Cloudfront Signer ECDSA Support

[maths22]

Describe the feature

Now that cloudfront supports ECDSA signed urls, the java SDK should be capable of generating them when given an ECDSA private key.

Use Case

ECDSA signing is faster and creates shorter URLs, and is now supported by cloudfront.

Proposed Solution

The SDK should be able to check the algorithm of the provided PrivateKey object and then appropriate select between SHA1withRSA signing and SHA1withECDSA signing, so the API should not need to change.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS Java SDK version used

2.37.3

JDK version used

21.0.5

Operating System and version

macOS 26.0.1

[yeenow123]

Did you actually get this working with your own code? I tried signing with SHA256withECDSA but I am still getting a AccessDenied error when hitting Cloudfront with signed cookies. Verifying the signature locally with the public key returns true as well.

    private final BouncyCastleProvider provider = new BouncyCastleProvider();

    public DefaultCookiesForCustomPolicy generateCustomPolicyCookies(CustomerSignerRequest request)
            throws NoSuchAlgorithmException, InvalidKeyException, SignatureException { // Propagate exceptions
        
        final String policy = SigningUtils.buildCustomPolicy(
            request.resourceUrl(), request.activeDate(), request.expirationDate(),
            request.ipRange()
        );

        final byte[] policyBytes = policy.getBytes(StandardCharsets.UTF_8);

        final byte[] signatureBytes = signWithECDSA(policyBytes, request.privateKey());

        final String urlSafePolicy = SigningUtils.makeStringUrlSafe(policy);
        final String urlSafeSignature = SigningUtils.makeBytesUrlSafe(signatureBytes);
        
        return DefaultCookiesForCustomPolicy.builder()
            .resourceUrl(request.resourceUrl())
            .keyPairIdHeaderValue("CloudFront-Key-Pair-Id=" + request.keyPairId())
            .signatureHeaderValue("CloudFront-Signature=" + urlSafeSignature)
            .policyHeaderValue("CloudFront-Policy=" + urlSafePolicy)
            .build();
    }

    private byte[] signWithECDSA(byte[] dataToSign, PrivateKey privateKey) throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
        final Signature signature = Signature.getInstance("SHA256withECDSA", provider);
        final SecureRandom random = new SecureRandom();
        signature.initSign(privateKey, random);
        signature.update(dataToSign);
        return signature.sign();
    }

    // This returns true
    public boolean verifySignatureECDSA(PublicKey publicKey, byte[] dataToVerify, byte[] signedData) throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
        final Signature signature = Signature.getInstance("SHA256withECDSA", provider);
        signature.initVerify(publicKey);
        signature.update(dataToVerify);
        return signature.verify(signedData);

[debora-ito]

@maths22 acknowledged, added to our backlog.

[alextwoods]

@yeenow123 - Based on the documentation only SHA1 is supported, so you should be able to use SHA1WithECDSA but not SHA256WithECDSA.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.

[RockyMM]

Hey @alextwoods , I see that @Fred1155 reverted the PR #6627

Are there some concerns with the implementation? I'm asking since I was planing to use exactly ECDSA for signing URLs hosted behind CloudFront.