COSE signatures

Signatures

Create new

Signature will contain a DID issuer header which will point back to the did document hosted here .well-known/did.json

There will also be a payload wrapped inside along with a header indicating the content type of the payload (text/plain).

Payload will get embedded in the COSE_Sign1 signature envelope. The generated private key will be used to sign.
Content type of the payload to add to the headers, defaults to "text/plain"
Create with cURL
curl -L 'https://playground-cose-eastus-api.azurewebsites.net/signature/create' -X POST \
                  --form payload='{"foo":"bar"}' \
                  --form contenttype='application/json' \
                  -o signature.cose

Verify

Verification will download did:web keys from the given signature issuer and will validate the signature against it.

Attach the cose file if you have it, or
If you do not have a file but know the signature representation in HEX then use this field
Verify with cURL

Using a file:

curl -L 'https://playground-cose-eastus-api.azurewebsites.net/signature/verify' -X POST \
                  --form signaturefile='@./my/signature/file.cose'

Using a hex value:

curl -L 'https://playground-cose-eastus-api.azurewebsites.net/signature/verify' -X POST \
                  --form signaturehex='d2845828a301260446666f6f...17219018758186469643a77'

Countersigning and receipts

Create receipt (countersign)

This implementation produces a full countersignature - COSE_Countersignature aka receipt. It contains a signature over the details of the submitted COSE_Sign1 parts (CounterSignatureV2). Please refer to RFC9338 for more details on countersignatures.

Attach the cose file if you have it, or
If you do not have a file but know the signature representation in HEX then use this field
Specify how you want the receipt to be issued. Embedded option suits when you want keep signature and countersignature in one file.
Countersign with cURL

Using a file:

curl -L 'https://playground-cose-eastus-api.azurewebsites.net/receipt/create' -X POST \
                  --form signaturefile='@./my/signature/file.cose'
                  --form receipttype='embedded'

Using a hex value:

curl -L 'https://playground-cose-eastus-api.azurewebsites.net/receipt/create' -X POST \
                  --form signaturehex='d2845828a301260446666f6f...17219018758186469643a77'
                  --form receipttype='embedded'

Verify receipt

For the verification it is necessary to have both the receipt and the original signature. The receipt might be embedded into the original signature or be a separate file.

Attach the cose file if you have it, or
If you do not have a file but know the signature representation in HEX then use this field
Attach the receipt file if you have it, or
If you do not have a file but know the representation in HEX then use this field
Verify with cURL

Using a file:

curl -L 'https://playground-cose-eastus-api.azurewebsites.net/receipt/verify' -X POST \
                  --form signaturefile='@./my/signature/file.cose'
                  --form receiptfile='@./my/signature/receipt.cbor'

Using a hex value:

curl -L 'https://playground-cose-eastus-api.azurewebsites.net/receipt/verify' -X POST \
                  --form signaturehex='d2845828a301260446666f6f...17219018758186469643a77'
                  --form receipthex='d2845828a301260446666f6f...17219018758186469643a77'

To preview signature use the following websites