.NET 8 WinForms调用Cisco Intersight API签名验证失败求助

问题背景 #

在.NET 8 WinForms项目中使用C#调用Cisco Intersight API，无法正确构建请求头签名。已从官方Postman集合获取可正常请求的签名及待签名字符串用于测试对比。

正常参考示例 #

Postman有效签名 #

MEUCIEoSI3dEFJSRkcl4KUP6OWDMF/n9JOymDk8nRQmLY6ZoAiEA8JoHW5RMkAPreqFFKFTkgxB5TivVRuu4H5Iem9wH3SY=

Postman待签名字符串（含换行，最后一行无换行） #

(request-target): get /api/v1/asset/DeviceContractInformations
date: Tue, 20 Aug 2024 03:08:58 GMT
digest: SHA-256=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
host: eu-central-1.intersight.com

签名计算代码实现 #

以下是编写的签名计算C#函数，不确定HashAlgorithmName.SHA256是否符合API要求的hs2019算法：

static string ComputeSignature(string stringToSign) 
{
    using(var fileStream = new FileStream("C:\\Users\\xxx\\PrivateKey.pem", FileMode.Open, FileAccess.Read)) 
    {
        using(var reader = new StreamReader(fileStream)) 
        {
           var pem = reader.ReadToEnd();
           Console.WriteLine($"Read PEM as: \n {pem}");

           try 
           {
               using var ecdsakey = ECDsa.Create();
               ecdsakey.ImportFromPem(pem);

               byte[] bytes = Encoding.UTF8.GetBytes(stringToSign);

               var hashedBytes = ecdsakey.SignData(bytes, HashAlgorithmName.SHA256);
               bool isValid = ecdsakey.VerifyData(bytes, hashedBytes, HashAlgorithmName.SHA256);

               // 测试Postman数据
               string test = """(request-target): get /api/v1/asset/DeviceContractInformations
date: Tue, 20 Aug 2024 03:08:58 GMT
digest: SHA-256=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
host: eu-central-1.intersight.com""";
               byte[] testBytes = Encoding.UTF8.GetBytes(test);
               byte[] testhashedbytes = Convert.FromBase64String("MEUCIEoSI3dEFJSRkcl4KUP6OWDMF/n9JOymDk8nRQmLY6ZoAiEA8JoHW5RMkAPreqFFKFTkgxB5TivVRuu4H5Iem9wH3SY=");

               bool isValid2 = ecdsakey.VerifyData(testBytes, testhashedbytes, HashAlgorithmName.SHA256);

               Console.WriteLine($"Computed hash valid: {isValid2}");
                        
               return Convert.ToBase64String(hashedBytes);
            } 
            catch(Exception ex) 
            {
               Console.WriteLine($"Couldn't load key from PEM: {ex}");
               throw ex;
            }
        }
    }
}

问题现象 #

• 用自身密钥和对应数据签名时，isValid = true；但用Postman的签名和待签名字符串验证时，isValid2 = false
• 发送请求始终返回认证失败错误：

{"code": "AuthenticationFailure","message": "Cannot perform the operation. Invalid API key..."}

排查方向 #

请求体摘要已与Postman完全一致，怀疑问题出在签名函数逻辑，希望分析验证失败及请求报错的具体原因。

内容的提问来源于stack exchange，提问作者L. Landgraf