使用 node.js 加密来验证签名

Question

我正在尝试使用 AWS lambda 验证在 swift 中使用 sec256r1 创建的签名。

消息："some text to sign"

也已使用 sha256 进行哈希处理

签名将采用 base64

encoding:MEYCIQCPfWhpzxMqu3gZWflBm5V0aetgb2/S+SGyGcElaOjgdgIhALaD4lbxVwa8HUUBFOLz+CGvIioDkf9oihSnXHCqh8yV

和 public 键看起来像这样：

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXIvPbzLjaPLd8jgiv1TL/X8PXpJN
gDkGRj9U9Lcx1yKURpQFVavcMkfWyO8r7JlZNMax0JKfLZUM1IePRjHlFw==
-----END PUBLIC KEY-----

澄清一下，

我正在尝试使用 lambda 来验证来自客户端的签名，并在需要时使用其 public 密钥加密数据。

代码如下：

    const crypto = require('crypto');
    const verify = crypto.createVerify('SHA256');

    verify.write('some text to sign');
    verify.end();

    const l1 = "-----BEGIN PUBLIC KEY-----\n"
    const l2 = 
  "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXIvPbzLjaPLd8jgiv1TL/X8PXpJNgDkGRj9U9Lcx1yKURpQFVavcMkfWyO8r7JlZNMax0JKfLZUM1IePRjHlFw=="

    const l3 = "\n-----END PUBLIC KEY-----"

    const publicKey = l1 + l2 + l3

    const signature = "MEYCIQCPfWhpzxMqu3gZWflBm5V0aetgb2/S+SGyGcElaOjgdgIhALaD4lbxVwa8HUUBFOLz+CGvIioDkf9oihSnXHCqh8yV";

    console.log(verify.verify(publicKey, signature));// Prints: true or false

Answer 1

请在 node.js 中的 this Whosebug post which shows how to use the verify.update() and verify.verify() 方法中查看更完整的解决方案。

Answer 2

这是与 Nodejs.Crypto. First, the RSA private and public keys need to be generated. There are several ways to do that, here's an a way to do this online with encrypt.JS 集成的方法。在将私钥和 public 密钥存储到文件系统中后，您可以使用下面的 getSignatureByInput 函数，该文件系统会在给定字符串输入的情况下生成唯一签名：

const crypto = require('crypto')
const fs = require('fs')

const getSignatureByInput = (input) => {
  let privatePem = fs.readFileSync('PRIVATE_KEY_FILE_PATH_GOES_HERE')
  let key = privatePem.toString('ascii')
  let sign = crypto.createSign('RSA-SHA256')
  sign.update(input)
  let signature = sign.sign(key, 'hex')

  return signature
}

此后，到verify a signature，可以使用如下函数：

const getSignatureVerifyResult = (input) => {
        let signatureSignedByPrivateKey = getSignatureByInput(input)

        let pem = fs.readFileSync('PUBLIC_KEY_FILE_PATH_GOES_HERE')
        let publicKey = pem.toString('ascii')
        const verifier = crypto.createVerify('RSA-SHA256')

        verifier.update(input, 'ascii')

        const publicKeyBuf = new Buffer(publicKey, 'ascii')
        const signatureBuf = new Buffer(signatureSignedByPrivateKey, 'hex')
        const result = verifier.verify(publicKeyBuf, signatureBuf)

        return result;
}

getSignatureVerifyResult 将 return true/false 取决于签名是否被验证。请记住，在签名时有一个 plethora of algorithms to choose。

使用 node.js 加密来验证签名

Using node.js crypto to verify signatures

digital-signature

public-key-encryption

node.js