values

Check the list here.

Log entries

Event	Result	Source
LOG_TYPE_FAILED_SCOPE_CHECK	LOG_RESULT_FAILED	403
LOG_TYPE_CRYPTO_EXDSA_VERIFY	LOG_RESULT_ERROR	400
LOG_TYPE_CRYPTO_EXDSA_VERIFY	LOG_RESULT_FAILED	406
LOG_TYPE_CRYPTO_EXDSA_VERIFY	LOG_RESULT_OK	200