1
<h1>自然人憑證 憑證驗簽PKCS1</h1>
2
<input type="button" value="讀取簽章憑證" onclick="getCert()" />
3
<form action="https://cert.modatw.workers.dev/api/pkcs1VerifyWithCert" method="post">
4
  tbs: <input type="text" name="tbs" /><br>
5
  hashAlgorithm: <select name="hashAlgorithm">
6
    <option value="SHA1">SHA1</option>
7
    <option value="SHA256" selected>SHA256</option>
8
    <option value="SHA384">SHA384</option>
9
    <option value="SHA512">SHA512</option>
10
  </select><br>
11
  signature (簽章值)<br>
12
  <textarea name="signature" rows="8" cols="65"></textarea><br>
13
  certb64 (憑證)<br>
14
  <textarea name="certb64" rows="8" cols="65"></textarea><br>
15
  <input type="submit">
16
</form>
17

18
<script>
19
  let popupForm;
20
  let timeout;
21

22
  function getCert() {
23
    popupForm = window.open(
24
      "http://localhost:61161/popupForm",
25
      "popupForm",
26
      "height=200, width=200, left=100, top=20"
27
    );
28
    timeout = setTimeout(() => {
29
      popupForm.close();
30
      alert("尚未安裝元件");
31
    }, 5000);
32
  }
33

34
  function receiveMessage(event) {
35
    if (event.origin !== "http://localhost:61161") return;
36

37
    let ret = JSON.parse(event.data);
38
    if (ret.func === "getTbs") {
39
      clearTimeout(timeout);
40
      const tbsData = { func: "GetUserCert" };
41
      popupForm.postMessage(JSON.stringify(tbsData), "*");
42
    } else {
43
      const data = JSON.parse(event.data);
44
      const cert = data.slots[0].token.certs[2].certb64;
45
      document.getElementsByName("certb64")[0].value = cert;
46
    }
47
  }
48

49
  window.addEventListener("message", receiveMessage, false);
50
</script>

1
// 本範例環境為 Cloudflare Workers
2
// 程式碼適用於 NodeJS，需安裝 node-forge
3

4
// 以下為 Cloudflare Workers 可用的 node-forge
5
// https://gist.github.com/chouhsiang/2dad8070e517b61cec3d175b1832c4be
6
import { forge } from "./node-forge.js";
7

8
export default {
9
  async fetch(request, env, ctx) {
10
    try {
11
      const { pathname } = new URL(request.url);
12
      if (pathname == "/api/pkcs1VerifyWithCert" && request.method == "POST") {
13
        return await pkcs1VerifyWithCert(request);
14
      }
15
      return new Response("");
16
    } catch (e) {
17
      return new Response(e);
18
    }
19
  },
20
};
21

22
async function pkcs1VerifyWithCert(request) {
23
  const formData = await request.formData();
24

25
  // 從憑證提取公鑰
26
  const begin = "-----BEGIN CERTIFICATE-----";
27
  const end = "-----END CERTIFICATE-----";
28
  const certPem = begin + formData.get("certb64") + end;
29
  const cert = forge.pki.certificateFromPem(certPem);
30
  const publicKey = cert.publicKey;
31

32
  // 將簽章值轉為 Byte
33
  const signature = formData.get("signature");
34
  const signatureBytes = forge.util.decode64(signature);
35

36
  // 將 tbs 進行 Hash
37
  const tbs = formData.get("tbs");
38
  const plainTextBytes = forge.util.encodeUtf8(tbs);
39
  const hashAlgorithm = formData.get("hashAlgorithm").toUpperCase();
40
  let hashCodeBytes;
41
  if (hashAlgorithm == "SHA1") {
42
    const md = forge.md.sha1.create();
43
    md.update(plainTextBytes);
44
    hashCodeBytes = md.digest().getBytes();
45
  } else if (hashAlgorithm == "SHA256") {
46
    const md = forge.md.sha256.create();
47
    md.update(plainTextBytes);
48
    hashCodeBytes = md.digest().getBytes();
49
  } else if (hashAlgorithm == "SHA384") {
50
    const md = forge.md.sha384.create();
51
    md.update(plainTextBytes);
52
    hashCodeBytes = md.digest().getBytes();
53
  } else if (hashAlgorithm == "SHA512") {
54
    const md = forge.md.sha512.create();
55
    md.update(plainTextBytes);
56
    hashCodeBytes = md.digest().getBytes();
57
  }
58

59
  // 使用公鑰對 Hash、signature 進行驗證
60
  const verified = publicKey.verify(hashCodeBytes, signatureBytes);
61
  if (verified) {
62
    return new Response("PKCS1 驗簽成功");
63
  } else {
64
    return new Response("PKCS1 驗簽失敗");
65
  }
66
}