URLs Ký ECDSA Trên CloudFront: Tăng Tốc 91% và Ngắn Hơn 55%

# Tạo khóa riêng ECDSA P-256
openssl ecparam -name prime256v1 -genkey -noout -out ecdsa-private.pem

# Tạo khóa công khai
openssl ec -in ecdsa-private.pem -pubout -out ecdsa-public.pem

# Để so sánh, tạo khóa RSA
openssl genrsa -out rsa-private.pem 2048
openssl rsa -pubout -in rsa-private.pem -out rsa-public.pem

# Đăng ký khóa công khai ECDSA
ECDSA_KEY_CONTENT=$(cat ecdsa-public.pem)
ECDSA_KEY_RESPONSE=$(aws cloudfront create-public-key \
    --public-key-config \
    Name="ecdsa-signing-key",CallerReference="$(date +%s)",EncodedKey="$ECDSA_KEY_CONTENT",Comment="Khóa ECDSA P-256 cho các URL ký")

ECDSA_KEY_ID=$(echo $ECDSA_KEY_RESPONSE | jq -r '.PublicKey.Id')
echo "ECDSA Key ID: $ECDSA_KEY_ID"

# Tạo nhóm khóa ECDSA
ECDSA_KEY_GROUP_RESPONSE=$(aws cloudfront create-key-group \
    --key-group-config \
    Name="ecdsa-key-group",Items="$ECDSA_KEY_ID",Comment="Nhóm khóa ECDSA")

ECDSA_KEY_GROUP_ID=$(echo $ECDSA_KEY_GROUP_RESPONSE | jq -r '.KeyGroup.Id')

# aws --version
# aws-cli/2.29.0 
# Lệnh này sẽ thất bại với các khóa ECDSA
aws cloudfront sign --url https://example.com/file.jpg \
    --key-pair-id $ECDSA_KEY_ID \
    --private-key file://ecdsa-private.pem \
    --date-less-than "2025-09-10T12:09:03Z"
# Lỗi: Không tìm thấy khóa riêng RSA trong PEM.

# ecdsa_signer.py
import sys
import time
from botocore.signers import CloudFrontSigner
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.serialization import load_pem_private_key
from cryptography.hazmat.backends import default_backend
import os
from datetime import datetime

def ecdsa_signer(message):
    with open("ecdsa-private.pem", "rb") as key_file:
        private_key = load_pem_private_key(
            key_file.read(), password=None, backend=default_backend()
        )
    return private_key.sign(message, ec.ECDSA(hashes.SHA1()))

def generate_signed_url(url, key_pair_id, date_less_than):
    start_time = time.time()

    cf_signer = CloudFrontSigner(key_pair_id, ecdsa_signer)
    signed_url = cf_signer.generate_presigned_url(
        url,
        date_less_than=datetime.fromisoformat(date_less_than.replace("Z", "+00:00")),
    )

    processing_time_ms = (time.time() - start_time) * 1000
    print(f"Thời gian xử lý ECDSA: {processing_time_ms:.2f}ms", file=sys.stderr)

    return signed_url

if __name__ == "__main__":
    url = sys.argv[1] if len(sys.argv) > 1 else "https://example.com/file.jpg"
    expiry_time = sys.argv[2] if len(sys.argv) > 2 else "2025-09-10T12:09:03Z"
    key_pair_id = os.environ.get("ECDSA_KEY_ID")

    signed_url = generate_signed_url(url, key_pair_id, expiry_time)
    print(signed_url)

https://example.com/private-files/uploadtest.jpg?Expires=1757511063&Signature=TNGmM2jrc5GRTalKgYhdZla1uaR~gOiX4HevKDMBbe5JkecwxGe0VoCqXB5KnCPgetRbbBE6JCtOdCYiTwGYxKpByOBJTMaS5Z3H9rqhln~wqQ0KZ-q5-lqvEPsxXlbBXbzJ0MDwNgzcCcu3GavsYGiceFr0veGw5RuYNLSs49HdFUKtdk~7wpI~bjdHzLDSaxoTKtIz0HDgii~VTPP769X~aOmG7~W0hm23nBP4WcTDe6Z8YvDRr61TqjixkNYrh4FiuUFFVuA2Tn0FUuaxcU5qVhtcl0ng8QqoyHUwWFju65h6g0TUM2iueJudQtV-CcoYf-UHlVOGQ39pnG9HxQ__&Key-Pair-Id=ZZZZZZZZZZZZZ

https://example.com/private-files/uploadtest.jpg?Expires=1757511063&Signature=MEQCIBO~LD6qEaVjiwGFFF233dOB~XJvi7SPhubaN0FjFsigAiBlLZAYz9sCp6aY93bE9z0SuZDhEH3Pw8uL-9rPODVbQw__&Key-Pair-Id=WWWWWWWWWWWWWW