AWS cloudhsm documentation change
Summary
Added --data-type parameter documentation specifying whether input data is raw or pre-hashed digest
Security assessment
Clarifies proper handling of cryptographic data input types (raw vs pre-hashed), which helps prevent misuse that could lead to cryptographic vulnerabilities. However, no direct evidence of addressing a specific security incident.
Diff
diff --git a/cloudhsm/latest/userguide/cloudhsm_cli-crypto-sign-ecdsa.md b/cloudhsm/latest/userguide/cloudhsm_cli-crypto-sign-ecdsa.md index 0069e029b..d1cbaa0df 100644 --- a//cloudhsm/latest/userguide/cloudhsm_cli-crypto-sign-ecdsa.md +++ b//cloudhsm/latest/userguide/cloudhsm_cli-crypto-sign-ecdsa.md @@ -53,0 +54,2 @@ The following types of users can run this command. + --data-type <DATA_TYPE> + The type of data passed in, either raw or digest [possible values: raw, digest] @@ -143,0 +146,14 @@ Specifies the file path to a signed quorum token file to approve operation. Only +**`<DATA_TYPE>`** + + +Specifies whether the value of the data parameter should be hashed as part of the signing algorithm. Use `raw` for unhashed data; use `digest` for digests, which are already hashed. + +Valid values: + + * raw + + * digest + + + +