rsa p7 验签通过
This commit is contained in:
parent
5a033318c0
commit
9d826fb985
@ -46,6 +46,12 @@ module.exports.getInfoFromPKCS7 = function (p7sign) {
|
||||
// 解析 PKCS7 数据
|
||||
const p7 = forge.pkcs7.messageFromPem(pemData)
|
||||
|
||||
// 辅助函数：将属性数组转换为 DN 字符串
|
||||
function attrsToDN(attrs) {
|
||||
if (!attrs || attrs.length === 0) return ''
|
||||
return attrs.map(attr => `${attr.name}=${attr.value}`).join(', ')
|
||||
}
|
||||
|
||||
// 提取证书
|
||||
let cert = null
|
||||
if (p7.certificates && p7.certificates.length > 0) {
|
||||
@ -55,10 +61,12 @@ module.exports.getInfoFromPKCS7 = function (p7sign) {
|
||||
name: attr.name,
|
||||
value: attr.value
|
||||
})),
|
||||
subjectDN: attrsToDN(certObj.subject.attributes),
|
||||
issuer: certObj.issuer.attributes.map(attr => ({
|
||||
name: attr.name,
|
||||
value: attr.value
|
||||
})),
|
||||
issuerDN: attrsToDN(certObj.issuer.attributes),
|
||||
serialNumber: certObj.serialNumber,
|
||||
notBefore: certObj.validity.notBefore,
|
||||
notAfter: certObj.validity.notAfter,
|
||||
@ -66,13 +74,18 @@ module.exports.getInfoFromPKCS7 = function (p7sign) {
|
||||
}
|
||||
}
|
||||
|
||||
// 提取公钥 - 从证书中提取公钥对象并转换为 PEM
|
||||
// 提取公钥 - 从证书中提取公钥对象并转换为 PEM 和 Hex
|
||||
let publicKey = null
|
||||
let publicKeyHex = null
|
||||
if (p7.certificates && p7.certificates.length > 0) {
|
||||
const certObj = p7.certificates[0]
|
||||
// 提取公钥对象并转换为 PEM 格式
|
||||
if (certObj.publicKey) {
|
||||
publicKey = forge.pki.publicKeyToPem(certObj.publicKey)
|
||||
// 将公钥转换为 hex 格式
|
||||
const publicKeyAsn1 = forge.pki.publicKeyToAsn1(certObj.publicKey)
|
||||
const publicKeyDer = forge.asn1.toDer(publicKeyAsn1)
|
||||
publicKeyHex = forge.util.bytesToHex(publicKeyDer.getBytes())
|
||||
}
|
||||
}
|
||||
|
||||
@ -89,6 +102,7 @@ module.exports.getInfoFromPKCS7 = function (p7sign) {
|
||||
return {
|
||||
cert,
|
||||
publicKey,
|
||||
publicKeyHex,
|
||||
signature,
|
||||
signatureHex
|
||||
}
|
||||
@ -143,7 +157,21 @@ module.exports.verifyPKCS7 = function (p7sign, originalData) {
|
||||
|
||||
// 验证签名
|
||||
try {
|
||||
// 尝试使用 node-forge 验证（适用于 RSA）
|
||||
// 对于 RSA 签名，使用公钥手动验证
|
||||
if (p7.certificates && p7.certificates.length > 0) {
|
||||
const publicKey = p7.certificates[0].publicKey
|
||||
if (publicKey && p7.rawCapture && p7.rawCapture.signature) {
|
||||
// 计算数据的摘要
|
||||
const md = forge.md.sha256.create()
|
||||
md.update(verifyData.toString(), 'utf8')
|
||||
const digest = md.digest().getBytes()
|
||||
|
||||
// 使用公钥验证签名
|
||||
return publicKey.verify(digest, p7.rawCapture.signature)
|
||||
}
|
||||
}
|
||||
|
||||
// 如果 RSA 验证失败或不适用，尝试使用 node-forge 的 verify（如果支持）
|
||||
return p7.verify()
|
||||
} catch (error) {
|
||||
// 如果验证失败，尝试使用 SM2 验证
|
||||
@ -164,55 +192,3 @@ module.exports.verifyPKCS7 = function (p7sign, originalData) {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* PKCS7 签名（自动判断 RSA 或 SM2 算法）
|
||||
* @param {Buffer|string} data - 待签名数据
|
||||
* @param {string} privateKey - 私钥
|
||||
* @returns {Buffer} PKCS7 签名数据
|
||||
*/
|
||||
module.exports.pkcs7Sign = function (data, privateKey) {
|
||||
// 处理输入数据
|
||||
let inputData
|
||||
if (Buffer.isBuffer(data)) {
|
||||
inputData = data
|
||||
} else if (typeof data === 'string') {
|
||||
inputData = Buffer.from(data)
|
||||
} else {
|
||||
throw new Error('Invalid input type for data')
|
||||
}
|
||||
|
||||
// 判断私钥类型
|
||||
if (privateKey.includes('RSA PRIVATE KEY')) {
|
||||
// RSA 算法签名
|
||||
const pkey = forge.pki.privateKeyFromPem(privateKey)
|
||||
const p7 = forge.pkcs7.createSignedData()
|
||||
p7.content = forge.util.createBuffer(inputData.toString('binary'))
|
||||
p7.addCertificate(forge.pki.certificateFromPem(privateKey)) // 假设私钥包含证书
|
||||
p7.addSigner({
|
||||
key: pkey,
|
||||
certificate: forge.pki.certificateFromPem(privateKey),
|
||||
digestAlgorithm: forge.pki.oids.sha256
|
||||
})
|
||||
p7.sign()
|
||||
const pem = forge.pkcs7.messageToPem(p7)
|
||||
return Buffer.from(pem, 'ascii')
|
||||
} else if (privateKey.includes('SM2') || privateKey.length === 64) {
|
||||
// SM2 算法签名
|
||||
// 由于 node-forge 不直接支持 SM2 算法
|
||||
// 这里需要使用 sm-crypto 库进行 SM2 签名，然后封装到 PKCS7 格式中
|
||||
// 注意：这只是一个简化的实现，实际应用中可能需要更复杂的处理
|
||||
const hash = sm3(inputData.toString())
|
||||
const signature = sm2.doSignature(hash, privateKey)
|
||||
|
||||
// 创建一个简单的 PKCS7 结构来存储 SM2 签名
|
||||
// 注意：这不是标准的 PKCS7 SM2 签名实现
|
||||
const p7 = forge.pkcs7.createSignedData()
|
||||
p7.content = forge.util.createBuffer(inputData.toString('binary'))
|
||||
// 这里需要添加 SM2 证书和签名逻辑
|
||||
// 由于复杂性，这里暂时抛出错误
|
||||
throw new Error('SM2 PKCS7 signature not fully implemented yet')
|
||||
} else {
|
||||
throw new Error('Unsupported private key type')
|
||||
}
|
||||
}
|
||||
@ -32,16 +32,10 @@ X9ncPP4VRERPw8U=
|
||||
|
||||
const result = crypto.getInfoFromPKCS7(mockP7Sign);
|
||||
|
||||
// 将 subject 和 issuer 转换为 DN 格式
|
||||
function toDN(attrs) {
|
||||
if (!attrs) return '';
|
||||
return attrs.map(attr => `${attr.name}=${attr.value}`).join(', ');
|
||||
}
|
||||
|
||||
console.log('测试结果:');
|
||||
console.log(' cert:');
|
||||
console.log(' subject:', toDN(result.cert?.subject));
|
||||
console.log(' issuer:', toDN(result.cert?.issuer));
|
||||
console.log(' subject:', result.cert?.subjectDN);
|
||||
console.log(' issuer:', result.cert?.issuerDN);
|
||||
console.log(' serialNumber:', result.cert?.serialNumber);
|
||||
console.log(' notBefore:', result.cert?.notBefore);
|
||||
console.log(' notAfter:', result.cert?.notAfter);
|
||||
@ -49,6 +43,8 @@ X9ncPP4VRERPw8U=
|
||||
console.log(result.cert?.pem);
|
||||
console.log(' publicKey:');
|
||||
console.log(result.publicKey);
|
||||
console.log(' publicKey (hex):');
|
||||
console.log(result.publicKeyHex);
|
||||
console.log(' signature (hex):');
|
||||
console.log(result.signatureHex);
|
||||
console.log('✓ getInfoFromPKCS7 接口（RSA）测试通过');
|
||||
@ -73,15 +69,35 @@ try {
|
||||
// 测试 3: verifyPKCS7 接口（RSA）
|
||||
try {
|
||||
console.log('\n3. 测试 verifyPKCS7 接口（RSA）');
|
||||
// 这里应该使用实际的 PKCS7 签名数据和原始数据进行测试
|
||||
// 由于没有实际数据，这里使用模拟数据
|
||||
const mockP7Sign = 'MIICdwYJKoZIhvcNAQcCoIICZzCCAm8CAQExADALBgkqhkiG9w0BBwGgggLsMIIC3wIBADCCAbkGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM9Q7c7X7X7X7X7X7X7X7X7AgEQgIID+DCCA+SgAwIBAgIUY1234567890abcdefghijklmnopqrstuvwxyzMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFI1234567890abcdefghijklmnopqrstuvwxyzMB8GA1UdIwQYMBaAFJ1234567890abcdefghijklmnopqrstuvwxyzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAj1234567890abcdefghijklmnopqrstuvwxyz';
|
||||
const mockOriginalData = 'test data';
|
||||
// 使用真实的 PKCS7 签名数据和原始数据进行测试
|
||||
const mockP7Sign = `-----BEGIN PKCS7-----
|
||||
MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExDzANBglghkgBZQMEAgEFADA8Bgkq
|
||||
hkiG9w0BBwGgLwQtVGhpcyBpcyB0aGUgdGVzdCBjb250ZW50IGZvciBQS0NTNyBz
|
||||
aWduYXR1cmUuoIIB5jCCAeIwggFLoAMCAQICAQEwDQYJKoZIhvcNAQELBQAwNzEZ
|
||||
MBcGA1UEAxMQdGVzdC5leGFtcGxlLmNvbTEaMBgGA1UEChMRVGVzdCBPcmdhbml6
|
||||
YXRpb24wHhcNMjYwNDA0MDAxMDIyWhcNMjcwNDA0MDAxMDIyWjA3MRkwFwYDVQQD
|
||||
ExB0ZXN0LmV4YW1wbGUuY29tMRowGAYDVQQKExFUZXN0IE9yZ2FuaXphdGlvbjCB
|
||||
nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1e+05xb8T3Lo2v9MZQen5HYffpnc
|
||||
yY9mnT/ygvfxZNM9TeYkq4fACiuS99FONnlHFQdlXEPJluIk1NBFUoLpehAbzOSY
|
||||
Fu0WEjBOVJIg9FIWm7TUojU8yvPsfPGFYTEGEOGAse8AfHw4pl+w5SvxQUF8f2jB
|
||||
XsRY0MrDyb07xC8CAwEAATANBgkqhkiG9w0BAQsFAAOBgQAOEttx/p3xosIm/8sM
|
||||
kIaxR2c/fbYoMbBsX+geaiRu+xNOItbtQpGOhW6Ql981c3EwIjyd34KavplofZIr
|
||||
Slj4jHQFySZaJkegHY+LCAQz9GEg2TMke3MsPJ7nSZS7MUqB2AQt1tLuiXUuRh3V
|
||||
jF4yiqi6lGVmvPJf+y1GXk47KjGB5TCB4gIBATA8MDcxGTAXBgNVBAMTEHRlc3Qu
|
||||
ZXhhbXBsZS5jb20xGjAYBgNVBAoTEVRlc3QgT3JnYW5pemF0aW9uAgEBMA0GCWCG
|
||||
SAFlAwQCAQUAMA0GCSqGSIb3DQEBAQUABIGAMxSC81vzjSiZcJTcSicgCG9879mu
|
||||
p/bikqdHZPyF8UgABjikXXoVJ9IClFRd5/3wRf8ez+hwnxKR8j1vAsDI7U6dXJtr
|
||||
wp0aO7Ua6ecKhI5V0F8nUg5CjEK9FR8vNg0Il8U5AXDuan0iYKvguhWkiuJlvQlV
|
||||
X9ncPP4VRERPw8U=
|
||||
-----END PKCS7-----`;
|
||||
// 这是生成签名时使用的原始数据
|
||||
const mockOriginalData = 'This is the test content for PKCS7 signature.';
|
||||
const result = crypto.verifyPKCS7(mockP7Sign, mockOriginalData);
|
||||
console.log('测试结果:', result);
|
||||
console.log('✓ verifyPKCS7 接口（RSA）测试通过');
|
||||
} catch (error) {
|
||||
console.error('✗ verifyPKCS7 接口（RSA）测试失败:', error.message);
|
||||
console.error(error.stack);
|
||||
}
|
||||
|
||||
// 测试 4: verifyPKCS7 接口（SM2）
|
||||
@ -98,32 +114,4 @@ try {
|
||||
console.error('✗ verifyPKCS7 接口（SM2）测试失败:', error.message);
|
||||
}
|
||||
|
||||
// 测试 5: pkcs7Sign 接口（RSA）
|
||||
try {
|
||||
console.log('\n5. 测试 pkcs7Sign 接口（RSA）');
|
||||
// 这里应该使用实际的私钥进行测试
|
||||
// 由于没有实际数据，这里使用模拟数据
|
||||
const mockData = 'test data';
|
||||
const mockPrivateKey = '-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz-----END RSA PRIVATE KEY-----';
|
||||
const result = crypto.pkcs7Sign(mockData, mockPrivateKey);
|
||||
console.log('测试结果:', result.toString('base64'));
|
||||
console.log('✓ pkcs7Sign 接口（RSA）测试通过');
|
||||
} catch (error) {
|
||||
console.error('✗ pkcs7Sign 接口（RSA）测试失败:', error.message);
|
||||
}
|
||||
|
||||
// 测试 6: pkcs7Sign 接口（SM2）
|
||||
try {
|
||||
console.log('\n6. 测试 pkcs7Sign 接口（SM2）');
|
||||
// 这里应该使用实际的私钥进行测试
|
||||
// 由于没有实际数据，这里使用模拟数据
|
||||
const mockData = 'test data';
|
||||
const mockPrivateKey = '1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdef';
|
||||
const result = crypto.pkcs7Sign(mockData, mockPrivateKey);
|
||||
console.log('测试结果:', result.toString('base64'));
|
||||
console.log('✓ pkcs7Sign 接口（SM2）测试通过');
|
||||
} catch (error) {
|
||||
console.error('✗ pkcs7Sign 接口（SM2）测试失败:', error.message);
|
||||
}
|
||||
|
||||
console.log('\n=== 测试完成 ===');
|
||||
|
||||
79
kit/test/debug_verify.js
Normal file
79
kit/test/debug_verify.js
Normal file
@ -0,0 +1,79 @@
|
||||
const forge = require('node-forge');
|
||||
|
||||
const mockP7Sign = `-----BEGIN PKCS7-----
|
||||
MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExDzANBglghkgBZQMEAgEFADA8Bgkq
|
||||
hkiG9w0BBwGgLwQtVGhpcyBpcyB0aGUgdGVzdCBjb250ZW50IGZvciBQS0NTNyBz
|
||||
aWduYXR1cmUuoIIB5jCCAeIwggFLoAMCAQICAQEwDQYJKoZIhvcNAQELBQAwNzEZ
|
||||
MBcGA1UEAxMQdGVzdC5leGFtcGxlLmNvbTEaMBgGA1UEChMRVGVzdCBPcmdhbml6
|
||||
YXRpb24wHhcNMjYwNDA0MDAxMDIyWhcNMjcwNDA0MDAxMDIyWjA3MRkwFwYDVQQD
|
||||
ExB0ZXN0LmV4YW1wbGUuY29tMRowGAYDVQQKExFUZXN0IE9yZ2FuaXphdGlvbjCB
|
||||
nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1e+05xb8T3Lo2v9MZQen5HYffpnc
|
||||
yY9mnT/ygvfxZNM9TeYkq4fACiuS99FONnlHFQdlXEPJluIk1NBFUoLpehAbzOSY
|
||||
Fu0WEjBOVJIg9FIWm7TUojU8yvPsfPGFYTEGEOGAse8AfHw4pl+w5SvxQUF8f2jB
|
||||
XsRY0MrDyb07xC8CAwEAATANBgkqhkiG9w0BAQsFAAOBgQAOEttx/p3xosIm/8sM
|
||||
kIaxR2c/fbYoMbBsX+geaiRu+xNOItbtQpGOhW6Ql981c3EwIjyd34KavplofZIr
|
||||
Slj4jHQFySZaJkegHY+LCAQz9GEg2TMke3MsPJ7nSZS7MUqB2AQt1tLuiXUuRh3V
|
||||
jF4yiqi6lGVmvPJf+y1GXk47KjGB5TCB4gIBATA8MDcxGTAXBgNVBAMTEHRlc3Qu
|
||||
ZXhhbXBsZS5jb20xGjAYBgNVBAoTEVRlc3QgT3JnYW5pemF0aW9uAgEBMA0GCWCG
|
||||
SAFlAwQCAQUAMA0GCSqGSIb3DQEBAQUABIGAMxSC81vzjSiZcJTcSicgCG9879mu
|
||||
p/bikqdHZPyF8UgABjikXXoVJ9IClFRd5/3wRf8ez+hwnxKR8j1vAsDI7U6dXJtr
|
||||
wp0aO7Ua6ecKhI5V0F8nUg5CjEK9FR8vNg0Il8U5AXDuan0iYKvguhWkiuJlvQlV
|
||||
X9ncPP4VRERPw8U=
|
||||
-----END PKCS7-----`;
|
||||
|
||||
const originalData = 'This is the test content for PKCS7 signature.';
|
||||
|
||||
try {
|
||||
const p7 = forge.pkcs7.messageFromPem(mockP7Sign);
|
||||
|
||||
console.log('=== PKCS7 信息 ===');
|
||||
console.log('type:', p7.type);
|
||||
console.log('content:', p7.content ? p7.content.getBytes() : 'null');
|
||||
console.log('certificates count:', p7.certificates ? p7.certificates.length : 0);
|
||||
|
||||
if (p7.certificates && p7.certificates.length > 0) {
|
||||
const cert = p7.certificates[0];
|
||||
console.log('cert subject:', cert.subject.attributes.map(a => `${a.name}=${a.value}`).join(', '));
|
||||
}
|
||||
|
||||
console.log('\n=== 尝试验证 ===');
|
||||
try {
|
||||
// 尝试验证
|
||||
const result = p7.verify();
|
||||
console.log('verify() result:', result);
|
||||
} catch (e) {
|
||||
console.log('verify() error:', e.message);
|
||||
}
|
||||
|
||||
// 手动验证
|
||||
console.log('\n=== 手动验证 ===');
|
||||
const md = forge.md.sha256.create();
|
||||
md.update(originalData, 'utf8');
|
||||
const digest = md.digest().getBytes();
|
||||
console.log('calculated digest (hex):', forge.util.bytesToHex(digest));
|
||||
|
||||
// 获取签名
|
||||
if (p7.rawCapture && p7.rawCapture.signature) {
|
||||
console.log('signature length:', p7.rawCapture.signature.length);
|
||||
console.log('signature (hex):', forge.util.bytesToHex(p7.rawCapture.signature).substring(0, 100) + '...');
|
||||
}
|
||||
|
||||
// 获取公钥
|
||||
if (p7.certificates && p7.certificates.length > 0) {
|
||||
const publicKey = p7.certificates[0].publicKey;
|
||||
if (publicKey) {
|
||||
console.log('publicKey exists:', true);
|
||||
// 尝试用公钥验证
|
||||
try {
|
||||
const verified = publicKey.verify(digest, p7.rawCapture.signature);
|
||||
console.log('publicKey.verify() result:', verified);
|
||||
} catch (e) {
|
||||
console.log('publicKey.verify() error:', e.message);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
} catch (error) {
|
||||
console.error('Error:', error.message);
|
||||
console.error(error.stack);
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user