Interrupted signing with AWS CloudHSM

[dattv155]

Hi,
I'm building a signing SDK where the client-side SDK sends a document hash to the server and receives signed data to integrate into the PDF. The process consists of these 3 steps:

Step 1: The SDK prepares a document hash from the PDF file on the client machine and sends it to the server.
Step 2: The server signs this document hash using AWS CloudHSM Client SDK 5 and returns the signed data.
Step 3: The client-side SDK receives the signed data and integrates it into the PDF file.

How can I achieve this requirement using pyHanko?

[MatthiasValvekens]

CloudHSM supports access over PKCS#11: https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-library.html. This is supported out of the box in pyHanko.

[dattv155]

Thank you for your response. Could you provide some examples of how to prepare the digest without the certificate from the HSM, and how to implement signing using CloudHSM over PKCS#11 with pyHanko?

[MatthiasValvekens]

There are examples for interrupted signing in the docs, and specifically for PKCS#11, you could look at the implementation of the pkcs11 signing command in the CLI, or the tests. There are no samples for interrupted signing with PKCS#11 as far as I'm aware, so you'll have to put 2 and 2 together ;)

Word of advice: try to get it to work without using interrupted signing first (i.e. just using the high-level signing API with CloudHSM). The interrupted signing flow is a fairly advanced performance optimisation, so you'll want to make sure that the rest of your integration is correct before you try to pull in more complex stuff.

[dattv155]

@MatthiasValvekens I want to test my Interrupted signing flow with sample cert before using CloudHSM. But after embedding signed data into pdf file, I get a signed PDF that "Document has been altered or corrupted since it was signed". Below is my implementation in server that will generate signed signature. Am I correct in using the async_sign_raw function in this case?

async def getRemoteHash(digest_b64):
    pfx_path = 'my_cert_file.pfx' 
    pfx_password = b'password' 

    with open(pfx_path, 'rb') as f:
        pfx_data = f.read()
        private_key, cert, other_certs,= pkcs12.load_key_and_certificates(pfx_data, pfx_password)

    kinfo = _translate_pyca_cryptography_key_to_asn1(private_key)
    cert = _translate_pyca_cryptography_cert_to_asn1(cert)
    other_certs = [_translate_pyca_cryptography_cert_to_asn1(c) for c in other_certs]

    cs = SimpleCertificateStore()
    cs.register_multiple(other_certs)
    signer = signers.SimpleSigner(
        signing_key=kinfo,
        signing_cert=cert,
        cert_registry=cs,
    )

    digest = base64.b64decode(digest_b64)
    signature = await signer.async_sign_raw(
        digest,
        digest_algorithm = 'sha256',
    )

    return base64.b64encode(signature).decode('utf-8')