tencent cloud

Key Management Service

DocumentationKey Management ServicePractical TutorialAsymmetric Encryption and DecryptionAsymmetric Signature VerificationRSA Signature Verification

RSA Signature Verification

Download
Focus Mode
Font Size
Last updated: 2026-07-30 16:52:53
AI-Translated
This document describes how to use the RSA signature verification algorithm.

Operation Steps

Step 1: Creating an Asymmetric Signature Key

Attention:
When you call the CreateMasterKey API in KMS to create a customer master key, you must specify the correct key usage as KeyUsage=ASYMMETRIC_SIGN_VERIFY_RSA_2048. This is required to use the signature feature.
Request:
tccli kms CreateKey --Alias test_rsa --KeyUsage ASYMMETRIC_SIGN_VERIFY_RSA_2048
Returned results:
{
"Response": {
"KeyId": "22d79428-61d9-11ea-a3c8-525400******",
"Alias": "test_rsa",
"CreateTime": 1583739580,
"Description": "",
"KeyState": "Enabled",
"KeyUsage": "ASYMMETRIC_SIGN_VERIFY_RSA_2048",
"TagCode": 0,
"TagMsg": "",
"RequestId": "0e3c62db-a408-406a-af27-dd5ced******"
}
}

Step 2: Downloading the Public Key

Request:
tccli kms GetPublicKey  --KeyId 22d79428-61d9-11ea-a3c8-525400******
Returned results:
{
"Response": {
"RequestId": "408fa858-cd6d-4011-b8a0-653805******",
"KeyId": "22d79428-61d9-11ea-a3c8-525400******",
"PublicKey":  "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJahujq+PvM***************bBs/f3axWbvgvHx8Jmqw==",
"PublicKeyPem": "-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJa\\nhujq+PvM***************bBs/f3axWbvgvHx8Jmqw==\\n-----END PUBLIC KEY-----\\n"
}
}
Convert the public key PublicKeyPem to the pem format and save it to the file public_key.pem.
echo "-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEFLlge0vtct949CwtadHODzisgXJa
hujq+PvM***************bBs/f3axWbvgvHx8Jmqw==
-----END PUBLIC KEY-----" > public_key.pem
Attention:
You can log in to the KMS console, click Customer Keys > Key ID/Key Name to go to the key details page, and directly download the public key of the asymmetric key.

Step 3: Creating a Plaintext File for the Message

Create a test plaintext file.
echo "test" > test_verify.txt
Attention:
When the generated file contains invisible characters (such as line breaks), you must truncate the file (for example, using `truncate -s -1 test_verify.txt`) to ensure signature accuracy.

Step 4: Calculating the Message Digest

Attention:
If the message to be signed is no longer than 4096 bytes, you can skip this step and go directly to Step 5.
If the message to be signed exceeds 4096 bytes, you must first calculate the message digest locally on the client side.
Use openssl to calculate the digest of the content in the test_verity.txt file.
openssl dgst -sha256 -binary -out digest.bin test_verify.txt

Step 5: Generating a Signature via the KMS Signing API

Call the KMS Sign API to calculate the signature of the message.
1. Before calculating the signature for the original message or message digest, you must first perform base64 encoding.
//Base64-encode the message digest.
openssl enc -e -base64 -A -in digest.bin -out encoded.base64
//Base64-encode the original message.
openssl enc -e -base64 -A -in test_verify.txt -out encoded.base64
2. Calculate the signature.
Request:
RSA_PSS_SHA_256
//Use the content of the encoded.base64 file as the Message parameter for SignByAsymmetricKey to sign it as a message digest.
tccli kms SignByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm RSA_PSS_SHA_256 --Message "qJQj83hSyOuU7Tn0SRReGCk4yuuVWaeZ44BP******==" --MessageType DIGEST
//Sign the message as the original text (the original text must be Base64-encoded).
tccli kms SignByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm RSA_PSS_SHA_256 --Message "dG***Ao=" --MessageType RAW
RSA_PKCS1_SHA_256
//Use the content of the encoded.base64 file as the Message parameter for SignByAsymmetricKey to sign it as a message digest.
tccli kms SignByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm RSA_PKCS1_SHA_256 --Message "qJQj83hSyOuU7Tn0SRReGCk4yuuVWaeZ44BP******==" --MessageType DIGEST
//Sign the message as the original text (the original text must be Base64-encoded).
tccli kms SignByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --Algorithm RSA_PKCS1_SHA_256 --Message "dG***Ao=" --MessageType RAW
Returned results:
{
"Response": {
  "Signature": "U7Tn0SRReGCk4yuuVWaeZ4******",
  "RequestId": "408fa858-cd6d-4011-b8a0-653805******"
}
}
Save the signature content Signature to the file signContent.sign.
echo "U7Tn0SRReGCk4yuuVWaeZ4******" | base64 -d > signContent.bin

Step 6: Verifying the Signature

1. Verify the signature using the KMS signature verification API. (We recommend using this method for signature verification).
Request:
RSA_PSS_SHA_256
//Verify the message digest (use the content of the encoded.base64 file from step 4 as the Message parameter for VerifyByAsymmetricKey to verify the signature as a message digest).
tccli kms VerifyByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --SignatureValue "U7Tn0SRReGCk4yuuVWaeZ4******" --Message "QUuAcNFr1Jl5+3GDbCxU7te7Uekq+oTxZ**********=" --Algorithm RSA_PSS_SHA_256 --MessageType DIGEST
//Verify the original message (the original text must be Base64-encoded).
tccli kms VerifyByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --SignatureValue "U7Tn0SRReGCk4yuuVWaeZ4******" --Message "dG***Ao=" --Algorithm RSA_PSS_SHA_256 --MessageType RAW
RSA_PKCS1_SHA_256
//Verify the message digest (use the content of the encoded.base64 file from step 4 as the Message parameter for VerifyByAsymmetricKey to verify the signature as a message digest).
tccli kms VerifyByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --SignatureValue "U7Tn0SRReGCk4yuuVWaeZ4******" --Message "QUuAcNFr1Jl5+3GDbCxU7te7Uekq+oTxZ**********=" --Algorithm RSA_PKCS1_SHA_256 --MessageType DIGEST
//Verify the original message (the original text must be Base64-encoded).
tccli kms VerifyByAsymmetricKey --KeyId 22d79428-61d9-11ea-a3c8-525400****** --SignatureValue "U7Tn0SRReGCk4yuuVWaeZ4******" --Message "dG***Ao=" --Algorithm RSA_PKCS1_SHA_256 --MessageType RAW
Returned results:
{
"Response": {
"SignatureValid": true,
"RequestId": "6758cbf5-5e21-4c37-a2cf-8d47f5******"
}
}
Note:
The values for the Message and MessageType parameters used in the signature and verification APIs must be consistent.
2. Verify the signature locally using the KMS public key and the signature content.
Request:
//Verify the signature using the RSA_PSS_SHA_256 algorithm.
openssl dgst -verify public_key.pem -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -signature ./signContent.bin ./test_verify.txt
//Verify the signature using the RSA_PKCS1_SHA_256 algorithm.
openssl dgst -verify public_key.pem -sha256 -signature ./signContent.bin ./test_verify.txt
Returned results:
Verified OK

Previous Topic: SM2 Signature VerificationNext Topic: ECC Signature Verification

Help and Support

Was this page helpful?

Help us improve! Rate your documentation experience in 5 mins.

Feedback

Search
    Enter keywords to search documentation