在MarkLogic XQuery中生成AWS签名：无法复现示例哈希值

我在MarkLogic中向AWS发送带签名的GET请求时，生成的签名结果和官方示例不一致。以下是我的代码：

let $canonicalRequest :=
'GET
/test.txt
X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20130524%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20130524T000000Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host
host:examplebucket.s3.amazonaws.com

host
UNSIGNED-PAYLOAD'

(: 此值正确，与示例一致：3bfa292879f6447bbcda7001decf97f4a54dc650c8942174ae0a9121cf58ad04 :)
let $canonicalRequestHash := xdmp:sha256($canonicalRequest) 

let $stringToSign :=
'AWS4-HMAC-SHA256
20130524T000000Z
20130524/us-east-1/s3/aws4_request
' ||
$canonicalRequestHash

let $signingKey := xdmp:hmac-sha256(xdmp:hmac-sha256(xdmp:hmac-sha256(xdmp:hmac-sha256("AWS4wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","20130524"),"us-east-1"),"s3"),"aws4_request")

return xdmp:hmac-sha256($signingKey,$stringToSign)

• 实际得到的结果：ec43271c228d0d408e25dd8ec1e3b71ed7c1dbfe5c76bd7f272d3bff665e1f16
• 期望得到的结果：aeeed9bbccd4d02ee5c0109b86d86835f995330da4c265957d157751f604d404

问题原因 #

MarkLogic的xdmp:hmac-sha256函数参数顺序和常规HMAC工具相反：它要求先传入消息，再传入密钥，而非常见的密钥在前、消息在后的顺序。代码中所有xdmp:hmac-sha256调用都搞反了参数顺序，导致签名错误。

修正后的代码 #

let $canonicalRequest :=
'GET
/test.txt
X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20130524%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20130524T000000Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host
host:examplebucket.s3.amazonaws.com

host
UNSIGNED-PAYLOAD'

let $canonicalRequestHash := xdmp:sha256($canonicalRequest) 

let $stringToSign :=
'AWS4-HMAC-SHA256
20130524T000000Z
20130524/us-east-1/s3/aws4_request
' || $canonicalRequestHash

(: 调整xdmp:hmac-sha256的参数顺序：消息在前，密钥在后 :)
let $signingKey := 
  xdmp:hmac-sha256("aws4_request",
    xdmp:hmac-sha256("s3",
      xdmp:hmac-sha256("us-east-1",
        xdmp:hmac-sha256("20130524", "AWS4wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY")
      )
    )
  )

return xdmp:hmac-sha256($stringToSign, $signingKey)

修正后运行代码，即可得到预期的签名结果。

内容的提问来源于stack exchange，提问作者maifosz