RSACryptoServiceProvider equivalent in JS
本文关键字:JS in equivalent RSACryptoServiceProvider | 更新日期: 2023-09-27 18:32:57
我一直在开发一个 ASP.NET WEB API RESTFUL 服务,供 angularjs 客户端使用。现在,我正在使其安全,并且我决定实施RSA加密来获得它。因此,在服务器端,我正在使用RSACryptoServiceProvider方法,公钥和私钥都存储在文件中。这几乎足够了,但是,在客户端的第一次调用中,它会发送一串用户名和密码进行身份验证并获取令牌,因此我必须加密该调用。
有没有人知道任何关于如何在 JS 中实现类似于我在 C# 中使用的内容的教程或手册?
以下是 WEB API 中的加密代码:
using System;
using System.Collections.Generic;
using System.Text;
using System.Security.Cryptography;
using System.IO;
namespace MvcPrueba.Models
{
public class Cryptography
{
#region Types
#region Enum
#endregion
#region Class
#endregion
#endregion
#region Variables
#endregion
#region Properties
#endregion
#region Constructors/Destructors
#region Constructors
protected Cryptography()
{
}
#region Instantiate
#endregion
#endregion
#region Destructors
public void Dispose()
{
throw new NotImplementedException();
}
#endregion
#endregion
#region Class Logic
// Generate a new key pair
public static void GenerateKeys(string publicKeyFileName, string privateKeyFileName)
{
// Variables
CspParameters cspParams = null;
RSACryptoServiceProvider rsaProvider = null;
StreamWriter publicKeyFile = null;
StreamWriter privateKeyFile = null;
string publicKey = "";
string privateKey = "";
try
{
// Create a new key pair on target CSP
cspParams = new CspParameters();
cspParams.ProviderType = 1; // PROV_RSA_FULL
//cspParams.ProviderName; // CSP name
cspParams.Flags = CspProviderFlags.UseArchivableKey;
cspParams.KeyNumber = (int)KeyNumber.Exchange;
rsaProvider = new RSACryptoServiceProvider(cspParams);
// Export public key
publicKey = rsaProvider.ToXmlString(false);
// Write public key to file
publicKeyFile = File.CreateText(publicKeyFileName);
publicKeyFile.Write(publicKey);
// Export private/public key pair
privateKey = rsaProvider.ToXmlString(true);
// Write private/public key pair to file
privateKeyFile = File.CreateText(privateKeyFileName);
privateKeyFile.Write(privateKey);
}
catch (Exception ex)
{
// Any errors? Show them
Console.WriteLine("Exception generating a new key pair! More info:");
Console.WriteLine(ex.Message);
}
finally
{
// Do some clean up if needed
if (publicKeyFile != null)
{
publicKeyFile.Close();
}
if (privateKeyFile != null)
{
privateKeyFile.Close();
}
}
} // Keys
// Encrypt a file
public static void Encrypt(string publicKeyFileName, string plainFileName, string encryptedFileName)
{
// Variables
CspParameters cspParams = null;
RSACryptoServiceProvider rsaProvider = null;
StreamReader publicKeyFile = null;
StreamReader plainFile = null;
FileStream encryptedFile = null;
string publicKeyText = "";
string plainText = "";
byte[] plainBytes = null;
byte[] encryptedBytes = null;
try
{
// Select target CSP
cspParams = new CspParameters();
cspParams.ProviderType = 1; // PROV_RSA_FULL
//cspParams.ProviderName; // CSP name
rsaProvider = new RSACryptoServiceProvider(cspParams);
// Read public key from file
publicKeyFile = File.OpenText(publicKeyFileName);
publicKeyText = publicKeyFile.ReadToEnd();
// Import public key
rsaProvider.FromXmlString(publicKeyText);
// Read plain text from file
plainFile = File.OpenText(plainFileName);
plainText = plainFile.ReadToEnd();
// Encrypt plain text
plainBytes = Encoding.Unicode.GetBytes(plainText);
encryptedBytes = rsaProvider.Encrypt(plainBytes, false);
// Write encrypted text to file
encryptedFile = File.Create(encryptedFileName);
encryptedFile.Write(encryptedBytes, 0, encryptedBytes.Length);
}
catch (Exception ex)
{
// Any errors? Show them
Console.WriteLine("Exception encrypting file! More info:");
Console.WriteLine(ex.Message);
}
finally
{
// Do some clean up if needed
if (publicKeyFile != null)
{
publicKeyFile.Close();
}
if (plainFile != null)
{
plainFile.Close();
}
if (encryptedFile != null)
{
encryptedFile.Close();
}
}
} // Encrypt
// Decrypt a file
public static void Decrypt(string privateKeyFileName, string encryptedFileName, string plainFileName)
{
// Variables
CspParameters cspParams = null;
RSACryptoServiceProvider rsaProvider = null;
StreamReader privateKeyFile = null;
FileStream encryptedFile = null;
StreamWriter plainFile = null;
string privateKeyText = "";
string plainText = "";
byte[] encryptedBytes = null;
byte[] plainBytes = null;
try
{
// Select target CSP
cspParams = new CspParameters();
cspParams.ProviderType = 1; // PROV_RSA_FULL
//cspParams.ProviderName; // CSP name
rsaProvider = new RSACryptoServiceProvider(cspParams);
// Read private/public key pair from file
privateKeyFile = File.OpenText(privateKeyFileName);
privateKeyText = privateKeyFile.ReadToEnd();
// Import private/public key pair
rsaProvider.FromXmlString(privateKeyText);
// Read encrypted text from file
encryptedFile = File.OpenRead(encryptedFileName);
encryptedBytes = new byte[encryptedFile.Length];
encryptedFile.Read(encryptedBytes, 0, (int)encryptedFile.Length);
// Decrypt text
plainBytes = rsaProvider.Decrypt(encryptedBytes, false);
// Write decrypted text to file
plainFile = File.CreateText(plainFileName);
plainText = Encoding.Unicode.GetString(plainBytes);
plainFile.Write(plainText);
}
catch (Exception ex)
{
// Any errors? Show them
Console.WriteLine("Exception decrypting file! More info:");
Console.WriteLine(ex.Message);
}
finally
{
// Do some clean up if needed
if (privateKeyFile != null)
{
privateKeyFile.Close();
}
if (encryptedFile != null)
{
encryptedFile.Close();
}
if (plainFile != null)
{
plainFile.Close();
}
}
} // Decrypt
#endregion
}
}
提前谢谢。
@m.dorian - 这是一个非常糟糕的主意!如果您重视安全性和最佳实践,请不要尝试以任何方式实现这一点。我建议您彻底阅读该主题。此外,您应该始终对用户的密码进行哈希处理,而不是对其进行加密。密码应该是单向散列等。
如果您不了解数据安全的细节,我建议您退后一步,要么与知道自己在做什么的人交谈,要么自学。尤其是在过去几年报告的所有数据泄露之后。特洛伊·亨特的有用帖子可以在这里找到,这应该只是一个开始!
一个新的API,Web加密API,目前处于草案状态,但根据MDN的说法,它可以在几乎所有主要浏览器的最新版本中使用。
但是,我不确定您要实现什么?您说您希望对用户名和密码进行客户端加密,但为什么不只使用 TLS 来加密所有流量?或者您是否使用用户名和密码生成用于加密和解密数据客户端的私钥,因此您只需将公钥存储在服务器上?
附带说明一下,您将加密密钥存储在文件中。您存储它们的安全性如何?当有人窃取密钥时,所有数据都是公开的。