使用nodejs验证RSA签名（使用phpseclib签名）

Question

我正在尝试将支付网关集成到我的nodejs应用程序中。当支付完成时，网关用支付结果将用户重定向到我的站点。结果是RSA签名的，我需要用支付网关提供的公钥来验证它。

下面是支付网关为签名验证提供的示例PHP代码。

<?php
include 'Crypt/RSA.php';
$rsa = new Crypt_RSA();
$payment = base64_decode($_POST ["payment"]);
$signature = base64_decode($_POST ["signature"]);
$publickey = "-----BEGIN PUBLIC KEY----- SOMEKEYSOMEKEYSOMEKEYSOMEKEYSOMEKEYSOMEKEYSOMEKEY -----END PUBLIC KEY-----";
$rsa->loadKey($publickey);
$signature_status = $rsa->verify($payment, $signature) ? TRUE : FALSE;
echo $signature_status; 
?>

const NodeRSA = require('node-rsa');
const decryptionKey = new NodeRSA(PUBLIC_KEY);
decryptionKey.setOptions({signingScheme: 'pss-sha1'});

module.exports.handlePaymentCallback = function (req, res, next) {
    const signature = Buffer.from(req.body.signature, 'base64').toString();
    const payment = Buffer.from(req.body.payment, 'base64').toString();
    let result = decryptionKey.verify(payment, signature);
}

const constants = process.binding('constants').crypto;
const crypt = require('crypto');

module.exports.handlePaymentCallback = function (req, res, next) {
    const signature = Buffer.from(req.body.signature, 'base64').toString();
    const payment = Buffer.from(req.body.payment, 'base64').toString();
    const verifier = crypt.createVerify('RSA-SHA1');
    verifier.update(new Buffer('' + payment, 'utf8'));
    const options = {key: PUBLIC_KEY};
    let result = verifier.verify(options, signature);
}

有谁知道怎么把这件事搞定吗？

Answer 1

我发现了问题所在。我不必要地调用了签名和支付缓冲区的toString()。删除toString()时，它会起作用。

const NodeRSA = require('node-rsa');
const decryptionKey = new NodeRSA(PUBLIC_KEY);
decryptionKey.setOptions({signingScheme: 'pss-sha1'});

module.exports.handlePaymentCallback = function (req, res, next) {
    const signature = Buffer.from(req.body.signature, 'base64');
    const payment = Buffer.from(req.body.payment, 'base64');
    let result = decryptionKey.verify(payment, signature);
}