Explore KMS - the monkey business of Elliptic Curve Cryptography (ECC)Page

Imagine an alien species living in a universe shaped like an Elliptic Curve. They value privacy, so they invent ways to protect their chats from eavesdropping. One invention is a method to reach a shared secret between two parties. In this universe, there are monkeys that love peanuts. They jump on the curve in predefined patterns when fed peanuts. However, they jump so fast, no one can determine how many peanuts make them jump from one point to another. Now, two citizens, Alice and Bob, use the monkeys to agree on a shared secret. The monkeys always start from a base point G on the curve. Alice generates a private number (a), and Bob generates a private number (b). Alice feeds a monkey (a) peanuts, making it jump to point A (A = aG). Bob does the same, making his monkey jump to point B (B = bG). They tell each other where their monkeys are. Then, Alice feeds Bob's monkey at point B (a) peanuts, and Bob feeds Alice's monkey at point A (b) peanuts. After some jumping, both monkeys meet at a shared secret point S. This is known as Elliptic Curve Diffie-Hellman (ECDH). If Alice wants to sign a message with her private key, she first generates a random number (d) as her private key, then feeds a monkey (d) peanuts to get to a point (Q) on the curve from base point G. Q becomes Alice's public key. Alice creates a message (m) that she wants to sign, she computes a hash (e) of the message. Next, Alice generates a random number (k), and feeds her monkey (k) peanuts to jump to a rendezvous point R with x coordinate r. Alice computes the signature (r, s) using her private key, the hash of the message, and the r. Alice sends the message and the signature (r, s) to Bob. Bob receives the message and the signature. Bob needs two monkeys, one starts from Alice's public key point Q, one from the base point G, with the right amount of peanuts computed from the received message (m), and the received signature (r, s), Bob's two monkeys can meet exactly at the rendezvous point R. If the monkeys cannot meet, the signature is invalid. This is known as Elliptic Curve Digital Signature Algorithm (ECDSA).

The monkeys in the story are very busy but calling KMS API for ECDSA sign and verify are straightforward:

message = b'Hello World'
signature = kms.sign(KeyId=key_id, Message=message, SigningAlgorithm='ECDSA_SHA_512')['Signature']
ecc_public_key = kms.get_public_key(KeyId=key_id)["PublicKey"]                       
# verify the signature using the public key locally
public_key = load_der_public_key(ecc_public_key)
public_key.verify(signature, message, ec.ECDSA(hashes.SHA512()))
print("Signature is valid")