解密证书验证签名哈希答案

【问题标题】：Decrypt certificate validate signature hash解密证书验证签名哈希
【发布时间】：2017-01-29 05:36:30
【问题描述】：

对象：https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/developing-an-alexa-skill-as-a-web-service?ref_=pe_679090_102923190#checking-the-signature-of-the-request

使用从签名证书中提取的公钥解密加密的签名以生成断言的哈希值。
从完整的 HTTPS 请求正文生成 SHA-1 哈希值以生成派生的哈希值（不确定这是否意味着整个 POST 或只是“请求”JSON）

签名示例：

FosqGd + Djx2PAXuER7msZwOsGok + BWZUXMj6LjEIDkhGp0yvmB / oB76C9Mu5fhL6ZH0AgZ862sZYArp2VZnANGy2fAzTyUa1dWL + uZuO4l9jAxq / 7Y30W9 + V1rStWF8LcYK48iaHdfsqPFm9otOWSLoIYhg9bo62rrCDBo9TeQOt8S63lrBTWc6csEQ0PRVsplkfnAb3edv46g0c7Mg4B3h + uQfq3 + RveoKVrUDAEfg1SN7HLWtjxPcLJ1pxOYa29zu56aqiF / 96G79gNyQMrUZ7wdnElWWA + lYgHNWAxCibKdzs7QiU1hgbLR + G45 + 33nHn + M2qgKjjGFcDtaMmPA == PRE>

签名证书链网址：https://s3.amazonaws.com/echo.api/echo-api-cert-4.pem

示例帖子 JSON：

{"session":{"sessionId":"SessionId.d6d80552-79bf-445a-9e88-5f845a368718","application":{"applicationId":"amzn1.ask.skill.29dff22d-929c-4c74-bbe2-e2a9c83316c5"},"attributes":{},"user":{"userId":"amzn1.ask.account."},"new":true},"request":{"type":"IntentRequest","requestId":"EdwRequestId.c4a78877-5328-4009-9c1c-f6b8783186a2","locale":"en-US","timestamp":"2017-01-29T03:35:40Z","intent":{"name":"GetMovie","slots":{"Keyword":{"name":"Keyword"},"Genre":{"name":"Genre"}}}},"version":"1.0"}

我完全不知道如何使用从签名证书中提取的公钥来解密加密的签名以生成断言的哈希值。 .GetPublicKey() 返回相当长的 System.Byte，但现在呢？

当前代码：

$cert = Get-PfxCertificate -FilePath $dlPath
# 5.- Base64-decode the Signature header value on the request to obtain the encrypted signature
$encryptedSignatureBytes = [System.Convert]::FromBase64String($Json.signature)

# 6.- Use the public key extracted from the signing certificate to decrypt the encrypted signature to produce the asserted hash value       
$publicKey = $cert.GetPublicKey() #returns long System.Byte
$assertedHash = $cert.PublicKey.Key.Decrypt($encryptedSignatureBytes, $false) #Exception calling "Decrypt" with "2" argument(s): "Key does not exist.
$assertedHash = $cert.PublicKey.Key.DecryptValue($encryptedSignatureBytes) #Exception calling "DecryptValue" with "1" argument(s): "Method is not supported."

# 7.- Generate a SHA-1 hash value from the full HTTPS request body to produce the derived hash value    
$requestBodySHA1 = $(Get-StringHash $Json.requestBody)

# 8.- Compare the asserted hash value and derived hash values to ensure that they match    
if ($assertedHash -eq $requestBodySHA1)
{
    #todo
}

【问题讨论】：

标签： powershell encryption hash

【解决方案1】：

一旦我了解了实际需求，这最终比预期的要容易。为了比较签名和亚马逊发布请求，我所要做的就是将请求作为 Byte[] 获取，签名已经是 Byte[] 从 Base64 转换，然后将其输入到函数 $cert.PublicKey.Key.VerifyData 如果我更改 Signature 或 Request 中的任何字节，则会失败。

# 7.- Generate a SHA-1 hash value from the full HTTPS request body to produce the derived hash value
$requestBodyBytes = [System.IO.File]::ReadAllBytes($req)
# 8.- Compare the asserted hash value and derived hash values to ensure that they match
$sha1Oid = [System.Security.Cryptography.CryptoConfig]::MapNameToOID('SHA1')
if(!($cert.PublicKey.Key.VerifyData($requestBodyBytes, $sha1Oid, $encryptedSignatureBytes)))
{
    $validErr += "`nFailed request hash comparison to signature."
}

【讨论】：