title: How to derive a sign-in key for AWS Signature Version 4 (in ColdFusion)?
body: <p>I am trying to use ColdFusion to access Amazon Web Services (AWS) using their current authentication method known as Signature Version 4.  I have consulted their documentation which has code examples for <a href="http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html" rel="nofollow">several programming languages</a>, as well as pseudo-code for <a href="http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-other" rel="nofollow">other languages</a>.  They provided some test input values to pass in to my script's signature function, and also some expected results.</p>
  
  <p>Here are the test inputs:</p>
  
  <pre><code>key = 'wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY'
  dateStamp = '20120215'
  regionName = 'us-east-1'
  serviceName = 'iam'
  </code></pre>
  
  <p>Here are the expected results:</p>
  
  <pre><code>kSecret  = '41575334774a616c725855746e46454d492f4b374d44454e472b62507852666943594558414d504c454b4559'
  kDate    = '969fbb94feb542b71ede6f87fe4d5fa29c789342b0f407474670f0c2489e0a0d'
  kRegion  = '69daa0209cd9c5ff5c8ced464a696fd4252e981430b10e3d3fd8e2f197d7a70c'
  kService = 'f72cfd46f26bc4643f06a11eabb6c0ba18780c19a8da0c31ace671265e3c87fa'
  kSigning = 'f4780e2d9f65fa895f9c67b32ce1baf0b0d8a43505a000a1a9e090d414db404d'
  </code></pre>
  
  <p>The correct value for "kSigning" should be this:</p>
  
  <pre><code>f4780e2d9f65fa895f9c67b32ce1baf0b0d8a43505a000a1a9e090d414db404d
  </code></pre>
  
  <p>However, for "kSigning" my code generates this:</p>
  
  <pre><code>31A84DCE0538A8B15ED68CCFBD803F17947E41BF625EFFD1AD6A67FC821F9BE2
  </code></pre>
  
  <p>I am using Railo 4.2.  Can someone please help me solve this, so that the anticipated value matches the dumped value?  Here's my ColdFusion markup:</p>
  
  <pre><code>&lt;cfsilent&gt;
  
  &lt;!--- HMACSHA256 ---&gt;
  &lt;cffunction name="sign" returntype="binary" access="private" output="false" hint="Sign with NSA SHA-256 Algorithm"&gt;
     &lt;cfargument name="signMessage" type="string" required="true" /&gt;
     &lt;cfargument name="signKey" type="string" required="true" /&gt;
  
     &lt;cfset var jMsg = JavaCast("string",arguments.signMessage).getBytes("utf-8") /&gt;
     &lt;cfset var jKey = JavaCast("string",arguments.signKey).getBytes("utf-8") /&gt;
     &lt;cfset var key = createObject("java","javax.crypto.spec.SecretKeySpec") /&gt;
     &lt;cfset var mac = createObject("java","javax.crypto.Mac") /&gt;
  
     &lt;cfset key = key.init(jKey,"HmacSHA256") /&gt;
     &lt;cfset mac = mac.getInstance(key.getAlgorithm()) /&gt;
     &lt;cfset mac.init(key) /&gt;
  
     &lt;cfreturn mac.doFinal(jMsg) /&gt;
  &lt;/cffunction&gt;
  
  &lt;!--- Get Signature Key ---&gt;
  &lt;cffunction name="getSignatureKey" returntype="binary" access="private" output="false" hint="Derive the sign-in key"&gt;
      &lt;cfargument name="key" type="string" required="true" /&gt;
      &lt;cfargument name="dateStamp" type="string" required="true" /&gt;
      &lt;cfargument name="regionName" type="string" required="true" /&gt;
      &lt;cfargument name="serviceName" type="string" required="true" /&gt;
  
      &lt;cfset var kSecret = "AWS4" &amp; arguments.key /&gt;
      &lt;cfset var kDate = sign( arguments.dateStamp, kSecret ) /&gt;
      &lt;cfset var kRegion = sign( arguments.regionName, kDate ) /&gt;
      &lt;cfset var kService = sign( arguments.serviceName, kRegion ) /&gt;
      &lt;cfset var kSigning = sign( arguments.serviceName, kService ) /&gt;
  
      &lt;cfreturn kSigning /&gt;
  &lt;/cffunction&gt;
  
  &lt;/cfsilent&gt;&lt;!doctype html&gt;
  
  &lt;html lang="en"&gt;
  &lt;head&gt;
      &lt;meta charset="utf-8"&gt;
      &lt;title&gt;AWS Test&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  
  &lt;cfset kSecret = getSignatureKey( 
      'wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY', 
      '20120215', 
      'us-east-1', 
      'iam' 
  ) /&gt;
  &lt;cfdump var="#BinaryEncode(kSecret, 'hex')#" label="kSecret" /&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>