TechOverflow Logo
TechOverflow

如何验证 AWS Signature Version 4 实现

English Deutsch 简体中文

你可以使用 Python botocore 包（boto3 AWS 客户端的依赖项）来验证你的实现是否为给定的待签名字符串产生正确的 HMAC 签名。

为此，我们将使用固定的 AmzDate（即时间戳）和固定（但随机）的访问密钥。待签名字符串也是一些随机字符串。唯一重要的是没有随机字符串为空，并且使用 botocore 验证路径的所有值与你自己的实现相同。

之后，将 botocore 实现的输出与你自己的自定义实现进行比较。虽然你可能想用不同的值检查你的实现，但实际上如果它对一个字符串正确工作，它就能工作（可能除了罕见的边界情况）。

验证输出

verify_sigv4.py
from botocore.auth import SigV4Auth
from collections import namedtuple

# Data structures for isolated testing
Credentials = namedtuple('Credentials', ['access_key', 'secret_key'])
Request = namedtuple('Request', ['context'])

amzDate = "20130524T000000Z" # Fixed date for testing
signer = SigV4Auth(Credentials(
    access_key="GBWZ45MPRGGMO2JILBXA",
    secret_key="346NO6UJCAMHLHX4SMFA"
), "s3", "global")
signature = signer.signature("ThisStringWillBeSigned", Request(
    context={"timestamp": amzDate}
))
print(signature)

使用此脚本中给定的值，输出为

sigv4_signature.txt
3be60989db53028ca485b46a07df9287a1731df74a234ea247a99febb7c2eb31

验证中间结果

如果全局结果匹配，你已经完成了。通常不需要检查中间结果和输入字符串。

SigV4Auth.signature() 函数不提供任何访问中间结果的方式。但是，我们可以直接复制其源代码来获取相关中间件并以十六进制打印：

sigv4_intermediates.py
secret_key="346NO6UJCAMHLHX4SMFA"
datestamp = "20130524"
region_name = "global"
service_name = "s3"
string_to_sign = "ThisStringWillBeSigned"

sign_input =  (f"AWS4{secret_key}").encode(), datestamp
k_date = signer._sign(*sign_input)
k_region = signer._sign(k_date, region_name)
k_service = signer._sign(k_region, service_name)
k_signing = signer._sign(k_service, 'aws4_request')
sign_result = signer._sign(k_signing, string_to_sign, hex=True)

print("Sign input: ", sign_input)
print("k_date: ", k_date.hex(), "of length: ", len(k_date))
print("k_region: ", k_region.hex(), "of length: ", len(k_region))
print("k_service: ", k_service.hex(), "of length: ", len(k_service))
print("k_signing: ", k_signing.hex(), "of length: ", len(k_signing))
print("sign_result: ", sign_result)

这会打印：

sigv4_intermediates_output.txt
Sign input:  (b'AWS4346NO6UJCAMHLHX4SMFA', '20130524')
k_date:  a788ed61da3106091ac303738fe248c3d391e851858d9b048d3fddf0494cac61 of length:  32
k_region:  90331d205578b73aeaf4ef9082cbb704111d29364dcae4d4405ddfefc4e6a8b0 of length:  32
k_service:  a0b2fb2efe1977349c647d28e86d373aaa67ca9f452c15c7cfbdb9a4fabd685b of length:  32
k_signing:  e02df2af0ce8890816c931c8e72168921f5f481dfbcaf92a35324b65fc322865 of length:  32
sign_result:  3be60989db53028ca485b46a07df9287a1731df74a234ea247a99febb7c2eb31
Check out similar posts by category: Python, S3