如何使用Cordova在IOS和Android中生成KeyPair？

Question

I am creating a banking app using angularjs1 and ionic1 for IOS and Android. Due to some security concerns from clients the device should generate public and private key using SHA/RSA. I don't want to use any javascript plugin, strictly denied by the client. I digged a lot, OpenSSL and LetsEncrypt are the only options left as far as I know. Both the websites discuss manual command prompt key generation on an operating system. I want a mechanism where I can:

1. Generate keypair on the device.
2. Generate Json Web Key(JWK).
3. Sign/Hash the data using private key. Below is a reference in .net/Java(I want this in cordova)

signature = RSA256SignData(ASCIIBytes(data to be signed), rsaPrivateKey)

Encoded Signature = Base64Encode(signature)

I couldn't find any cordova plugin which can handle this. If there is no cordova plugin I'll be glad if anyone can tell me to do this in pieces or anything which is native.

Thanks.

Answer 1

I do not know of a Cordova plugin that can accomplish these tasks.

There are some excellent javascript libraries that do provide these functions. Have a look at node-jose which allows you to work with JWK, JWE and JWS. The library depends on (a slightly altered version of) node-forge which can do almost anything, including generating a keypair and signing/hashing data.

The only drawback of using these libraries is that the speed may not be sufficient for the mobile devices you need to support. My personal experience is that mobile devices are perfectly capable of working with 1024-bit keypairs. Working with 2048-bits is somewhat slow and generating a 2048-bit pair simply takes too long on most devices.