amazon-web-services - 为 AWIS 创建 AWS v4 签名

Question

多年来我们一直使用 AWS v2 签名，现已被 v4 取代。

我正在慢慢地完成所有步骤，但在第 3 步中遇到了困难，其中要求以二进制格式输出的 HMAC-SHA256 加密。 https://docs.aws.amazon.com/AlexaWebInfoService/latest/CalculatingSignatures.html https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html

我需要在经典 ASP 中执行此操作，我有编码 SHA256 的脚本，但我找不到任何可以二进制输出的脚本。

我得到的最接近的是 Chilkat 组件，它似乎从 SHA256 哈希值输出二进制文件，但我不知道如何实现这一点: http://www.chilkatsoft.com/refdoc/xChilkatCrypt2Ref.html#method72

任何人都可以使用脚本(asp、vbscript、javascript)或 Chilkat(或其他)组件为我指明正确的方向吗？真正引起问题的是二进制输出。

提前非常感谢

Answer 1

AWS V4 签名生成过程让我摸不着头脑好几天(HMAC 二进制输出也让我难住了)，但使用纯经典 ASP 是可能的。这是我编写的用于生成签名 S3 URL 的类(我不熟悉 AWIS，但浏览了您链接的文档后，我可以看到签名生成过程是相同的):

Class AmazonWebServices

    Private AWS_utc, AWS_timestamp, AWS_timestamp_short, AWS_url, AWS_headers, AWS_string_to_sign, AWS_signature

    Private AWS_S3_key, AWS_S3_region, AWS_S3_version, AWS_S3_bucket, AWS_S3_host, AWS_S3_secret

    Private Sub Class_Initialize()

        ' AWS expects a UTC timestamp, if your server isn't set to UTC you will need to apply
        ' an offset to NOW() using DateAdd()

        AWS_utc = NOW() ' Or to apply an offset: DateAdd("h",-1,NOW())

        AWS_timestamp = year(AWS_utc) & zero_pad(month(AWS_utc)) & zero_pad(day(AWS_utc)) &_
        "T" & zero_pad(hour(AWS_utc)) & zero_pad(minute(AWS_utc)) & zero_pad(second(AWS_utc)) & "Z"

        AWS_timestamp_short = left(AWS_timestamp,8)

        AWS_S3_key = "XXXXXXXXXXXXXXXXXXXX"

        AWS_S3_region = "eu-west-2"

        AWS_S3_version = "2006-03-01"

        AWS_S3_bucket = "BUCKETNAME"

        AWS_S3_host = AWS_S3_bucket & ".s3." & AWS_S3_region & ".amazonaws.com"

        AWS_S3_secret = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

    End Sub

    public function s3_signed_url(ByVal theFile, ByVal expire)

        ' expire is the number of seconds to keep the url alive

        ' Prefix the file name with a slash

        if NOT inStr(theFile,"/") = 1 then theFile = "/" & theFile

        ' Construct the S3 URL

        AWS_url = "https://" & AWS_S3_host & theFile &_
        "?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD" &_
        "&X-Amz-Algorithm=AWS4-HMAC-SHA256" &_
        "&X-Amz-Credential=" & AWS_S3_key &_ 
            "%2F" & AWS_timestamp_short &_ 
            "%2F" & AWS_S3_region &_ 
            "%2Fs3" &_
            "%2Faws4_request" &_
        "&X-Amz-Date=" & AWS_timestamp &_
        "&X-Amz-SignedHeaders=host" &_
        "&X-Amz-Expires=" & expire &_
        "&X-Amz-Signature="

        ' Construct the GET headers

        ' headers need to be separated with just a line feed
        ' VBlf = line feed
        ' VBcr = carriage return
        ' VBcrlf = carriage return & line feed
        ' Anything but VBlf (or chr(10)) will return a signature mismatch

        AWS_headers = "GET" & VBlf &_ 
        theFile & VBlf &_ 
        "X-Amz-Algorithm=AWS4-HMAC-SHA256" &_
        "&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD" &_
        "&X-Amz-Credential=" & AWS_S3_key &_ 
            "%2F" & AWS_timestamp_short &_ 
            "%2F" & AWS_S3_region &_ 
            "%2Fs3" &_
            "%2Faws4_request" &_
        "&X-Amz-Date=" & AWS_timestamp &_ 
        "&X-Amz-Expires=" & expire &_ 
        "&X-Amz-SignedHeaders=host" & VBlf &_ 
        "host:" & AWS_S3_host & VBlf & VBlf &_ 
        "host" & VBlf &_ 
        "UNSIGNED-PAYLOAD"

        ' GET headers are hashed with SHA256

        AWS_headers = hash(AWS_headers,"SHA256","hex")

        ' Construct the string to sign

        AWS_string_to_sign = "AWS4-HMAC-SHA256" & VBlf &_ 
        AWS_timestamp & VBlf &_
        AWS_timestamp_short & "/" & AWS_S3_region & "/s3/aws4_request" & VBlf &_ 
        AWS_headers

        ' date key, generated by hashing the short timestamp using the secret key as the HMAC key

        AWS_signature = hash_hmac("AWS4" & AWS_S3_secret,AWS_timestamp_short,"SHA256","raw")    

        ' region key, generated by hashing the region using the date key as the HMAC key

        AWS_signature = hash_hmac(AWS_signature,AWS_S3_region,"SHA256","raw")

        ' service key, generated by hashing the service name using the region key as the HMAC key

        AWS_signature = hash_hmac(AWS_signature,"s3","SHA256","raw")        

        ' signing key, generated by hashing the request type using the service key as the HMAC key

        AWS_signature = hash_hmac(AWS_signature,"aws4_request","SHA256","raw")

        ' signature, generated by hashing the "string to sign" using the signing key as the HMAC key

        AWS_signature = hash_hmac(AWS_signature,AWS_string_to_sign,"SHA256","hex")

        ' Return the complete URL with signature

        s3_signed_url = AWS_url & AWS_signature

    end function

    private function hash(ByVal input, ByVal alg, ByVal encoding)
        ' Convert the input to bytes if not already
        if NOT vartype(input) = 8209 then input = string_to_UTF8_bytes(input)
        Dim hAlg : Set hAlg = Server.CreateObject("System.Security.Cryptography." & get_hash_class(alg))
            hash = binary_encode(hAlg.ComputeHash_2((input)),encoding)     
        set hAlg = nothing
    end function

    private function hash_hmac(ByVal secret, ByVal message, ByVal alg, ByVal encoding)
        ' Convert the input to bytes if not already
        if NOT vartype(secret) = 8209 then secret = string_to_UTF8_bytes(secret)
        if NOT vartype(message) = 8209 then message = string_to_UTF8_bytes(message)
        Dim hAlg : Set hAlg = Server.CreateObject("System.Security.Cryptography." & get_hmac_class(alg))
            hAlg.Initialize() 
            hAlg.key = secret
            hash_hmac = binary_encode(hAlg.ComputeHash_2((message)),encoding)             
       set hAlg = nothing
    end function

    private function binary_encode(ByVal binary, ByVal encoding)
        encoding = lCase(encoding)
        if encoding = "raw" then
            binary_encode = binary
            exit function
        end if
        Dim enc : Set enc = Server.CreateObject("MSXML2.DomDocument").CreateElement("encode")
            if encoding = "base64" OR encoding = "b64" then
                ' base64 string
                enc.dataType = "bin.base64"
                enc.nodeTypedValue = binary
                binary_encode = enc.Text 
            else
                ' hexadecimal string
                enc.dataType = "bin.hex"
                enc.nodeTypedValue = binary
                binary_encode = enc.Text 
            end if
        Set enc = nothing
    end function

    private function get_hash_class(ByVal alg)
        ' get the cryptography class name for the specified hashing algorithm,
        ' return the class name for SHA1 if not found
        select case uCase(alg)
            case "MD5"
                get_hash_class = "MD5CryptoServiceProvider"
            case "SHA1"
                get_hash_class = "SHA1CryptoServiceProvider"
            case "SHA2","SHA256"
                get_hash_class = "SHA256Managed"
            case "SHA3","SHA384"
                get_hash_class = "SHA384Managed"
            case "SHA5","SHA512"
                get_hash_class = "SHA512Managed"
            case else
                get_hash_class = "SHA1CryptoServiceProvider"
        end select
    end function

    private function get_hmac_class(ByVal alg)
        ' get the cryptography class name for the specified HMAC algorithm,
        ' return the class name for SHA1 if not found
        select case uCase(alg)
            case "MD5"
                get_hmac_class = "HMACMD5"
            case "SHA1"
                get_hmac_class = "HMACSHA1"
            case "SHA3","SHA384"
                get_hmac_class = "HMACSHA384"
            case "SHA2","SHA256"
                get_hmac_class = "HMACSHA256"
            case "SHA5","SHA512"
                get_hmac_class = "HMACSHA512"
            case else
                get_hmac_class = "HMACSHA1"
        end select
    end function

    private function string_to_UTF8_bytes(ByVal aString) 
        ' convert a UTF8 string to bytes
        Dim UTF8 : Set UTF8 = Server.CreateObject("System.Text.UTF8Encoding") 
            string_to_UTF8_bytes = UTF8.GetBytes_4(aString) 
        set UTF8 = nothing
    end function

    private function zero_pad(ByVal theNum)
        if len(theNum) = 1 then
            zero_pad = cStr("0" & theNum)
        else
            zero_pad = theNum
        end if
    end function

end class

要生成 24 小时 S3 签名 URL:

set AWS = new AmazonWebServices

    response.write AWS.s3_signed_url("file.name",86400)

set AWS = nothing

示例输出:

https://BUCKETNAME.s3.eu-west-2.amazonaws.com/file.name?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=XXXXXXXXXXXXXXXXXXXX%2F20190404%2Feu-west-2%2Fs3%2Faws4_request&X-Amz-Date=20190404T130643Z&X-Amz-SignedHeaders=host&X-Amz-Expires=86400&X-Amz-Signature=4e1ef2a12c304de0896f5faa2a472be5f66724d3c9778a73a1d623d30769c162

Time to execute: 0.00391s

您还在问题中提到了 Chilkat。 Chilkat 实际上可以为您生成 v4 签名:

https://www.chilkatsoft.com/refdoc/xChilkatAuthAwsRef.html

https://www.example-code.com/asp/aws_pre_signed_url_v4.asp

但它确实需要许可证。几年前我买了一个，我强烈推荐给仍然使用经典 ASP 的人。