將 base-64 spki 字符串轉換為公鑰

Question

我正在嘗試找到與此 js function 等效的 python：

/**
* Generating the shared secret with the merchant private key and the ephemeral public key(part of the payment token data)
* using Elliptic Curve Diffie-Hellman (id-ecDH 1.3.132.1.12).
* As the Apple Pay certificate is issued using prime256v1 encryption, create elliptic curve key instances using the package - https://www.npmjs.com/package/ec-key
*/
sharedSecret (privatePem) {
    const prv = new ECKey(privatePem, 'pem') // Create a new ECkey instance from PEM formatted string
    const publicEc = new ECKey(this.ephemeralPublicKey, 'spki') // Create a new ECKey instance from a base-64 spki string
    return prv.computeSecret(publicEc).toString('hex') // Compute secret using private key for provided ephemeral public key
  }

我嘗試轉換的公鑰：（應該是 base-64 spki 字符串？）

MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYtpZKqPDqavs4KzNnMoxWdIThKe/ErKMI/l34Y9/xVkt4DU4BrCaQnGLlRGx+Pn/WHPkQg3BYoRH4xUWswNhEA==

我設法做的事情：

from cryptography.hazmat.primitives.asymmetric.ec import SECP256R1, EllipticCurvePublicKey, ECDH
from cryptography.hazmat.primitives.serialization import load_pem_private_key

def __compute_shared_secret(ephemeral_public_key: str) -> bytes:
    curve = SECP256R1()
    key = base64.b64decode(ephemeral_public_key)
    public_key = EllipticCurvePublicKey.from_encoded_point(curve, key)  # problem here
    server_private_key = load_pem_private_key(<private_key>, password=None)
    shared_secret = server_private_key.exchange(ECDH(), public_key)
    return shared_secret

ValueError: Unsupported elliptic curve point type

據我了解，在 EllipticCurvePublicKey 中使用它之前，我需要將公鑰轉換為某種東西，但我不知道我應該做哪種類型的轉換。

Answer 1

根據 JavaScript 庫的文檔，該行

const publicEc = new ECKey(this.ephemeralPublicKey, 'spki')

導入 Base64 編碼的 X.509/SPKI DER 密鑰。

---

在 Python 中，這可以通過 Cryptography 庫的load_der_public_key()來完成，如下所示：

from cryptography.hazmat.primitives.serialization import load_der_public_key
import base64
...
public_key = load_der_public_key(base64.b64decode(ephemeral_public_key))

在這里， ephemeral_public_key是 Base64 編碼的 X.509/SPKI DER 密鑰。

通過 Python 代碼的這種更改，可以確定共享密鑰。