I have code in python that is working fine against our URLs
This is the meat of the code after GET
from a URL:
encoded_subject = json.dumps(subject, separators=(",", ":"), sort_keys=False, indent=None).encode('utf-8')
decoded_signature = base64.b64decode(signature)
public_key = serialization.load_pem_public_key(PUBLIC_KEY.encode(), backend=default_backend())
public_key.verify(decoded_signature, encoded_subject, ec.ECDSA(hashes.SHA384()))
I am trying to implement the same thing in Golang. Taking inspiration from this link I have such code in Go
type Subject struct {
URL string `json:"url"`
AccessURL string `json:"accessUrl"`
Expiration int64 `json:"expiration"`
}
type Response struct {
Signature string `json:"signature"`
Subject Subject `json:"subject"`
}
signature, subject := response.Signature, response.Subject
encodedSubject, err := json.Marshal(subject)
decodedSignature, err := base64.StdEncoding.DecodeString(signature)
block, _ := pem.Decode(PublicKey)
pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
ecdsaPubKey, ok := pubKey.(*ecdsa.PublicKey)
// Hash the encoded subject with SHA-3 (SHA-384)
hash := sha3.Sum384(encodedSubject)
// Verify the ECDSA signature
if !ecdsa.VerifyASN1(ecdsaPubKey, hash[:], decodedSignature) {
log.Printf("Domain signature verification failed")
return false
}
I have removed all the error handling code for brevity. This fails in signature verification.
I am trying to match different values produced in Python v/s Go. The encodedSubject
and decodedSignature
seemed to match. But the hash generated seems different, I might be wrong though
Any idea what to debug here ?