将仅限公共的椭圆曲线导入Azure密钥保管库

1tu0hz3e 于 2023-08-07 发布在其他

关注(0)|答案(1)|浏览(105)

我正在尝试将椭圆曲线的公共部分导入到Azure Key Vault中。当我包含私有和公共部分（即D、X和Y字段）时，请求成功工作，但是如果我只提交公共部分（即X和Y字段），我会收到错误“EC密钥无效-无法示例化加密服务”。
下面是两个请求，它们使用两个不同的标识符向Azure Key Vault提交相同的密钥;第一请求包括私钥信息（并且成功），而第二请求仅是公钥信息并且返回所描述的错误。
第一个带有私有信息的示例：

PUT https://XXX.vault.azure.net/keys/f851dad4-3a02-4039-90fa-6aed47fa06f0?api-version=7.4 HTTP/1.1
Host: XXX.vault.azure.net
Authorization: Bearer XXX
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 274

{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f0","key":{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f0","kty":"EC","crv":"P-256","d":"Wjdwwdd2dnf9QT6KqXsexBSs0DEbnKsfj0vW3fNkvJo","x":"U4h1986Oy6ARYQxIBU3JRGIuHA_GhWcPT1zwYAaG9Rg","y":"8_-7MQY-fiY2UvBcgnNtSqrs1AeoNxXvo-21mn8dKJs"}}

字符串
第二个不含私有信息的示例：

PUT https://XXX.vault.azure.net/keys/f851dad4-3a02-4039-90fa-6aed47fa06f9?api-version=7.4 HTTP/1.1
Host: XXX.vault.azure.net
Authorization: Bearer XXX
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 224

{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f9","key":{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f9","kty":"EC","crv":"P-256","x":"U4h1986Oy6ARYQxIBU3JRGIuHA_GhWcPT1zwYAaG9Rg","y":"8_-7MQY-fiY2UvBcgnNtSqrs1AeoNxXvo-21mn8dKJs"}}

型
第二个请求的响应：

HTTP/1.1 400 Bad Request
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 102
Content-Type: application/json; charset=utf-8
Expires: -1
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
Date: Thu, 27 Jul 2023 13:34:44 GMT

{"error":{"code":"BadParameter","message":"EC key is not valid - cannot instantiate crypto service."}}

型

Azure

来源：https://stackoverflow.com/questions/76780337/import-public-only-elliptic-curve-into-azure-key-vault

1条答案

按热度按时间

7cwmlq891#

Azure Key Vault需要私钥信息（D字段）才能导入椭圆曲线密钥。如果没有私钥信息，请求将失败并出错。
当我尝试在没有私钥的情况下将椭圆曲线的公共部分导入Azure Key Vault时，我得到了相同的错误，如下所示：

PUT https://sri-kv.vault.azure.net//keys/f851dad4-3a02-4039-90fa-6aed47fa06f0?api-version=7.4
Authorization: Bearer <token>
Content-Type: application/json

{
 "kid":"f851dad4-3a02-4039-90fa-6aed47fa06f0",
  "key": {
    "kty": "EC",
    "crv" : "P-256",
    "x": "U4h1986Oy6ARYQxIBU3JRGIuHA_GhWcPT1zwYAaG9Rg",
    "y": "8_-7MQY-fiY2UvBcgnNtSqrs1AeoNxXvo-21mn8dKJs"
  }
}

字符串

回复：

x1c 0d1x的数据
请注意，您无法将public-only * 椭圆曲线导入Azure Key Vault。要解决此错误，您必须在请求中包含私钥**。
当我再次运行请求时，在d参数中包含私钥，就像您第一次请求一样，我成功地得到了响应，如下所示：

PUT https://sri-kv.vault.azure.net//keys/f851dad4-3a02-4039-90fa-6aed47fa06f0?api-version=7.4
Authorization: Bearer <token>
Content-Type: application/json

{
 "kid":"f851dad4-3a02-4039-90fa-6aed47fa06f0",
  "key": {
    "kty": "EC",
    "crv" : "P-256",
    "d":"Wjdwwdd2dnf9QT6KqXsexBSs0DEbnKsfj0vW3fNkvJo",
    "x": "U4h1986Oy6ARYQxIBU3JRGIuHA_GhWcPT1zwYAaG9Rg",
    "y": "8_-7MQY-fiY2UvBcgnNtSqrs1AeoNxXvo-21mn8dKJs"
  }
}

型

回复：

的
为了确认，我在Portal中检查了相同的内容，其中密钥成功导入到密钥库中：