Question

A financial services company must digitally sign outbound payment files so that external partners can cryptographically verify the files came from the company and were not altered. Partners do not have AWS accounts and must be able to verify signatures using standard tooling without contacting AWS. The signing private key must never leave AWS and must be protected by FIPS 140-2 validated hardware. Which approach meets these requirements?

Accepted Answer

Create an asymmetric KMS key with key usage SIGN_VERIFY, sign files by calling the KMS Sign API, and distribute the public key to partners so they can verify signatures offline.

Answer

Create a symmetric KMS key and generate HMAC tags for each file, then share the symmetric key material with partners so they can recompute the HMAC.

Answer

Store an RSA private key in AWS Secrets Manager, retrieve it in a Lambda function to sign files, and publish the corresponding public key to partners.

Answer

Create an asymmetric KMS key with key usage ENCRYPT_DECRYPT, encrypt files with the private key, and give partners the public key to decrypt and confirm origin.