Skip to content

Exchange data with standard JOSE tools

Work with a party outside the platform using that party's own public key: verify a JWS it signed with standard JOSE tooling, or encrypt a file for it. The public key you supply is used for the one request and is never stored as a key of your tenant.

Who can do it

An application authenticated as a cryptographic actor of your tenant, whose token carries:

  • interoperability.verifySignature to verify a signature with a supplied public key;
  • interoperability.encrypt to encrypt with a supplied public key.

No Capability Grant is involved, because no key of your tenant is used. No console role performs these operations.

Before you start

  • You have the other party's public key, Base64-encoded, with its key type and algorithm.
  • To verify, you have the signed data and the detached JWS in flattened JSON form ({"protected", "signature"}), carrying one signature.
  • The application can obtain a token. See Get an access token for an application.
  • These are streaming operations, and they do not run under PQC session transport.

Steps

  1. Verify a signature made by the other party:
    • Java SDK: sdk.verifySignatureUtilityStream(kty, alg, publicKeyBase64, signatureBase64, dataFile) returns a VerifySignatureResult; read isValid().
    • Crypto CLI: AnkaSecureCLI verify-signature-publickey-stream --kty <kty> --alg <alg> --public-key <file> --input-signature-file <file> --input-file <file>, where --public-key names a JSON file with a Base64 publicKey field.
    • API: POST /api/v3/interoperability/verify with a multipart/form-data body: metadata (the detached JWS and the public key) before file (the signed data).
  2. The JWS's own protected alg selects the scheme and must fit the key: RS256, RS384, RS512, PS256, PS384 or PS512 for an RSA key; the one ECDSA algorithm of an EC key's curve, such as ES256 for P-256; EdDSA, Ed25519 or Ed448 for an Edwards key; the parameter-set name, such as ML-DSA-65, for a post-quantum signing key. Any kid in the header is ignored.
  3. Encrypt a file for the other party:
    • Java SDK: sdk.encryptFileUtilityStream(kty, alg, publicKeyBase64, input, output) returns an EncryptResult.
    • Crypto CLI: AnkaSecureCLI encrypt-file-publickey-stream --kty <kty> --alg <alg> --public-key <file> --input-file <file> --output-file <file>.
    • API: POST /api/v3/interoperability/encrypt with metadata (kty, alg, publicKey) before file (the plaintext); the ciphertext is streamed back.

What you see when it worked

A verification answers 200 with valid and one signatureResults entry that carries the algorithm you declared and no key identifier or material version, because the key is not a platform key. valid is false when the signature does not verify under the supplied key.

An encryption streams the ciphertext back; the SDK and the CLI write it to the output file.

If it fails

What you see Cause What to do
200 with valid: false The signature does not verify under the supplied key Do not trust the data
422 with JWS_SINGLE_SIGNATURE_REQUIRED The JWS carries several signatures; one supplied key verifies one signature Verify each signature with its own key, or use the platform's own verification for platform keys
422 .../errors/unprocessable-entity The protected alg is none, absent, an HMAC or composite algorithm, or does not fit the key; or the supplied key is not the parameter set or curve its alg names Supply the key and algorithm that match
400 .../errors/invalid-input The key material, the JWS or the multipart body is invalid, or alg names no parameter set Correct the request
400 .../errors/pqc-transport-not-available-for-streaming The request was sent with PQC session transport Resend without the X-PQC-Transport and X-PQC-Session headers
403 The calling application or actor is suspended or disabled, or the token lacks the scope Ask a tenant administrator to check the actor
408 .../errors/stream-read-budget-exceeded The upload was not received within the deployment's time budget Retry on a faster link, or with a smaller file
429 with Retry-After The streaming concurrency limit is full Retry after the indicated time

Without the console

These operations have no console screen.

Surface How
Java SDK verifySignatureUtilityStream, encryptFileUtilityStream on AuthenticatedSdk
Crypto CLI AnkaSecureCLI verify-signature-publickey-stream, encrypt-file-publickey-stream
API POST /api/v3/interoperability/verify (verifyInteroperable), POST /api/v3/interoperability/encrypt (encryptInteroperable)