Skip to content

Commit 3f14d77

Browse files
Fred1155Fred1155
committed
Revert "Add support for ECDSA signed CloudFront URLs (#6627)"
This reverts commit 5b2e5e0.
1 parent df6e381 commit 3f14d77

File tree

5 files changed

+129
-366
lines changed

5 files changed

+129
-366
lines changed

‎services/cloudfront/src/main/java/software/amazon/awssdk/services/cloudfront/CloudFrontUtilities.java‎

Lines changed: 4 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919

2020
import java.net.URI;
2121
import java.security.InvalidKeyException;
22-
import java.security.PrivateKey;
2322
import java.util.function.Consumer;
2423
import software.amazon.awssdk.annotations.Immutable;
2524
import software.amazon.awssdk.annotations.SdkPublicApi;
@@ -141,7 +140,7 @@ public SignedUrl getSignedUrlWithCannedPolicy(CannedSignerRequest request) {
141140
try {
142141
String resourceUrl = request.resourceUrl();
143142
String cannedPolicy = SigningUtils.buildCannedPolicy(resourceUrl, request.expirationDate());
144-
byte[] signatureBytes = signPolicy(cannedPolicy.getBytes(UTF_8), request.privateKey());
143+
byte[] signatureBytes = SigningUtils.signWithSha1Rsa(cannedPolicy.getBytes(UTF_8), request.privateKey());
145144
String urlSafeSignature = SigningUtils.makeBytesUrlSafe(signatureBytes);
146145
URI uri = URI.create(resourceUrl);
147146
String protocol = uri.getScheme();
@@ -267,7 +266,7 @@ public SignedUrl getSignedUrlWithCustomPolicy(CustomSignerRequest request) {
267266
request.expirationDate(),
268267
request.ipRange());
269268

270-
byte[] signatureBytes = signPolicy(policy.getBytes(UTF_8), request.privateKey());
269+
byte[] signatureBytes = SigningUtils.signWithSha1Rsa(policy.getBytes(UTF_8), request.privateKey());
271270
String urlSafePolicy = SigningUtils.makeStringUrlSafe(policy);
272271
String urlSafeSignature = SigningUtils.makeBytesUrlSafe(signatureBytes);
273272
URI uri = URI.create(resourceUrl);
@@ -369,7 +368,7 @@ public CookiesForCannedPolicy getCookiesForCannedPolicy(Consumer<CannedSignerReq
369368
public CookiesForCannedPolicy getCookiesForCannedPolicy(CannedSignerRequest request) {
370369
try {
371370
String cannedPolicy = SigningUtils.buildCannedPolicy(request.resourceUrl(), request.expirationDate());
372-
byte[] signatureBytes = signPolicy(cannedPolicy.getBytes(UTF_8), request.privateKey());
371+
byte[] signatureBytes = SigningUtils.signWithSha1Rsa(cannedPolicy.getBytes(UTF_8), request.privateKey());
373372
String urlSafeSignature = SigningUtils.makeBytesUrlSafe(signatureBytes);
374373
String expiry = String.valueOf(request.expirationDate().getEpochSecond());
375374
return DefaultCookiesForCannedPolicy.builder()
@@ -470,7 +469,7 @@ public CookiesForCustomPolicy getCookiesForCustomPolicy(CustomSignerRequest requ
470469
try {
471470
String policy = SigningUtils.buildCustomPolicy(request.resourceUrl(), request.activeDate(), request.expirationDate(),
472471
request.ipRange());
473-
byte[] signatureBytes = signPolicy(policy.getBytes(UTF_8), request.privateKey());
472+
byte[] signatureBytes = SigningUtils.signWithSha1Rsa(policy.getBytes(UTF_8), request.privateKey());
474473
String urlSafePolicy = SigningUtils.makeStringUrlSafe(policy);
475474
String urlSafeSignature = SigningUtils.makeBytesUrlSafe(signatureBytes);
476475
return DefaultCookiesForCustomPolicy.builder()
@@ -483,20 +482,4 @@ public CookiesForCustomPolicy getCookiesForCustomPolicy(CustomSignerRequest requ
483482
}
484483
}
485484

486-
private static byte[] signPolicy(byte[] policyToSign, PrivateKey privateKey) throws InvalidKeyException {
487-
// all CloudFront signed urls currently require the SHA1 and currently only support RSA and EC
488-
switch (privateKey.getAlgorithm()) {
489-
case "RSA":
490-
return SigningUtils.signWithSha1Rsa(policyToSign, privateKey);
491-
case "EC":
492-
case "ECDSA":
493-
return SigningUtils.signWithSha1ECDSA(policyToSign, privateKey);
494-
default:
495-
// do not attempt to use a generic Signer based on the privateKey algorithm:
496-
// future supported key types likely require different hash algorithms (eg, SHA256 or higher instead of SHA1)
497-
throw new IllegalArgumentException(
498-
"Unsupported key algorithm for CloudFront signed URL: " + privateKey.getAlgorithm());
499-
}
500-
}
501-
502485
}

‎services/cloudfront/src/main/java/software/amazon/awssdk/services/cloudfront/internal/auth/Pem.java‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
import java.util.List;
2828
import java.util.regex.Pattern;
2929
import software.amazon.awssdk.annotations.SdkInternalApi;
30-
import software.amazon.awssdk.services.cloudfront.internal.utils.SigningUtils;
3130

3231
@SdkInternalApi
3332
public final class Pem {
@@ -52,19 +51,16 @@ public static PrivateKey readPrivateKey(InputStream is) throws InvalidKeySpecExc
5251
for (PemObject object : objects) {
5352
switch (object.getPemObjectType()) {
5453
case PRIVATE_KEY_PKCS1:
55-
// only supports RSA keys, so load it as RSA.
5654
return Rsa.privateKeyFromPkcs1(object.getDerBytes());
5755
case PRIVATE_KEY_PKCS8:
58-
return SigningUtils.privateKeyFromPkcs8(object.getDerBytes());
56+
return Rsa.privateKeyFromPkcs8(object.getDerBytes());
5957
default:
6058
break;
6159
}
6260
}
6361
throw new IllegalArgumentException("Found no private key");
6462
}
6563

66-
67-
6864
/**
6965
* Returns the first public key that is found from the input stream of a PEM
7066
* file.

‎services/cloudfront/src/main/java/software/amazon/awssdk/services/cloudfront/internal/utils/SigningUtils.java‎

Lines changed: 2 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -21,20 +21,17 @@
2121
import java.nio.file.Files;
2222
import java.nio.file.Path;
2323
import java.security.InvalidKeyException;
24-
import java.security.KeyFactory;
2524
import java.security.NoSuchAlgorithmException;
2625
import java.security.PrivateKey;
2726
import java.security.SecureRandom;
2827
import java.security.Signature;
2928
import java.security.SignatureException;
30-
import java.security.spec.EncodedKeySpec;
31-
import java.security.spec.InvalidKeySpecException;
32-
import java.security.spec.PKCS8EncodedKeySpec;
3329
import java.time.Instant;
3430
import java.util.Base64;
3531
import software.amazon.awssdk.annotations.SdkInternalApi;
3632
import software.amazon.awssdk.core.exception.SdkClientException;
3733
import software.amazon.awssdk.services.cloudfront.internal.auth.Pem;
34+
import software.amazon.awssdk.services.cloudfront.internal.auth.Rsa;
3835
import software.amazon.awssdk.utils.IoUtils;
3936
import software.amazon.awssdk.utils.StringUtils;
4037
import software.amazon.awssdk.utils.Validate;
@@ -142,22 +139,6 @@ public static byte[] signWithSha1Rsa(byte[] dataToSign, PrivateKey privateKey) t
142139
}
143140
}
144141

145-
/**
146-
* Signs the data given with the private key given, using the SHA1withECDSA
147-
* algorithm provided by bouncy castle.
148-
*/
149-
public static byte[] signWithSha1ECDSA(byte[] dataToSign, PrivateKey privateKey) throws InvalidKeyException {
150-
try {
151-
Signature signature = Signature.getInstance("SHA1withECDSA");
152-
SecureRandom random = new SecureRandom();
153-
signature.initSign(privateKey, random);
154-
signature.update(dataToSign);
155-
return signature.sign();
156-
} catch (NoSuchAlgorithmException | SignatureException e) {
157-
throw new IllegalStateException(e);
158-
}
159-
}
160-
161142
/**
162143
* Generate a policy document that describes custom access permissions to
163144
* apply via a private distribution's signed URL.
@@ -217,35 +198,10 @@ public static PrivateKey loadPrivateKey(Path keyFile) throws Exception {
217198
}
218199
if (StringUtils.lowerCase(keyFile.toString()).endsWith(".der")) {
219200
try (InputStream is = Files.newInputStream(keyFile)) {
220-
return privateKeyFromPkcs8(IoUtils.toByteArray(is));
201+
return Rsa.privateKeyFromPkcs8(IoUtils.toByteArray(is));
221202
}
222203
}
223204
throw SdkClientException.create("Unsupported file type for private key");
224205
}
225206

226-
/**
227-
* Attempt to load a private key from PKCS8 DER
228-
*/
229-
public static PrivateKey privateKeyFromPkcs8(byte[] derBytes) {
230-
EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(derBytes);
231-
try {
232-
return tryKeyLoadFromSpec(privateKeySpec);
233-
} catch (NoSuchAlgorithmException e) {
234-
throw new IllegalArgumentException(e);
235-
} catch (InvalidKeySpecException e) {
236-
throw new IllegalArgumentException("Invalid private key, unable to load as either RSA or ECDSA", e);
237-
}
238-
}
239-
240-
/**
241-
* We don't have a way to determine which algorithm to use, so we try to load as RSA and EC
242-
*/
243-
private static PrivateKey tryKeyLoadFromSpec(EncodedKeySpec privateKeySpec)
244-
throws NoSuchAlgorithmException, InvalidKeySpecException {
245-
try {
246-
return KeyFactory.getInstance("RSA").generatePrivate(privateKeySpec);
247-
} catch (InvalidKeySpecException rsaFail) {
248-
return KeyFactory.getInstance("EC").generatePrivate(privateKeySpec);
249-
}
250-
}
251207
}

0 commit comments

Comments
 (0)