ctyun-eop-ak/ctyun-eop-sk basic signing process

(1) Creating a string: Create a string to be signed using the specification request and other information;

(2) Calculating the key: Use HEADER, ctyun-eop-sk, ctyun-eop-ak to create the key of the Hmac algorithm;

(3) Calculating the signature: Use the key in the second step and the string to be signed to calculate the signature through hmacsha256.

(4) Applying the signature: Add the created signature information to the HTTP request as a request header.

Creating a String to be Signed

(1) The construction rules of the string to be signed are as follows:

String to be signed = combined list of ranked Headers that need to be signed + "\n" + ranked query + "\n" + toHex(sha256 (original body)).

Parameter	Description
Combined list of ranked Headers that need to be signed (ranked headers)	Headers are concatenated one by one by \n using header_name:header_value. EOP requires the ctyun-eop-request-id and eop-date headers to be part of the header, and must be one of the headers to be signed. The headers that need to be signed need to be ranked (their header_names are ranked in the order of the 26 English letters), and the ranked list is traversed and assembled into headers to be signed.
Ranked query	Queries are joined with &, and key and value are connected with =, and the ranking rules are the order of 26 English letters, and all query parameters need to be signed.
toHex(sha256(original body))	The inbound body parameter is sha256 digested, and the digested result is converted to hexadecimal.

(2) Example of ranked orders

Assuming that you need to sign ctyun-eop-request-id, eop-date, and the host, the header to be signed is constructed as follows:

ctyun-eop-request-id:123456789\neop-date:20210531T100101Z\nhost:1.1.1.1:9080\n

The order of ctyun-eop-request-id, eop-date and host is applied. If you add a ccad header; at the same time, this header also needs to be signed, then the header combination to be signed is:

ccda:123\n ctyun-eop-request-id:123456789\neop-date:20210531T100101Z\nhost:1.1.1.1:9080\n

Constructing a Dynamic Key

When initiating a request, you need to construct an eop-date time. The format of this time is yyyymmddTHHMMSSZ; to be more concise, it is year, month, day, T hour, minute, and second Z.

(1) First, use the ctyun-eop-sk you applied for as the key and eop-date as the data to calculate the ktime.

(2) Use the ktime as the key and the ctyun-eop-ak data you applied for to calculate the kAk;

(3) Use the kAk as the key and the year, month and day for the eop-date as the data to calculate the kdate.

Parameter	Description
eop-date	yyyymmddTHHMMSSZ (20211221T163614Z) (year, month, day, T hour, minute, second Z).
Ktime	Use the ctyun-eop-sk you applied for as the key and eop-date as the data to calculate the ktime. Ktime = hmacSha256(ctyun-eop-sk, eop-date)
kAk	Use the ktime as the key and the ctyun-eop-ak data you applied for to calculate the kAk; kAk = hmacsha256(ktime,ctyun-eop-ak)
kdate	Use the kAk as the key and the year, month and day for the eop-date as the data to calculate the kdate; kdate = hmacsha256(kAk, eop-date)

Applying Signatures and Signature Examples

(1) The signature is generated from the string_sigture and kdate to be signed respectively from Constructing a Dynamic Key and Creating a String to Be Signed .

Parameter	Description
Signature	The strings string_sigture, kdate are to be signed; and then based on the result obtained on hmacsha256 (kdate, string_sigture), the result is base64 encoded to obtain the signature.
Eop-Authorization	ctyun-eop-ak Header=The header ranking signature when you construct the string to be signed (note that there are spaces in the middle). The headers are ranked and joined together with the semicolon ";". Example: The header sequence of the string you want to sign is eop-date and host; then the value you add to the header is Eop-Authorization: ctyun-eop-ak Header=eop-date;host Signature=xad01/ada

Eop-Authorization is obtained from the above, and then the data is integrated into HEADER and placed in http_client, and then you can issue them.
(2) The request header required by http_client is as follows:
Eop-Authorization: ctyun-eop-ak Header= ctyun-eop-request-id;eop-date Signature=xad01/ada
eop-date:20211221T163614Z
ctyun-eop-request-id: 123456789
(Note: If the headers to be signed are more than the default ctyun-eop-request-id and eop-date, they need to be added to the request header (http_client), and the Eop-Authorization also needs to be added).

Distributed Message Service (Kafka)

Basic Signing Procedure