如何使用AWS KMS Java API生成验证HMAC类型对称密钥的MAC

对于AWS KMS中的HMAC类型对称CMK，确实无法使用非对称密钥对应的SignRequest/SignResponse，官方提供的等效API是GenerateMac（生成MAC）和VerifyMac（验证MAC），下面是完整的Java实现方案：

1. 依赖准备 #

确保项目引入AWS SDK for Java 2.x的KMS模块（推荐使用2.x版本，1.x逻辑类似但API结构不同）：

<!-- Maven依赖 -->
<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>kms</artifactId>
    <version>2.25.0</version> <!-- 替换为最新稳定版 -->
</dependency>

2. 生成MAC（对应CLI的aws kms generate-mac） #

AWS SDK会自动处理认证逻辑，优先从环境变量、IAM角色（EC2/EKS等托管环境）、本地~/.aws/credentials文件加载凭证，无需手动编写签名逻辑：

import software.amazon.awssdk.core.SdkBytes;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.kms.KmsClient;
import software.amazon.awssdk.services.kms.model.GenerateMacRequest;
import software.amazon.awssdk.services.kms.model.GenerateMacResponse;
import software.amazon.awssdk.services.kms.model.KmsException;

public class KmsHmacGenerator {
    public static void main(String[] args) {
        // 替换为你的KMS区域和CMK ID/ARN
        Region region = Region.US_EAST_1;
        String keyId = "arn:aws:kms:us-east-1:123456789012:key/abcdef12-3456-7890-abcd-ef1234567890";
        String message = "需要生成MAC的原始数据";

        try (KmsClient kmsClient = KmsClient.builder().region(region).build()) {
            GenerateMacRequest request = GenerateMacRequest.builder()
                    .keyId(keyId)
                    .message(SdkBytes.fromUtf8String(message))
                    .macAlgorithm("HMAC_SHA_256") // 必须和创建CMK时指定的算法一致
                    .build();

            GenerateMacResponse response = kmsClient.generateMac(request);
            // 生成的MAC字节转Base64方便存储/传输
            String macBase64 = response.mac().asUtf8String();
            System.out.println("生成的MAC（Base64）：" + macBase64);
        } catch (KmsException e) {
            System.err.println(e.getMessage());
            System.exit(1);
        }
    }
}

3. 验证MAC（对应CLI的aws kms verify-mac） #

验证逻辑需要传入原始消息、生成的MAC、CMK ID和对应算法：

import software.amazon.awssdk.core.SdkBytes;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.kms.KmsClient;
import software.amazon.awssdk.services.kms.model.KmsException;
import software.amazon.awssdk.services.kms.model.VerifyMacRequest;
import software.amazon.awssdk.services.kms.model.VerifyMacResponse;

public class KmsHmacVerifier {
    public static void main(String[] args) {
        Region region = Region.US_EAST_1;
        String keyId = "arn:aws:kms:us-east-1:123456789012:key/abcdef12-3456-7890-abcd-ef1234567890";
        String originalMessage = "需要生成MAC的原始数据";
        String macBase64 = "之前生成的MAC Base64字符串";

        try (KmsClient kmsClient = KmsClient.builder().region(region).build()) {
            VerifyMacRequest request = VerifyMacRequest.builder()
                    .keyId(keyId)
                    .message(SdkBytes.fromUtf8String(originalMessage))
                    .mac(SdkBytes.fromUtf8String(macBase64))
                    .macAlgorithm("HMAC_SHA_256") // 必须和生成时使用的算法一致
                    .build();

            VerifyMacResponse response = kmsClient.verifyMac(request);
            if (response.macValid()) {
                System.out.println("MAC验证通过");
            } else {
                System.out.println("MAC验证失败");
            }
        } catch (KmsException e) {
            // 验证失败时会抛出InvalidSignatureException，属于KmsException子类
            System.err.println("验证错误：" + e.getMessage());
            System.exit(1);
        }
    }
}

关键注意事项 #

• macAlgorithm参数必须和创建HMAC CMK时指定的算法完全一致（支持HMAC_SHA_256、HMAC_SHA_384、HMAC_SHA_512），否则会触发参数错误
• 本地开发可通过~/.aws/credentials文件或AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY环境变量配置凭证；AWS托管环境中，直接通过IAM角色授予KMS权限即可
• 生成的MAC是二进制数据，示例用Base64编码方便处理，实际场景也可直接使用字节数组传输

内容的提问来源于stack exchange，提问作者ItDepends