多年来我们一直使用 AWS v2 签名，现已被 v4 取代。
我正在慢慢地完成所有步骤，但在第 3 步中遇到了困难，其中要求以二进制格式输出的 HMAC-SHA256 加密。 https://docs.aws.amazon.com/AlexaWebInfoService/latest/CalculatingSignatures.html https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
我需要在经典 ASP 中执行此操作，我有编码 SHA256 的脚本，但我找不到任何可以二进制输出的脚本。
我得到的最接近的是 Chilkat 组件，它似乎从 SHA256 哈希值输出二进制文件，但我不知道如何实现这一点: http://www.chilkatsoft.com/refdoc/xChilkatCrypt2Ref.html#method72
任何人都可以使用脚本(asp、vbscript、javascript)或 Chilkat(或其他)组件为我指明正确的方向吗？真正引起问题的是二进制输出。
提前非常感谢
最佳答案
AWS V4 签名生成过程让我摸不着头脑好几天(HMAC 二进制输出也让我难住了)，但使用纯经典 ASP 是可能的。这是我编写的用于生成签名 S3 URL 的类(我不熟悉 AWIS，但浏览了您链接的文档后，我可以看到签名生成过程是相同的):
Class AmazonWebServices
Private AWS_utc, AWS_timestamp, AWS_timestamp_short, AWS_url, AWS_headers, AWS_string_to_sign, AWS_signature
Private AWS_S3_key, AWS_S3_region, AWS_S3_version, AWS_S3_bucket, AWS_S3_host, AWS_S3_secret
Private Sub Class_Initialize()
' AWS expects a UTC timestamp, if your server isn't set to UTC you will need to apply
' an offset to NOW() using DateAdd()
AWS_utc = NOW() ' Or to apply an offset: DateAdd("h",-1,NOW())
AWS_timestamp = year(AWS_utc) & zero_pad(month(AWS_utc)) & zero_pad(day(AWS_utc)) &_
"T" & zero_pad(hour(AWS_utc)) & zero_pad(minute(AWS_utc)) & zero_pad(second(AWS_utc)) & "Z"
AWS_timestamp_short = left(AWS_timestamp,8)
AWS_S3_key = "XXXXXXXXXXXXXXXXXXXX"
AWS_S3_region = "eu-west-2"
AWS_S3_version = "2006-03-01"
AWS_S3_bucket = "BUCKETNAME"
AWS_S3_host = AWS_S3_bucket & ".s3." & AWS_S3_region & ".amazonaws.com"
AWS_S3_secret = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
End Sub
public function s3_signed_url(ByVal theFile, ByVal expire)
' expire is the number of seconds to keep the url alive
' Prefix the file name with a slash
if NOT inStr(theFile,"/") = 1 then theFile = "/" & theFile
' Construct the S3 URL
AWS_url = "https://" & AWS_S3_host & theFile &_
"?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD" &_
"&X-Amz-Algorithm=AWS4-HMAC-SHA256" &_
"&X-Amz-Credential=" & AWS_S3_key &_
"%2F" & AWS_timestamp_short &_
"%2F" & AWS_S3_region &_
"%2Fs3" &_
"%2Faws4_request" &_
"&X-Amz-Date=" & AWS_timestamp &_
"&X-Amz-SignedHeaders=host" &_
"&X-Amz-Expires=" & expire &_
"&X-Amz-Signature="
' Construct the GET headers
' headers need to be separated with just a line feed
' VBlf = line feed
' VBcr = carriage return
' VBcrlf = carriage return & line feed
' Anything but VBlf (or chr(10)) will return a signature mismatch
AWS_headers = "GET" & VBlf &_
theFile & VBlf &_
"X-Amz-Algorithm=AWS4-HMAC-SHA256" &_
"&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD" &_
"&X-Amz-Credential=" & AWS_S3_key &_
"%2F" & AWS_timestamp_short &_
"%2F" & AWS_S3_region &_
"%2Fs3" &_
"%2Faws4_request" &_
"&X-Amz-Date=" & AWS_timestamp &_
"&X-Amz-Expires=" & expire &_
"&X-Amz-SignedHeaders=host" & VBlf &_
"host:" & AWS_S3_host & VBlf & VBlf &_
"host" & VBlf &_
"UNSIGNED-PAYLOAD"
' GET headers are hashed with SHA256
AWS_headers = hash(AWS_headers,"SHA256","hex")
' Construct the string to sign
AWS_string_to_sign = "AWS4-HMAC-SHA256" & VBlf &_
AWS_timestamp & VBlf &_
AWS_timestamp_short & "/" & AWS_S3_region & "/s3/aws4_request" & VBlf &_
AWS_headers
' date key, generated by hashing the short timestamp using the secret key as the HMAC key
AWS_signature = hash_hmac("AWS4" & AWS_S3_secret,AWS_timestamp_short,"SHA256","raw")
' region key, generated by hashing the region using the date key as the HMAC key
AWS_signature = hash_hmac(AWS_signature,AWS_S3_region,"SHA256","raw")
' service key, generated by hashing the service name using the region key as the HMAC key
AWS_signature = hash_hmac(AWS_signature,"s3","SHA256","raw")
' signing key, generated by hashing the request type using the service key as the HMAC key
AWS_signature = hash_hmac(AWS_signature,"aws4_request","SHA256","raw")
' signature, generated by hashing the "string to sign" using the signing key as the HMAC key
AWS_signature = hash_hmac(AWS_signature,AWS_string_to_sign,"SHA256","hex")
' Return the complete URL with signature
s3_signed_url = AWS_url & AWS_signature
end function
private function hash(ByVal input, ByVal alg, ByVal encoding)
' Convert the input to bytes if not already
if NOT vartype(input) = 8209 then input = string_to_UTF8_bytes(input)
Dim hAlg : Set hAlg = Server.CreateObject("System.Security.Cryptography." & get_hash_class(alg))
hash = binary_encode(hAlg.ComputeHash_2((input)),encoding)
set hAlg = nothing
end function
private function hash_hmac(ByVal secret, ByVal message, ByVal alg, ByVal encoding)
' Convert the input to bytes if not already
if NOT vartype(secret) = 8209 then secret = string_to_UTF8_bytes(secret)
if NOT vartype(message) = 8209 then message = string_to_UTF8_bytes(message)
Dim hAlg : Set hAlg = Server.CreateObject("System.Security.Cryptography." & get_hmac_class(alg))
hAlg.Initialize()
hAlg.key = secret
hash_hmac = binary_encode(hAlg.ComputeHash_2((message)),encoding)
set hAlg = nothing
end function
private function binary_encode(ByVal binary, ByVal encoding)
encoding = lCase(encoding)
if encoding = "raw" then
binary_encode = binary
exit function
end if
Dim enc : Set enc = Server.CreateObject("MSXML2.DomDocument").CreateElement("encode")
if encoding = "base64" OR encoding = "b64" then
' base64 string
enc.dataType = "bin.base64"
enc.nodeTypedValue = binary
binary_encode = enc.Text
else
' hexadecimal string
enc.dataType = "bin.hex"
enc.nodeTypedValue = binary
binary_encode = enc.Text
end if
Set enc = nothing
end function
private function get_hash_class(ByVal alg)
' get the cryptography class name for the specified hashing algorithm,
' return the class name for SHA1 if not found
select case uCase(alg)
case "MD5"
get_hash_class = "MD5CryptoServiceProvider"
case "SHA1"
get_hash_class = "SHA1CryptoServiceProvider"
case "SHA2","SHA256"
get_hash_class = "SHA256Managed"
case "SHA3","SHA384"
get_hash_class = "SHA384Managed"
case "SHA5","SHA512"
get_hash_class = "SHA512Managed"
case else
get_hash_class = "SHA1CryptoServiceProvider"
end select
end function
private function get_hmac_class(ByVal alg)
' get the cryptography class name for the specified HMAC algorithm,
' return the class name for SHA1 if not found
select case uCase(alg)
case "MD5"
get_hmac_class = "HMACMD5"
case "SHA1"
get_hmac_class = "HMACSHA1"
case "SHA3","SHA384"
get_hmac_class = "HMACSHA384"
case "SHA2","SHA256"
get_hmac_class = "HMACSHA256"
case "SHA5","SHA512"
get_hmac_class = "HMACSHA512"
case else
get_hmac_class = "HMACSHA1"
end select
end function
private function string_to_UTF8_bytes(ByVal aString)
' convert a UTF8 string to bytes
Dim UTF8 : Set UTF8 = Server.CreateObject("System.Text.UTF8Encoding")
string_to_UTF8_bytes = UTF8.GetBytes_4(aString)
set UTF8 = nothing
end function
private function zero_pad(ByVal theNum)
if len(theNum) = 1 then
zero_pad = cStr("0" & theNum)
else
zero_pad = theNum
end if
end function
end class
要生成 24 小时 S3 签名 URL:
set AWS = new AmazonWebServices
response.write AWS.s3_signed_url("file.name",86400)
set AWS = nothing
示例输出:
您还在问题中提到了 Chilkat。 Chilkat 实际上可以为您生成 v4 签名:
https://www.chilkatsoft.com/refdoc/xChilkatAuthAwsRef.html
https://www.example-code.com/asp/aws_pre_signed_url_v4.asp
但它确实需要许可证。几年前我买了一个，我强烈推荐给仍然使用经典 ASP 的人。
关于amazon-web-services - 为 AWIS 创建 AWS v4 签名，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/55512946/