crypto-service-api

This is a minimal, security-focused ASP.NET Core API that provides REST API endpoints for hashing, signing, and verifying.

This project was created for educational purposes only and should not be used for other purposes.

---

Features

• Hashing using SHA256
• Signing messages and verifying signatures using ECDSA (in conjunction with SHA256)
• JSON Web Tokens for authentication with role-based authorization (using HMAC-SHA256)
• Input validation and request size limits
• Logging

---

Security and technology

• Hash, sign and verify endpoints use the built-in functions from System.Security.Cryptography of .NET and require authentication
  • SHA256
  • ECDSA
• Tokens are created using HmacSha256 (token endpoint exists only for local testing)
• Request sizes are limited
• Keys are demo-only and intentionally stored unsecurely in appsettings.json!

---

Running using Docker

Prerequisites (install first)

• Docker (tested with Docker Engine on Linux)

Build the Docker Image

cd into the project root and run

docker build -t crypto-service .

Then, run the container with

docker run -p 8080:8080 crypto-service

The API will be available at http://localhost:8080.

API Endpoints

• GET /health
• POST /hash
• POST /sign
• POST /verify

Basic Usage

The following commands assume that you have curl and jq installed. If you don't want to install jq, you can copy and paste the relevant fields from the JSON responses.

Health check (doesn't require authorization):

curl http://localhost:8080/health

Obtain a JWT (only for testing):

TOKEN=$(curl -s -X POST http://localhost:8080/auth/token | jq -r '.token')

Hashing:

curl -s -X POST http://localhost:8080/crypto/hash -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"Data":"hello"}'

Signing:

SIGNATURE=$(curl -s -X POST http://localhost:8080/crypto/sign -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"Data":"sign this"}' | jq -r '.signature')

Verifying:

Right signature:

curl -X POST http://localhost:8080/crypto/verify -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d "{\"Data\":\"sign this\",\"signature\":\"$SIGNATURE\"}"

Wrong signature:

curl -X POST http://localhost:8080/crypto/verify -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d "{\"Data\":\"Different data\",\"signature\":\"$SIGNATURE\"}"