Struct SigningKey

pub struct SigningKey {
    pub kind: SigningKeyKind,
    pub key: Vec<u8>,
}

An AWS SigV4 key for signing requests.

Signing keys are derived from a secret key and are used to sign requests made to AWS services. The raw secret key is hashed with other attributes in the request to derive the signing key.

In the table below, HMAC_SHA256(key, data) denotes the HMAC SHA-256 function with the given key and data.

The stages of derivation are:

• KSecret: The raw secret key.
• KDate: The secret key hashed with the request date in UTC formatted as “YYYYMMDD”. This is calculated as HMAC_SHA256("AWS4" + KSecret, request_date).
• KRegion: The KDate key hashed with the region name. This is calculated as HMAC_SHA256(KDate, region).
• KService: The KRegion key hashed with the service name. This is calculated as HMAC_SHA256(KRegion, service).
• KSigning: The KService key hashed with the string "aws4_request". This is calculated as HMAC_SHA256(KService, "aws4_request").

The KSigning key is the most secure key type. If the key is leaked, an attacker can only sign requests for the given date, region, and service. Key store services should never vend anything other than the KSigning key to an application service.

It is not possible to derive an earlier key from a later key—e.g., you cannot derive a KRegion key from a KService key. However, you can derive a later key from an earlier key.

Fields

kind: SigningKeyKind

The type of signing key.

key: Vec<u8>

The key itself.

Implementations

impl SigningKey

pub fn try_derive<R, S>( &self, derived_key_kind: SigningKeyKind, req_date: &NaiveDate, region: R, service: S, ) -> Result<Self, SignatureError>

where R: AsRef<str>, S: AsRef<str>,

Convert this key into the specified kind of key.

It is safe to call this function with the same kind of key as the existing key; this will return a copy of the existing key.

Errors

This function returns an error if the existing key is

pub fn try_to_kservice_key<R, S>( &self, req_date: &NaiveDate, region: R, service: S, ) -> Result<Self, SignatureError>

where R: AsRef<str>, S: AsRef<str>,

Return a KService key given a KService, KRegion, KDate, or KSecret key.

Errors

SignatureError::InvalidSigningKeyKind is returned if derivation to an earlier kind is attempted, e.g. KRegion into KDate.

pub fn try_to_kregion_key<R>( &self, req_date: &NaiveDate, region: R, ) -> Result<Self, SignatureError>

where R: AsRef<str>,

Return a KRegion key given a KRegion, KDate, or KSecret key.

Errors

SignatureError::InvalidSigningKeyKind is returned if this is given a KSigning key.

pub fn try_to_kdate_key( &self, req_date: &NaiveDate, ) -> Result<Self, SignatureError>

Return a KDate key given a KDate or KSecret key.

Errors

SignatureError::InvalidSigningKeyKind is returned if this is given a KRegion, KService, or KSigning key.

This function returns an error if given a KRegion, KSigning, or KService key.

pub fn derive<R, S>( &self, derived_key_kind: SigningKeyKind, req_date: &NaiveDate, region: R, service: S, ) -> Self

where R: AsRef<str>, S: AsRef<str>,

Convert this key into the specified kind of key.

Panics

This function panics if the existing key cannot be derived into the dervied key kind. Use try_derive for a non-panicking version.

pub fn to_ksigning_key<R, S>( &self, req_date: &NaiveDate, region: R, service: S, ) -> Self

where R: AsRef<str>, S: AsRef<str>,

Return a KSigning key given a KSigning, KService, KRegion, KDate, or KSecret key.

This function is infallible; an equivalent try_to_signing_key() method does not exist as as result.

pub fn to_kservice_key<R, S>( &self, req_date: &NaiveDate, region: R, service: S, ) -> Self

where R: AsRef<str>, S: AsRef<str>,

Return a KService key given a KService, KRegion, KDate, or KSecret key.

Panics

This function will panic if given a KSigning key. Use try_to_kservice_key for a non-panicking version.

pub fn to_kregion_key<R>(&self, req_date: &NaiveDate, region: R) -> Self

where R: AsRef<str>,

Return a KRegion key given a KRegion, KDate, or KSecret key.

Panics

This function will panic if given a KSigning or KService key. Use try_to_kregion_key for a non-panicking version.

pub fn to_kdate_key(&self, req_date: &NaiveDate) -> Self

Return a KDate key given a KDate, or KSecret key.

Panics

This function will panic if given a KSigning, KService, or KRegion key. Use try_to_kdate_key for a non-panicking version.

Trait Implementations

impl Clone for SigningKey

fn clone(&self) -> SigningKey

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SigningKey

fn fmt(&self, f: &mut Formatter<'_>) -> FmtResult

Formats the value using the given formatter.