Payload signing using asymmetric keys

[srs-api]

Is there a policy that we can use to sign payload using asymmetric keys(public/private keys) instead of HMAC policy ?

[dchiesa1]

There are builtin policies for generating signed JWT or JWS with RSA or EC keys. 

There are community-contributed policies - Java callouts - that do other kinds of signing. Think of this as RSA signing or ECDSA signing, without the JOSE wrapper.  There is also an HttpSignature callout.  

What specifically are you looking for? 

[srs-api]

I am looking to sign specific payloads on outgoing messages as well as verify the signature on  the incoming payloads using agreed upon RSA keys. We also want to support this on different content-types. We can surely look at using JWS, but wanted to see if there any other ways to do without the wrapper. 

[dchiesa1]

I just looked and I don't know of a callout that signs using RSA keys. There is a callout that encrypts with RSA, but nothing that does signing. (EDIT: I've updated it, it now does signing).

---

OLD INFORMATION:

It would take very little work to extend or modify that to also sign with RSA keys. This item was on my "to do" list, but i didn't have anyone specifically asking for it, so I deferred that work.

Do you have specific requirements around padding? PKCS v1.5 vs PSS?

Do you have an example of how you'd like to verify the signatures?

There are a number of options and I'd like to insure interoperability in what I produce.

[srs-api]

Thanks for looking into this. We don't have any specific requirements around padding. We should be good using PKCSv1.5. Also we are still hashing this out so I don't have concrete examples on how we intend to verify the signatures.

[dchiesa1 · Accepted solution]

OK I've updated the RSA callout to do Signing and Verification, in addition to the  Encryption/Decryption.

Find it here (URL has been updated):

https://github.com/DinoChiesa/Apigee-CustomPolicy-RsaCrypto

[srs-api]

Thank you very much. I really appreciate your help. Let me try it out and will get back to you if i have any questions.