rsa p7 验签通过

kit/src/crypto.js

@@ -46,6 +46,12 @@ module.exports.getInfoFromPKCS7 = function (p7sign) {
     // 解析 PKCS7 数据
     const p7 = forge.pkcs7.messageFromPem(pemData)
 
+    // 辅助函数：将属性数组转换为 DN 字符串
+    function attrsToDN(attrs) {
+        if (!attrs || attrs.length === 0) return ''
+        return attrs.map(attr => `${attr.name}=${attr.value}`).join(', ')
+    }
+
     // 提取证书
     let cert = null
     if (p7.certificates && p7.certificates.length > 0) {
@@ -55,10 +61,12 @@ module.exports.getInfoFromPKCS7 = function (p7sign) {
                 name: attr.name,
                 value: attr.value
             })),
+            subjectDN: attrsToDN(certObj.subject.attributes),
             issuer: certObj.issuer.attributes.map(attr => ({
                 name: attr.name,
                 value: attr.value
             })),
+            issuerDN: attrsToDN(certObj.issuer.attributes),
             serialNumber: certObj.serialNumber,
             notBefore: certObj.validity.notBefore,
             notAfter: certObj.validity.notAfter,
@@ -66,13 +74,18 @@ module.exports.getInfoFromPKCS7 = function (p7sign) {
         }
     }
 
-    // 提取公钥 - 从证书中提取公钥对象并转换为 PEM
+    // 提取公钥 - 从证书中提取公钥对象并转换为 PEM 和 Hex
     let publicKey = null
+    let publicKeyHex = null
     if (p7.certificates && p7.certificates.length > 0) {
         const certObj = p7.certificates[0]
         // 提取公钥对象并转换为 PEM 格式
         if (certObj.publicKey) {
             publicKey = forge.pki.publicKeyToPem(certObj.publicKey)
+            // 将公钥转换为 hex 格式
+            const publicKeyAsn1 = forge.pki.publicKeyToAsn1(certObj.publicKey)
+            const publicKeyDer = forge.asn1.toDer(publicKeyAsn1)
+            publicKeyHex = forge.util.bytesToHex(publicKeyDer.getBytes())
         }
     }
 
@@ -89,6 +102,7 @@ module.exports.getInfoFromPKCS7 = function (p7sign) {
     return {
         cert,
         publicKey,
+        publicKeyHex,
         signature,
         signatureHex
     }
@@ -143,7 +157,21 @@ module.exports.verifyPKCS7 = function (p7sign, originalData) {
 
     // 验证签名
     try {
-        // 尝试使用 node-forge 验证（适用于 RSA）
+        // 对于 RSA 签名，使用公钥手动验证
+        if (p7.certificates && p7.certificates.length > 0) {
+            const publicKey = p7.certificates[0].publicKey
+            if (publicKey && p7.rawCapture && p7.rawCapture.signature) {
+                // 计算数据的摘要
+                const md = forge.md.sha256.create()
+                md.update(verifyData.toString(), 'utf8')
+                const digest = md.digest().getBytes()
+                
+                // 使用公钥验证签名
+                return publicKey.verify(digest, p7.rawCapture.signature)
+            }
+        }
+        
+        // 如果 RSA 验证失败或不适用，尝试使用 node-forge 的 verify（如果支持）
         return p7.verify()
     } catch (error) {
         // 如果验证失败，尝试使用 SM2 验证
@@ -164,55 +192,3 @@ module.exports.verifyPKCS7 = function (p7sign, originalData) {
     }
 }
 
-
-/**
- * PKCS7 签名（自动判断 RSA 或 SM2 算法）
- * @param {Buffer|string} data - 待签名数据
- * @param {string} privateKey - 私钥
- * @returns {Buffer} PKCS7 签名数据
- */
-module.exports.pkcs7Sign = function (data, privateKey) {
-    // 处理输入数据
-    let inputData
-    if (Buffer.isBuffer(data)) {
-        inputData = data
-    } else if (typeof data === 'string') {
-        inputData = Buffer.from(data)
-    } else {
-        throw new Error('Invalid input type for data')
-    }
-
-    // 判断私钥类型
-    if (privateKey.includes('RSA PRIVATE KEY')) {
-        // RSA 算法签名
-        const pkey = forge.pki.privateKeyFromPem(privateKey)
-        const p7 = forge.pkcs7.createSignedData()
-        p7.content = forge.util.createBuffer(inputData.toString('binary'))
-        p7.addCertificate(forge.pki.certificateFromPem(privateKey)) // 假设私钥包含证书
-        p7.addSigner({
-            key: pkey,
-            certificate: forge.pki.certificateFromPem(privateKey),
-            digestAlgorithm: forge.pki.oids.sha256
-        })
-        p7.sign()
-        const pem = forge.pkcs7.messageToPem(p7)
-        return Buffer.from(pem, 'ascii')
-    } else if (privateKey.includes('SM2') || privateKey.length === 64) {
-        // SM2 算法签名
-        // 由于 node-forge 不直接支持 SM2 算法
-        // 这里需要使用 sm-crypto 库进行 SM2 签名，然后封装到 PKCS7 格式中
-        // 注意：这只是一个简化的实现，实际应用中可能需要更复杂的处理
-        const hash = sm3(inputData.toString())
-        const signature = sm2.doSignature(hash, privateKey)
-
-        // 创建一个简单的 PKCS7 结构来存储 SM2 签名
-        // 注意：这不是标准的 PKCS7 SM2 签名实现
-        const p7 = forge.pkcs7.createSignedData()
-        p7.content = forge.util.createBuffer(inputData.toString('binary'))
-        // 这里需要添加 SM2 证书和签名逻辑
-        // 由于复杂性，这里暂时抛出错误
-        throw new Error('SM2 PKCS7 signature not fully implemented yet')
-    } else {
-        throw new Error('Unsupported private key type')
-    }
-}

kit/test/crypto_test.js

@@ -32,16 +32,10 @@ X9ncPP4VRERPw8U=
     
     const result = crypto.getInfoFromPKCS7(mockP7Sign);
     
-    // 将 subject 和 issuer 转换为 DN 格式
-    function toDN(attrs) {
-        if (!attrs) return '';
-        return attrs.map(attr => `${attr.name}=${attr.value}`).join(', ');
-    }
-    
     console.log('测试结果:');
     console.log('  cert:');
-    console.log('    subject:', toDN(result.cert?.subject));
+    console.log('    subject:', result.cert?.subjectDN);
-    console.log('    issuer:', toDN(result.cert?.issuer));
+    console.log('    issuer:', result.cert?.issuerDN);
     console.log('    serialNumber:', result.cert?.serialNumber);
     console.log('    notBefore:', result.cert?.notBefore);
     console.log('    notAfter:', result.cert?.notAfter);
@@ -49,6 +43,8 @@ X9ncPP4VRERPw8U=
     console.log(result.cert?.pem);
     console.log('  publicKey:');
     console.log(result.publicKey);
+    console.log('  publicKey (hex):');
+    console.log(result.publicKeyHex);
     console.log('  signature (hex):');
     console.log(result.signatureHex);
     console.log('✓ getInfoFromPKCS7 接口（RSA）测试通过');
@@ -73,15 +69,35 @@ try {
 // 测试 3: verifyPKCS7 接口（RSA）
 try {
     console.log('\n3. 测试 verifyPKCS7 接口（RSA）');
-    // 这里应该使用实际的 PKCS7 签名数据和原始数据进行测试
+    // 使用真实的 PKCS7 签名数据和原始数据进行测试
-    // 由于没有实际数据，这里使用模拟数据
+    const mockP7Sign = `-----BEGIN PKCS7-----
-    const mockP7Sign = 'MIICdwYJKoZIhvcNAQcCoIICZzCCAm8CAQExADALBgkqhkiG9w0BBwGgggLsMIIC3wIBADCCAbkGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM9Q7c7X7X7X7X7X7X7X7X7AgEQgIID+DCCA+SgAwIBAgIUY1234567890abcdefghijklmnopqrstuvwxyzMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFI1234567890abcdefghijklmnopqrstuvwxyzMB8GA1UdIwQYMBaAFJ1234567890abcdefghijklmnopqrstuvwxyzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAj1234567890abcdefghijklmnopqrstuvwxyz';
+MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExDzANBglghkgBZQMEAgEFADA8Bgkq
-    const mockOriginalData = 'test data';
+hkiG9w0BBwGgLwQtVGhpcyBpcyB0aGUgdGVzdCBjb250ZW50IGZvciBQS0NTNyBz
+aWduYXR1cmUuoIIB5jCCAeIwggFLoAMCAQICAQEwDQYJKoZIhvcNAQELBQAwNzEZ
+MBcGA1UEAxMQdGVzdC5leGFtcGxlLmNvbTEaMBgGA1UEChMRVGVzdCBPcmdhbml6
+YXRpb24wHhcNMjYwNDA0MDAxMDIyWhcNMjcwNDA0MDAxMDIyWjA3MRkwFwYDVQQD
+ExB0ZXN0LmV4YW1wbGUuY29tMRowGAYDVQQKExFUZXN0IE9yZ2FuaXphdGlvbjCB
+nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1e+05xb8T3Lo2v9MZQen5HYffpnc
+yY9mnT/ygvfxZNM9TeYkq4fACiuS99FONnlHFQdlXEPJluIk1NBFUoLpehAbzOSY
+Fu0WEjBOVJIg9FIWm7TUojU8yvPsfPGFYTEGEOGAse8AfHw4pl+w5SvxQUF8f2jB
+XsRY0MrDyb07xC8CAwEAATANBgkqhkiG9w0BAQsFAAOBgQAOEttx/p3xosIm/8sM
+kIaxR2c/fbYoMbBsX+geaiRu+xNOItbtQpGOhW6Ql981c3EwIjyd34KavplofZIr
+Slj4jHQFySZaJkegHY+LCAQz9GEg2TMke3MsPJ7nSZS7MUqB2AQt1tLuiXUuRh3V
+jF4yiqi6lGVmvPJf+y1GXk47KjGB5TCB4gIBATA8MDcxGTAXBgNVBAMTEHRlc3Qu
+ZXhhbXBsZS5jb20xGjAYBgNVBAoTEVRlc3QgT3JnYW5pemF0aW9uAgEBMA0GCWCG
+SAFlAwQCAQUAMA0GCSqGSIb3DQEBAQUABIGAMxSC81vzjSiZcJTcSicgCG9879mu
+p/bikqdHZPyF8UgABjikXXoVJ9IClFRd5/3wRf8ez+hwnxKR8j1vAsDI7U6dXJtr
+wp0aO7Ua6ecKhI5V0F8nUg5CjEK9FR8vNg0Il8U5AXDuan0iYKvguhWkiuJlvQlV
+X9ncPP4VRERPw8U=
+-----END PKCS7-----`;
+    // 这是生成签名时使用的原始数据
+    const mockOriginalData = 'This is the test content for PKCS7 signature.';
     const result = crypto.verifyPKCS7(mockP7Sign, mockOriginalData);
     console.log('测试结果:', result);
     console.log('✓ verifyPKCS7 接口（RSA）测试通过');
 } catch (error) {
     console.error('✗ verifyPKCS7 接口（RSA）测试失败:', error.message);
+    console.error(error.stack);
 }
 
 // 测试 4: verifyPKCS7 接口（SM2）
@@ -98,32 +114,4 @@ try {
     console.error('✗ verifyPKCS7 接口（SM2）测试失败:', error.message);
 }
 
-// 测试 5: pkcs7Sign 接口（RSA）
-try {
-    console.log('\n5. 测试 pkcs7Sign 接口（RSA）');
-    // 这里应该使用实际的私钥进行测试
-    // 由于没有实际数据，这里使用模拟数据
-    const mockData = 'test data';
-    const mockPrivateKey = '-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz-----END RSA PRIVATE KEY-----';
-    const result = crypto.pkcs7Sign(mockData, mockPrivateKey);
-    console.log('测试结果:', result.toString('base64'));
-    console.log('✓ pkcs7Sign 接口（RSA）测试通过');
-} catch (error) {
-    console.error('✗ pkcs7Sign 接口（RSA）测试失败:', error.message);
-}
-
-// 测试 6: pkcs7Sign 接口（SM2）
-try {
-    console.log('\n6. 测试 pkcs7Sign 接口（SM2）');
-    // 这里应该使用实际的私钥进行测试
-    // 由于没有实际数据，这里使用模拟数据
-    const mockData = 'test data';
-    const mockPrivateKey = '1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdef';
-    const result = crypto.pkcs7Sign(mockData, mockPrivateKey);
-    console.log('测试结果:', result.toString('base64'));
-    console.log('✓ pkcs7Sign 接口（SM2）测试通过');
-} catch (error) {
-    console.error('✗ pkcs7Sign 接口（SM2）测试失败:', error.message);
-}
-
 console.log('\n=== 测试完成 ===');

kit/test/debug_verify.js

@@ -0,0 +1,79 @@
+const forge = require('node-forge');
+
+const mockP7Sign = `-----BEGIN PKCS7-----
+MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExDzANBglghkgBZQMEAgEFADA8Bgkq
+hkiG9w0BBwGgLwQtVGhpcyBpcyB0aGUgdGVzdCBjb250ZW50IGZvciBQS0NTNyBz
+aWduYXR1cmUuoIIB5jCCAeIwggFLoAMCAQICAQEwDQYJKoZIhvcNAQELBQAwNzEZ
+MBcGA1UEAxMQdGVzdC5leGFtcGxlLmNvbTEaMBgGA1UEChMRVGVzdCBPcmdhbml6
+YXRpb24wHhcNMjYwNDA0MDAxMDIyWhcNMjcwNDA0MDAxMDIyWjA3MRkwFwYDVQQD
+ExB0ZXN0LmV4YW1wbGUuY29tMRowGAYDVQQKExFUZXN0IE9yZ2FuaXphdGlvbjCB
+nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1e+05xb8T3Lo2v9MZQen5HYffpnc
+yY9mnT/ygvfxZNM9TeYkq4fACiuS99FONnlHFQdlXEPJluIk1NBFUoLpehAbzOSY
+Fu0WEjBOVJIg9FIWm7TUojU8yvPsfPGFYTEGEOGAse8AfHw4pl+w5SvxQUF8f2jB
+XsRY0MrDyb07xC8CAwEAATANBgkqhkiG9w0BAQsFAAOBgQAOEttx/p3xosIm/8sM
+kIaxR2c/fbYoMbBsX+geaiRu+xNOItbtQpGOhW6Ql981c3EwIjyd34KavplofZIr
+Slj4jHQFySZaJkegHY+LCAQz9GEg2TMke3MsPJ7nSZS7MUqB2AQt1tLuiXUuRh3V
+jF4yiqi6lGVmvPJf+y1GXk47KjGB5TCB4gIBATA8MDcxGTAXBgNVBAMTEHRlc3Qu
+ZXhhbXBsZS5jb20xGjAYBgNVBAoTEVRlc3QgT3JnYW5pemF0aW9uAgEBMA0GCWCG
+SAFlAwQCAQUAMA0GCSqGSIb3DQEBAQUABIGAMxSC81vzjSiZcJTcSicgCG9879mu
+p/bikqdHZPyF8UgABjikXXoVJ9IClFRd5/3wRf8ez+hwnxKR8j1vAsDI7U6dXJtr
+wp0aO7Ua6ecKhI5V0F8nUg5CjEK9FR8vNg0Il8U5AXDuan0iYKvguhWkiuJlvQlV
+X9ncPP4VRERPw8U=
+-----END PKCS7-----`;
+
+const originalData = 'This is the test content for PKCS7 signature.';
+
+try {
+    const p7 = forge.pkcs7.messageFromPem(mockP7Sign);
+    
+    console.log('=== PKCS7 信息 ===');
+    console.log('type:', p7.type);
+    console.log('content:', p7.content ? p7.content.getBytes() : 'null');
+    console.log('certificates count:', p7.certificates ? p7.certificates.length : 0);
+    
+    if (p7.certificates && p7.certificates.length > 0) {
+        const cert = p7.certificates[0];
+        console.log('cert subject:', cert.subject.attributes.map(a => `${a.name}=${a.value}`).join(', '));
+    }
+    
+    console.log('\n=== 尝试验证 ===');
+    try {
+        // 尝试验证
+        const result = p7.verify();
+        console.log('verify() result:', result);
+    } catch (e) {
+        console.log('verify() error:', e.message);
+    }
+    
+    // 手动验证
+    console.log('\n=== 手动验证 ===');
+    const md = forge.md.sha256.create();
+    md.update(originalData, 'utf8');
+    const digest = md.digest().getBytes();
+    console.log('calculated digest (hex):', forge.util.bytesToHex(digest));
+    
+    // 获取签名
+    if (p7.rawCapture && p7.rawCapture.signature) {
+        console.log('signature length:', p7.rawCapture.signature.length);
+        console.log('signature (hex):', forge.util.bytesToHex(p7.rawCapture.signature).substring(0, 100) + '...');
+    }
+    
+    // 获取公钥
+    if (p7.certificates && p7.certificates.length > 0) {
+        const publicKey = p7.certificates[0].publicKey;
+        if (publicKey) {
+            console.log('publicKey exists:', true);
+            // 尝试用公钥验证
+            try {
+                const verified = publicKey.verify(digest, p7.rawCapture.signature);
+                console.log('publicKey.verify() result:', verified);
+            } catch (e) {
+                console.log('publicKey.verify() error:', e.message);
+            }
+        }
+    }
+    
+} catch (error) {
+    console.error('Error:', error.message);
+    console.error(error.stack);
+}