Nodejs 加密到 Python jwt 轉換

Question

我正在與網關進行集成，他們為我提供了一種創建某些有效負載簽名的機制，我正在嘗試將此 Nodejs 代碼轉換為 python

這是我們要簽名的有效載荷：

actual = {"IntraTransferRqHeader": {"CorporateID": "XXX", "CorpReferenceNumber": "47165454456"},
                            "IntraTransferRqBody": {"AccountNumber": "05100004061100",
                                                    "DebitCurrency": "SAR", "BeneficiaryAccountNumber": "30008776337526",
                                                    "TransferAmount": "100.23",
                                                    "TransferCurrency": "SAR",
                                                    "Description": "Transfer fund to beneficiary", "AMLPurposeCode": "BC"}};

這是Nodejs提供的代碼

const cert = fs.readFileSync('/etc/ssl/nginx/snbcsr.key', "utf8");

var privateKey = crypto.createPrivateKey({
    'key': cert,
    'format': 'pem',
});
var signerObject = crypto.createSign("RSA-SHA256");
signerObject.update(JSON.stringify(actual).trim());
var signature = signerObject.sign({ key: privateKey }, "base64");

這是我為制作相同的簽名所做的

private_key_pem = "/etc/ssl/nginx/snbcsr.key"
with open(private_key_pem, "rb") as key_file:
   private_key = serialization.load_pem_private_key(key_file.read(), password=None, backend=default_backend())
signature = jwt.encode(actual, private_key, algorithm="RS256")

我仍然收到簽名錯誤。 我不知道Nodejs，我不知道我在這里做錯了什么

Answer 1

您不應將 JWT 與普通簽名混淆。

給定 Node.js 代碼

const fs = require('fs');
const crypto = require('crypto');
const cert = fs.readFileSync('key.pem', 'utf8');
var privateKey = crypto.createPrivateKey({
  'key': cert,
  'format': 'pem',
});
const payload = 'foople';
const signerObject = crypto.createSign('RSA-SHA256');
signerObject.update(payload);
const signature = signerObject.sign({key: privateKey}, 'base64');
console.log(signature);

使用cryptography庫的簽名原語的等效 Python 代碼是

import base64

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric.padding import PKCS1v15
from cryptography.hazmat.primitives.hashes import SHA256
from cryptography.hazmat.primitives.serialization import load_pem_private_key

bk = default_backend()

with open("./key.pem", "rb") as key_file:
    private_key = load_pem_private_key(key_file.read(), password=None, backend=bk)

payload = b'foople'
signature = base64.b64encode(private_key.sign(
    payload,
    padding=PKCS1v15(),
    algorithm=SHA256(),
)).decode()

鑒於我新生成的模擬 512 位 RSA 密鑰

-----BEGIN RSA PRIVATE KEY-----
MIIBPAIBAAJBAMd6HFNMreA1zwFpTA7vGFwSJFFZlKYtgJVsnSW3rc9zsisewUIC
U0MnvNucHeKifhniFOoimUr8hTiZMywEmFMCAwEAAQJBAJKYX+arzICgqr+rxZSY
C/vl7UDHp6G0gPHPP3HvmdGBNLst0mqV8GKbNEr1Myb7vQOjbYDno2OVFNL+jeMI
JYkCIQD2r+1dvpSDrSvelBIyymE1D42dQFviyoY8URCefRzJhQIhAM8B7VbcYNo1
Tm0BLCKIPO1CZKmPsYDb2byk8mtakVX3AiEAiDBF9iwh57Qx9PaAOYQbOGT2xKrk
T4eJpkEG0Mi3nNUCIQC6bdPf3E1ld4iP5vRmjSfBzX92rbCAin8Hw82HHWOydQIg
fLfsV/P5F0LseV5KRPVombYNc/bh4oU467kEEPXDX5w=
-----END RSA PRIVATE KEY-----

兩個程序 output

Wvy7cxuaUIpuiadTH2iOm6ayZUNrKY1whZElBIGBWbglEf0yA07wGbhD0qsPTWY7PzMtvuPV2xre+pCQsMwxmw==