1
<h1>自然人憑證 公鑰驗簽PKCS1</h1>
2
<input type="button" value="讀取簽章公鑰" onclick="getCert()" />
3
<form action="https://cert.modatw.workers.dev/api/pkcs1VerifyWithKey" method="post">
4
  tbs: <input type="text" name="tbs" /><br>
5
  hashAlgorithm: <select name="hashAlgorithm">
6
    <option value="SHA1">SHA1</option>
7
    <option value="SHA256" selected>SHA256</option>
8
    <option value="SHA384">SHA384</option>
9
    <option value="SHA512">SHA512</option>
10
  </select><br>
11
  signature (簽章值)<br>
12
  <textarea name="signature" rows="8" cols="65"></textarea><br>
13
  keyb64 (公鑰)<br>
14
  <textarea name="keyb64" rows="8" cols="65"></textarea><br>
15
  <input type="submit">
16
</form>
17

18
<script>
19
  let popupForm;
20
  let timeout;
21

22
  function getCert() {
23
    popupForm = window.open(
24
      "http://localhost:61161/popupForm",
25
      "popupForm",
26
      "height=200, width=200, left=100, top=20"
27
    );
28
    timeout = setTimeout(() => {
29
      popupForm.close();
30
      alert("尚未安裝元件");
31
    }, 5000);
32
  }
33

34
  function receiveMessage(event) {
35
    if (event.origin !== "http://localhost:61161") return;
36

37
    let ret = JSON.parse(event.data);
38
    if (ret.func === "getTbs") {
39
      clearTimeout(timeout);
40
      const tbsData = { func: "GetUserCert" };
41
      popupForm.postMessage(JSON.stringify(tbsData), "*");
42
    } else {
43
      const data = JSON.parse(event.data);
44
      const cert = data.slots[0].token.certs[2].certb64;
45
      document.getElementsByName("certb64")[0].value = cert;
46
    }
47
  }
48

49
  window.addEventListener("message", receiveMessage, false);
50
</script>

1
// 本範例環境為 Cloudflare Workers
2
// 程式碼適用於 NodeJS，需安裝 node-forge
3

4
// 以下為 Cloudflare Workers 可用的 node-forge
5
// https://gist.github.com/chouhsiang/2dad8070e517b61cec3d175b1832c4be
6
import { forge } from "./node-forge.js";
7

8
export default {
9
  async fetch(request, env, ctx) {
10
    try {
11
      const { pathname } = new URL(request.url);
12
      if (pathname == "/api/pkcs1VerifyWithKey" && request.method == "POST") {
13
        return await pkcs1VerifyWithKey(request);
14
      }
15
      return new Response("");
16
    } catch (e) {
17
      return new Response(e);
18
    }
19
  },
20
};
21

22
async function pkcs1VerifyWithKey(request) {
23
  const formData = await request.formData();
24

25
  // 載入公鑰
26
  const begin = "-----BEGIN PUBLIC KEY-----";
27
  const end = "-----END PUBLIC KEY-----";
28
  const keyPem = begin + formData.get("keyb64") + end;
29
  const publicKey = forge.pki.publicKeyFromPem(keyPem);
30

31
  // 將 signature 轉為 Byte
32
  const signature = formData.get("signature");
33
  const signatureBytes = forge.util.decode64(signature);
34

35
  // 將 tbs 進行 Hash
36
  const tbs = formData.get("tbs");
37
  const plainTextBytes = forge.util.encodeUtf8(tbs);
38
  const hashAlgorithm = formData.get("hashAlgorithm").toUpperCase();
39
  let hashCodeBytes;
40
  if (hashAlgorithm == "SHA1") {
41
    const md = forge.md.sha1.create();
42
    md.update(plainTextBytes);
43
    hashCodeBytes = md.digest().getBytes();
44
  } else if (hashAlgorithm == "SHA256") {
45
    const md = forge.md.sha256.create();
46
    md.update(plainTextBytes);
47
    hashCodeBytes = md.digest().getBytes();
48
  } else if (hashAlgorithm == "SHA384") {
49
    const md = forge.md.sha384.create();
50
    md.update(plainTextBytes);
51
    hashCodeBytes = md.digest().getBytes();
52
  } else if (hashAlgorithm == "SHA512") {
53
    const md = forge.md.sha512.create();
54
    md.update(plainTextBytes);
55
    hashCodeBytes = md.digest().getBytes();
56
  }
57

58
  // 使用公鑰對 Hash、signature 進行驗證
59
  const verified = publicKey.verify(hashCodeBytes, signatureBytes);
60
  if (verified) {
61
    return new Response("PKCS1 驗簽成功");
62
  } else {
63
    return new Response("PKCS1 驗簽失敗");
64
  }
65
}