签名机制

为保证API的安全调用，平台会对每个请求和响应通过签名进行身份验证。

接入方与平台需使用签名算法SHA256withRSA，对请求待签字符串和响应待签字符串进行签名，签名结果采用Base64 编码，对应请求和响应的sign字段。

接入方会提前收到平台为您分配的2048位RSA平台公钥（Base64 编码格式），同时平台需要接入方提前提供2048位RSA商户公钥（Base64 编码格式）。

整个请求与响应流程涉及2对RSA密钥：属于平台的平台公钥与平台私钥，属于接入方的商户公钥与商户私钥。公钥用于验证签名，私钥用于生成签名。

请求待签字符串

将请求的bizContent字段json序列化。

重要：请使用未加密的bizContent内容进行签名

{"cardCurrencyCode":"USD","settlementCurrencyCode":"USD","activeDate":"2023-01-01","inactiveDate":"2024-01-01","cardLimit":1000,"supportedMccGroup":"ecom","cardProductCode":"C02","cardType":"GWTTP","cardLabel":"MasterCard","userReferenceMap":{"useRef1Txt":"anything"}}

接入方：对请求待签字符串先使用商户私钥生成签名，再进行Base64编码。结果作为请求中sign字段的值。

平台：对收到的请求头中sign字段的值先进行Base64解码，再使用商户公钥验证签名。

响应待签字符串

重要：请先将收到的bizContent字段内容进行解密

平台：对响应待签字符串先使用平台私钥生成签名，再进行Base64编码。结果作为响应中sign字段的值。

接入方：对收到的响应中sign字段的值先进行Base64解码，再使用平台公钥验证签名。

工具类示例

<?php

class RsaUtils {

    public static function rsaSign(string $privateKeyStr, string $content): string {
        openssl_sign($content, $signature, self::pemFormat($privateKeyStr, 'RSA PRIVATE KEY'), OPENSSL_ALGO_SHA256);
        return base64_encode($signature);
    }

    public static function rsaVerify(string $publicKeyStr, string $content, string $signature): bool {
        return openssl_verify($content, base64_decode($signature), self::pemFormat($publicKeyStr, 'PUBLIC KEY'), OPENSSL_ALGO_SHA256) === 1;
    }

    private static function pemFormat(string $keyStr, string $label): string {
        return "-----BEGIN {$label}-----\n" . chunk_split($keyStr, 64) . "-----END {$label}-----\n";
    }
}

import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Signature;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;

import static java.nio.charset.StandardCharsets.UTF_8;

public class RsaUtils {
    
    private static final Base64.Encoder ENCODER = Base64.getEncoder();
    private static final Base64.Decoder DECODER = Base64.getDecoder();

    public static String rsaSign(PrivateKey privateKey, String content) throws Exception {
        Signature signer = Signature.getInstance("SHA256withRSA");
        signer.initSign(privateKey);
        signer.update(content.getBytes(UTF_8));
        return new String(ENCODER.encode(signer.sign()), UTF_8);
    }

    public static boolean rsaVerify(PublicKey publicKey, String content, String signature) throws Exception {
        Signature signer = Signature.getInstance("SHA256withRSA");
        signer.initVerify(publicKey);
        signer.update(content.getBytes(UTF_8));
        return signer.verify(DECODER.decode(signature.getBytes(UTF_8)));
    }

    public static PrivateKey newRsaPrivateKey(String privateKeyStr) throws Exception {
        byte[] bytes = DECODER.decode(privateKeyStr.getBytes(UTF_8));
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        return keyFactory.generatePrivate(new PKCS8EncodedKeySpec(bytes));
    }

    public static PublicKey newRsaPublicKey(String publicKeyStr) throws Exception {
        byte[] bytes = DECODER.decode(publicKeyStr.getBytes(UTF_8));
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        return keyFactory.generatePublic(new X509EncodedKeySpec(bytes));
    }

    public static String toRsaPrivateKeyStr(PrivateKey privateKey) {
        return new String(ENCODER.encode(privateKey.getEncoded()), UTF_8);
    }

    public static String toRsaPublicKeyStr(PublicKey publicKey) {
        return new String(ENCODER.encode(publicKey.getEncoded()), UTF_8);
    }
}

Java 6用户可以考虑使用org.apache.commons.codec.binary.Base64类代替Java 8新增的java.util.Base64类

最后更新于2年前

import java.security.KeyFactory; import java.security.PrivateKey; import java.security.PublicKey; import java.security.Signature; import java.security.spec.PKCS8EncodedKeySpec; import java.security.spec.X509EncodedKeySpec; import java.util.Base64; import static java.nio.charset.StandardCharsets.UTF_8; public class RsaUtils { private static final Base64.Encoder ENCODER = Base64.getEncoder(); private static final Base64.Decoder DECODER = Base64.getDecoder(); public static String rsaSign(PrivateKey privateKey, String content) throws Exception { Signature signer = Signature.getInstance("SHA256withRSA"); signer.initSign(privateKey); signer.update(content.getBytes(UTF_8)); return new String(ENCODER.encode(signer.sign()), UTF_8); } public static boolean rsaVerify(PublicKey publicKey, String content, String signature) throws Exception { Signature signer = Signature.getInstance("SHA256withRSA"); signer.initVerify(publicKey); signer.update(content.getBytes(UTF_8)); return signer.verify(DECODER.decode(signature.getBytes(UTF_8))); } public static PrivateKey newRsaPrivateKey(String privateKeyStr) throws Exception { byte[] bytes = DECODER.decode(privateKeyStr.getBytes(UTF_8)); KeyFactory keyFactory = KeyFactory.getInstance("RSA"); return keyFactory.generatePrivate(new PKCS8EncodedKeySpec(bytes)); } public static PublicKey newRsaPublicKey(String publicKeyStr) throws Exception { byte[] bytes = DECODER.decode(publicKeyStr.getBytes(UTF_8)); KeyFactory keyFactory = KeyFactory.getInstance("RSA"); return keyFactory.generatePublic(new X509EncodedKeySpec(bytes)); } public static String toRsaPrivateKeyStr(PrivateKey privateKey) { return new String(ENCODER.encode(privateKey.getEncoded()), UTF_8); } public static String toRsaPublicKeyStr(PublicKey publicKey) { return new String(ENCODER.encode(publicKey.getEncoded()), UTF_8); } }

hashtag请求待签字符串

hashtag响应待签字符串

hashtag工具类示例

请求待签字符串

响应待签字符串

工具类示例