使用 PHP 和 gree/jose 库验证来自签名的 webhook

Question

. Answers to this question are eligible for a +250 reputation bounty. mickmackusa wants to to this question:

I am seeking a clean, working script that uses the values provided by the 3rd party to correctly verify the payload using the signature string. Ideally, I'd like to use the gree/jose library that I currently have and merely adjust my snippet. That said, I am not completely opposed to using a different php library to complete this task or no library at all.

I'm trying to follow the 3rd party documentation for verifying a webhook body using the Signature header -- the 3rd party will be referred to as 3P going forward).

3P offered a sample Kotlin implementation using a java library . I am using PHP and decided to try gree/jose as my library.

As a sanity check, I've copied their sample data into my implementation, but I am still getting a false outcome.

$signature = '1IJl6VyKU4pYfqMHUd55QBNq5Etbz5a7DOCkID2Nloay76y4f02w2iMXONlyL/Bx9SkrbivOHW1l1XadkUrd5pKUK1fhpcnItukLrsK5ADQOcuEjSLBg9qJffZYooXfc7hOD/fV0sN33W2vBYJspbR3P766DwG/6IO/20f9t/DcSWa79EFZPMnsCicEArNS3iIYBtdZSX5ta5EETt7S8acHbpIlSDrTcYpo0vuz19LQ6SPQqN2LGdR+U7ZOiUQWdfMXhUgE7w94pHQzcOq1IHfw3CylUEcRR/DhrGqs4mBaagO6JpWzeqE1uTAiN579kOtSSqjblTb2AXALTQ3+TtA==';  // taken from "Signature" in headers
$payload = '{"eventId":"569886904","officeId":"132917981","eventType":"INTEGRATION_DEACTIVATED","event":{"integration":{"status":"INACTIVE","webhookId":"2bc47eed-08a0-4d18-a5c0-b7f18ab802e3","officeId":"132917981","createdDateTime":"2020-03-17T23:39:41.804Z","lastUpdatedDateTime":"2020-03-17T23:39:41.804Z"}},"createdDateTime":"2020-03-17T23:39:41.806Z"}';  // this is the body of the request sent to my application
$components = [
    'kty' => 'RSA',
    'e' => 'AQAB',
    'n' => 'ANV-aocctqt5xDRnqomCgsO9dm4hM0Qd75TqG7z2G5Z89JQ7SRy2ok-fIJRiSU5-JfjPc3uph3gSOXyqlNoEh4YGL2R4AP7jhxy9xv0gDVtj1tExB_mmk8EUbmj8hTIrfAgEJrDeB4qMk7MkkKxhHkhLNEJEPZfgYHcHcuKjp2l_vtpiuR9Ouz0febB9K4gLozrp9KHW2K-m0z02-tSurxmmij5nnJ-CEgp0wXcCS4w4G0jve4hcLlL9FU8HKxrb0d4rMQgM3VAal6yG5pwMdtrsch7xA-occwWFC_tHgpDJGNvOJNFtuk7Cit_aom-6U6ssGF13sUtdrog2ePWjVxc=',
    'kid' => '2020-03-18',
    'alg' => 'RSA256',
];  // the $components array values are sourced by a separate API call to the 3P
$rsa = JOSE_JWK::decode($components); // => phpseclib\Crypt\RSA instance
$publicKey = $rsa->createKey()['publickey'];  // this appears to work perfectly
$rsa->loadKey($publicKey);
var_dump($rsa->verify($payload, $rsa->sign($signature)));  // bool(false)

I've been floundering with this piece of software for over 2 days now and I feel like I've tried ~100 different things ( some proof ). I've even tried partially abandoning the gree/jose library. Ultimately, I just need a working solution (regardless of if it is repairing this implementation or entertaining a different implementation/library).

I feel like I am probably missing a step (or two) in preparing my strings prior to calling verify() , but I am too unfamiliar with this process to identify it myself. Of course, verify() doesn't indicate if I'm getting hotter or colder .

Places I've been:

• How to convert C# RSA to php?
• RSA signature verification in php not working when signed from c# code
• https://hotexamples.com/examples/-/-/openssl_verify/php-openssl_verify-function-examples.html
• https://www.php.net/manual/en/function.openssl-verify.php
• https://en.wikipedia.org/wiki/RSA_(cryptosystem)
• Signing JSON objects
• https://tools.ietf.org/id/draft-ietf-jose-json-web-signature-09.html
• https://hotexamples.com/examples/phpseclib.crypt/RSA/verify/php-rsa-verify-method-examples.html
• https://github.com/nov/jose-php

Answer 1

RS256 in Java means RSASSA-PKCS1-v1_5 using SHA-256

$signature = '1IJl6VyKU4pYfqMHUd55QBNq5Etbz5a7DOCkID2Nloay76y4f02w2iMXONlyL/Bx9SkrbivOHW1l1XadkUrd5pKUK1fhpcnItukLrsK5ADQOcuEjSLBg9qJffZYooXfc7hOD/fV0sN33W2vBYJspbR3P766DwG/6IO/20f9t/DcSWa79EFZPMnsCicEArNS3iIYBtdZSX5ta5EETt7S8acHbpIlSDrTcYpo0vuz19LQ6SPQqN2LGdR+U7ZOiUQWdfMXhUgE7w94pHQzcOq1IHfw3CylUEcRR/DhrGqs4mBaagO6JpWzeqE1uTAiN579kOtSSqjblTb2AXALTQ3+TtA==';  // taken from "Signature" in headers
$payload = '{"eventId":"569886904","officeId":"132917981","eventType":"INTEGRATION_DEACTIVATED","event":{"integration":{"status":"INACTIVE","webhookId":"2bc47eed-08a0-4d18-a5c0-b7f18ab802e3","officeId":"132917981","createdDateTime":"2020-03-17T23:39:41.804Z","lastUpdatedDateTime":"2020-03-17T23:39:41.804Z"}},"createdDateTime":"2020-03-17T23:39:41.806Z"}';  // this is the body of the request sent to my application
$components = [
    'kty' => 'RSA',
    'e' => 'AQAB',
    'n' => 'ANV-aocctqt5xDRnqomCgsO9dm4hM0Qd75TqG7z2G5Z89JQ7SRy2ok-fIJRiSU5-JfjPc3uph3gSOXyqlNoEh4YGL2R4AP7jhxy9xv0gDVtj1tExB_mmk8EUbmj8hTIrfAgEJrDeB4qMk7MkkKxhHkhLNEJEPZfgYHcHcuKjp2l_vtpiuR9Ouz0febB9K4gLozrp9KHW2K-m0z02-tSurxmmij5nnJ-CEgp0wXcCS4w4G0jve4hcLlL9FU8HKxrb0d4rMQgM3VAal6yG5pwMdtrsch7xA-occwWFC_tHgpDJGNvOJNFtuk7Cit_aom-6U6ssGF13sUtdrog2ePWjVxc=',
    'kid' => '2020-03-18',
    'alg' => 'RSA256',
];  // the $components array values are sourced by a separate API call to the 3P
$rsa = JOSE_JWK::decode($components); // => phpseclib\Crypt\RSA instance
$rsa->setHash('sha256');
var_dump($rsa->_rsassa_pkcs1_v1_5_verify($payload, JOSE_URLSafeBase64::decode($signature)));