[ChtICToken.js] func sign 進行數位簽章 | 自然人憑證開發筆記

ChtICToken.js 中透過 sign 做數位簽章#

ChtICToken.js 版本：R1.0.0.57

sign(B64ToBeSign, UserPIN, HashAlg, RevFun, PKCSSignType, keyidb64, nonce, withSigningTime, withCardSN, checkValidity)#

sign 用於簽章，背後是呼叫API http://127.0.0.1:61161/sign，先了解前篇關於 /sign 的說明。接著來說明參數：

B64ToBeSign 必填
原文的 Base64
▶ 備註：等同 /sign 的 tbs 欄位，tbsEncoding 固定為 base64
UserPIN 必填
憑證卡 PIN 碼
▶ 備註：等同 /sign 的 pin 欄位
HashAlg 必填
Hash 演算法
▶ 選項：SHA1、SHA256
▶ 備註：等同 /sign 的 hashAlgorithm 欄位
RevFun 必填
Callback Function
PKCSSignType 選填 簽章標準
▶ 預設：PKCS1
▶ 選項：PKCS1、PKCS7
▶ 備註：等同 /sign 的 signatureType 欄位
keyidb64 選填 選擇憑證，憑證 ID 的 Base64
▶ 預設：U0lHTg== (SIGN，簽章憑證)
▶ 選項：U0lHTg== (SIGN，簽章憑證)、S0VZWA== (KEYX，加密憑證)
▶ 備註：等同 /sign 的 keyidb64 欄位
nonce 選填
一次性數字，增加簽章的隨機性，PKCS7 專用
▶ 預設：空字串
▶ 備註：等同 /sign 的 nonce欄位
withSigningTime 選填 簽章值是否要包含簽章時間，PKCS7 專用
▶ 預設：true
▶ 選項：true、false
▶ 備註：等同 /sign 的 withSigningTime 欄位
withCardSN 選填
簽章值是否要包含卡號
▶ 預設：false
▶ 選項：true、false
▶ 備註：等同 /sign 的 withCardSN欄位
checkValidity 選填 簽章前，是否檢查使用者系統時間在憑證有效期間內
▶ 預設：true
▶ 選項：true、false
▶ 備註：等同 /sign 的 checkValidity欄位

Response#

Callback funtion 中以 getICToken() 取得以下內容

1
{
2
  "SmrtCrdID": ["<卡號>"],
3
  "SlotID": ["InfoThink USB Reader 0"],
4
  "SlotName": [],
5
  "ActvSltID": ["0"],
6
  "OldPIN": "",
7
  "NewPIN": "",
8
  "UID": "",
9
  "CrdSys": "",
10
  "KpMsg": "",
11
  "exDynamicCreateFileInput": "",
12
  "exDynamicReleaseFileInput": "",
13
  "TBS": "VEJT",
14
  "TbsEncoding": "base64",
15
  "HashAlgorithm": "SHA256",
16
  "PIN": "000000",
17
  "FUN": "MakeSignature",
18
  "SType": "PKCS1",
19
  "RetObj": {
20
    "RCode": "0",
21
    "B64Signature": "<簽章值>",
22
    "RMsg": "undefined"
23
  },
24
  "keyidb64": "__NotExistedTag__",
25
  "nonce": "__NotExistedTag__",
26
  "withSigningTime": "__NotExistedTag__",
27
  "withCardSN": "__NotExistedTag__",
28
  "checkValidity": "__NotExistedTag__"
29
}

原始碼#

1
ICToken.prototype.sign = function (
2
  B64ToBeSign, UserPIN, HashAlg, RevFun, PKCSSignType,
3
  keyidb64, nonce, withSigningTime, withCardSN, checkValidity
4
) {
5
  if (typeof PKCSSignType === "undefined") PKCSSignType = "PKCS1";
6
  if (typeof keyidb64 === "undefined") keyidb64 = "__NotExistedTag__";
7
  if (typeof nonce === "undefined") nonce = "__NotExistedTag__";
8
  if (typeof withSigningTime === "undefined")
9
    withSigningTime = "__NotExistedTag__";
10
  if (typeof withCardSN === "undefined") withCardSN = "__NotExistedTag__";
11
  if (typeof checkValidity === "undefined") checkValidity = "__NotExistedTag__";
12
  UserSign(
13
    B64ToBeSign, encodeURIComponent(UserPIN), HashAlg, RevFun, PKCSSignType,
14
    keyidb64, encodeURIComponent(nonce), encodeURIComponent(withSigningTime),
15
    encodeURIComponent(withCardSN), encodeURIComponent(checkValidity), "none"
16
  );
17
};
18

19
function UserSign(
20
  B64ToBeSign, UserPIN, HashAlg, UrRevFUN, PKCSSignType, keyidb64,
21
  nonce, withSigningTime, withCardSN, checkValidity, SignType
22
) {
23
  var l_iRetCode = 0;
24
  var l_B64Signature = "";
25
  var l_vRMsg;
26
  var l_vRetData;
27

28
  if (typeof PKCSSignType === "undefined") PKCSSignType = "PKCS1";
29
  if (typeof keyidb64 === "undefined") keyidb64 = "__NotExistedTag__";
30
  if (typeof nonce === "undefined") nonce = "__NotExistedTag__";
31
  if (typeof withSigningTime === "undefined")
32
    withSigningTime = "__NotExistedTag__";
33
  if (typeof withCardSN === "undefined") withCardSN = "__NotExistedTag__";
34
  if (typeof checkValidity === "undefined") checkValidity = "__NotExistedTag__";
35

36
  if (PKCSSignType == "PKCS7") {
37
    InToken.SType = "PKCS7";
38
  } else {
39
    //Default: "PKCS1"
40
  }
41

42
  if (SignType.localeCompare("Cryp") == 0) {
43
    InToken.FUN = "umakeSig";
44
    GARevFun.FUN = "StSgn";
45
  } else {
46
    InToken.FUN = "MakeSignature";
47
    GARevFun.FUN = "StSgn";
48
  }
49

50
  InToken.PIN = UserPIN;
51
  InToken.TBS = B64ToBeSign;
52
  InToken.keyidb64 = keyidb64;
53
  InToken.nonce = nonce;
54
  InToken.withSigningTime = withSigningTime;
55
  InToken.withCardSN = withCardSN;
56
  InToken.checkValidity = checkValidity;
57

58
  GARevFun.Para = HashAlg.toUpperCase();
59
  GARevFun.UrFUN = UrRevFUN;
60

61
  switch (GARevFun.Para) {
62
    case "SHA256":
63
      InToken.HashAlgorithm = "SHA256";
64
      break;
65
    case "SHA1":
66
      InToken.HashAlgorithm = "SHA1";
67
      break;
68
    default:
69
      l_iRetCode = 3400;
70
      l_vRMsg = rMsg(l_iRetCode, "");
71
      break;
72
  }
73

74
  if (B64ToBeSign == null) {
75
    l_iRetCode = 3402;
76
    l_vRMsg = rMsg(l_iRetCode, "");
77
  }
78

79
  if (UserPIN == null) {
80
    l_iRetCode = 3403;
81
    l_vRMsg = rMsg(l_iRetCode, "");
82
  }
83

84
  if (HashAlg == null) {
85
    l_iRetCode = 3404;
86
    l_vRMsg = rMsg(l_iRetCode, "");
87
  }
88

89
  if (UrRevFUN == null) {
90
    l_iRetCode = 3405;
91
    l_vRMsg = rMsg(l_iRetCode, "");
92
    alert("輸入參數錯誤或不足");
93
  }
94

95
  if (checkGoodDay() == false) {
96
    l_iRetCode = 3401;
97
    l_vRMsg = rMsg(l_iRetCode, "");
98
  }
99

100
  if (l_iRetCode == 0) {
101
    if (SignType.localeCompare("Cryp") == 0) {
102
      SendData(
103
        "http://localhost:61161/umakeSig",
104
        "http://localhost:61161/ChtPopupForm",
105
        "IC卡讀取中",
106
        Gbjct.PppFrmStyle,
107
        StSgn,
108
        UrRevFUN
109
      );
110
    } else {
111
      SendData(
112
        "http://localhost:61161/sign",
113
        "http://localhost:61161/ChtPopupForm",
114
        "IC卡讀取中",
115
        Gbjct.PppFrmStyle,
116
        StSgn,
117
        UrRevFUN
118
      );
119
    }
120
  } else {
121
    l_vRetData =
122
      '{"RCode":"' +
123
      l_iRetCode +
124
      '", "B64Signature":"' +
125
      l_B64Signature +
126
      '","RMsg":"' +
127
      l_vRMsg +
128
      '"}';
129
    InToken.RetObj = JSON.parse(l_vRetData);
130
    if (UrRevFUN && typeof UrRevFUN === "function") UrRevFUN();
131
  }
132
}