import { Command as $Command } from "@smithy/core/client"; import type { MetadataBearer as __MetadataBearer } from "@smithy/types"; import type { KMSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../KMSClient"; import type { VerifyRequest, VerifyResponse } from "../models/models_0"; /** * @public */ export type { __MetadataBearer }; export { $Command }; /** * @public * * The input for {@link VerifyCommand}. */ export interface VerifyCommandInput extends VerifyRequest { } /** * @public * * The output of {@link VerifyCommand}. */ export interface VerifyCommandOutput extends VerifyResponse, __MetadataBearer { } declare const VerifyCommand_base: { new (input: VerifyCommandInput): import("@smithy/core/client").CommandImpl; new (input: VerifyCommandInput): import("@smithy/core/client").CommandImpl; getEndpointParameterInstructions(): { [x: string]: unknown; }; }; /** *

Verifies a digital signature that was generated by the Sign operation.

*

*

Verification confirms that an authorized user signed the message with the specified KMS * key and signing algorithm, and the message hasn't changed since it was signed. If the * signature is verified, the value of the SignatureValid field in the response is * True. If the signature verification fails, the Verify operation * fails with an KMSInvalidSignatureException exception.

*

A digital signature is generated by using the private key in an asymmetric KMS key. The * signature is verified by using the public key in the same asymmetric KMS key. * For information about asymmetric KMS keys, see Asymmetric KMS keys in the Key Management Service Developer Guide.

*

To use the Verify operation, specify the same asymmetric KMS key, message, * and signing algorithm that were used to produce the signature. The message type does not need * to be the same as the one used for signing, but it must indicate whether the value of the * Message parameter should be hashed as part of the verification process.

*

You can also verify the digital signature by using the public key of the KMS key outside * of KMS. Use the GetPublicKey operation to download the public key in the * asymmetric KMS key and then use the public key to verify the signature outside of KMS. The * advantage of using the Verify operation is that it is performed within KMS. As * a result, it's easy to call, the operation is performed within the FIPS boundary, it is logged * in CloudTrail, and you can use key policy and IAM policy to determine who is authorized to use * the KMS key to verify signatures.

*

To verify a signature outside of KMS with an SM2 public key (China Regions only), you * must specify the distinguishing ID. By default, KMS uses 1234567812345678 as * the distinguishing ID. For more information, see Offline * verification with SM2 key pairs.

*

The KMS key that you use for this operation must be in a compatible key state. For * details, see Key states of KMS keys in the Key Management Service Developer Guide.

*

* Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify * the key ARN or alias ARN in the value of the KeyId parameter.

*

* Required permissions: kms:Verify (key policy)

*

* Related operations: Sign *

*

* Eventual consistency: The KMS API follows an eventual consistency model. * For more information, see KMS eventual consistency.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript * import { KMSClient, VerifyCommand } from "@aws-sdk/client-kms"; // ES Modules import * // const { KMSClient, VerifyCommand } = require("@aws-sdk/client-kms"); // CommonJS import * // import type { KMSClientConfig } from "@aws-sdk/client-kms"; * const config = {}; // type is KMSClientConfig * const client = new KMSClient(config); * const input = { // VerifyRequest * KeyId: "STRING_VALUE", // required * Message: new Uint8Array(), // e.g. Buffer.from("") or new TextEncoder().encode("") // required * MessageType: "RAW" || "DIGEST" || "EXTERNAL_MU", * Signature: new Uint8Array(), // e.g. Buffer.from("") or new TextEncoder().encode("") // required * SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256" || "ED25519_SHA_512" || "ED25519_PH_SHA_512", // required * GrantTokens: [ // GrantTokenList * "STRING_VALUE", * ], * DryRun: true || false, * }; * const command = new VerifyCommand(input); * const response = await client.send(command); * // { // VerifyResponse * // KeyId: "STRING_VALUE", * // SignatureValid: true || false, * // SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256" || "ED25519_SHA_512" || "ED25519_PH_SHA_512", * // }; * * ``` * * @param VerifyCommandInput - {@link VerifyCommandInput} * @returns {@link VerifyCommandOutput} * @see {@link VerifyCommandInput} for command's `input` shape. * @see {@link VerifyCommandOutput} for command's `response` shape. * @see {@link KMSClientResolvedConfig | config} for KMSClient's `config` shape. * * @throws {@link DependencyTimeoutException} (server fault) *

The system timed out while trying to fulfill the request. You can retry the * request.

* * @throws {@link DisabledException} (client fault) *

The request was rejected because the specified KMS key is not enabled.

* * @throws {@link DryRunOperationException} (client fault) *

The request was rejected because the DryRun parameter was specified.

* * @throws {@link InvalidGrantTokenException} (client fault) *

The request was rejected because the specified grant token is not valid.

* * @throws {@link InvalidKeyUsageException} (client fault) *

The request was rejected for one of the following reasons:

* *

For encrypting, decrypting, re-encrypting, and generating data keys, the * KeyUsage must be ENCRYPT_DECRYPT. For signing and verifying * messages, the KeyUsage must be SIGN_VERIFY. For generating and * verifying message authentication codes (MACs), the KeyUsage must be * GENERATE_VERIFY_MAC. For deriving key agreement secrets, the * KeyUsage must be KEY_AGREEMENT. To find the KeyUsage * of a KMS key, use the DescribeKey operation.

*

To find the encryption or signing algorithms supported for a particular KMS key, use the * DescribeKey operation.

* * @throws {@link KeyUnavailableException} (server fault) *

The request was rejected because the specified KMS key was not available. You can retry * the request.

* * @throws {@link KMSInternalException} (server fault) *

The request was rejected because an internal exception occurred. The request can be * retried.

* * @throws {@link KMSInvalidSignatureException} (client fault) *

The request was rejected because the signature verification failed. Signature verification * fails when it cannot confirm that signature was produced by signing the specified message with * the specified KMS key and signing algorithm.

* * @throws {@link KMSInvalidStateException} (client fault) *

The request was rejected because the state of the specified resource is not valid for this * request.

*

This exceptions means one of the following:

* * * @throws {@link NotFoundException} (client fault) *

The request was rejected because the specified entity or resource could not be * found.

* * @throws {@link KMSServiceException} *

Base exception class for all service exceptions from KMS service.

* * * @example To use an asymmetric KMS key to verify a digital signature * ```javascript * // This operation uses the public key in an elliptic curve (ECC) asymmetric key to verify a digital signature within AWS KMS. * const input = { * KeyId: "alias/ECC_signing_key", * Message: "", * MessageType: "RAW", * Signature: "", * SigningAlgorithm: "ECDSA_SHA_384" * }; * const command = new VerifyCommand(input); * const response = await client.send(command); * /* response is * { * KeyId: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", * SignatureValid: true, * SigningAlgorithm: "ECDSA_SHA_384" * } * *\/ * ``` * * @example To use an asymmetric KMS key to verify a digital signature on a message digest * ```javascript * // This operation uses the public key in an RSA asymmetric signing key pair to verify the digital signature of a message digest. Hashing a message into a digest before sending it to KMS lets you verify messages that exceed the 4096-byte message size limit. To indicate that the value of Message is a digest, use the MessageType parameter * const input = { * KeyId: "arn:aws:kms:us-east-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", * Message: "", * MessageType: "DIGEST", * Signature: "", * SigningAlgorithm: "RSASSA_PSS_SHA_512" * }; * const command = new VerifyCommand(input); * const response = await client.send(command); * /* response is * { * KeyId: "arn:aws:kms:us-east-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", * SignatureValid: true, * SigningAlgorithm: "RSASSA_PSS_SHA_512" * } * *\/ * ``` * * @public */ export declare class VerifyCommand extends VerifyCommand_base { /** @internal type navigation helper, not in runtime. */ protected static __types: { api: { input: VerifyRequest; output: VerifyResponse; }; sdk: { input: VerifyCommandInput; output: VerifyCommandOutput; }; }; }