PHP Crypt_RSA::verify方法代码示例

 public function seeValidSignature()
 {
     $response = $this->getModule('REST')->response;
     $response = json_decode($response);
     $sign = base64_url_decode($response->sign);
     $this->rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
     $this->assertTrue($this->rsa->verify($response->data, $sign));
 }

function _google_verify_token($public_key, $signature, $signed_data, $sku, $base_url)
{
    $comments = array();
    $error = '';
    $status = 'unknown';
    if (!class_exists('Crypt_RSA')) {
        $comments[] = 'PHPSecLib is not in the PHP path.';
    }
    $purchaseToken = _google_get_product_id($signed_data, $sku);
    if (empty($purchaseToken)) {
        $status = 'invalid';
        $error = 'The SKU is not present in the data.';
    } else {
        $status = 'unverified';
        // unverified until verified
        $comments[] = 'The SKU is present in the data.';
        $comments[] = 'The purchase token is ' . str_replace("--", "-\n-", $purchaseToken);
        // Split any --'s otherwise XML is not well-formed
        // verify the data signature
        if (!class_exists('Crypt_RSA')) {
            $error = 'PHPSecLib is not in the PHP path.';
        } else {
            $rsa = new Crypt_RSA();
            $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
            $rsa->loadKey("-----BEGIN PUBLIC KEY-----\n" . $public_key . "\n-----END PUBLIC KEY-----");
            if ($rsa->verify($signed_data, base64_decode($signature))) {
                $comments[] = 'verified ok';
                $status = 'OK';
            } else {
                $comments[] = 'verification failed';
            }
        }
    }
    return array('status' => $status, 'comments' => $comments, 'error' => $error);
}

 public function downloadPlugin($name, $url, $signature)
 {
     if (is_dir(ipFile("Plugin/{$name}/"))) {
         Service::deactivatePlugin($name);
         Helper::removeDir(ipFile("Plugin/{$name}/"));
     }
     //download plugin
     $net = new \Ip\Internal\NetHelper();
     $pluginTempFilename = $net->downloadFile($url, ipFile('file/secure/tmp/'), $name . '.zip');
     if (!$pluginTempFilename) {
         throw new \Ip\Exception('Plugin file download failed.');
     }
     $archivePath = ipFile('file/secure/tmp/' . $pluginTempFilename);
     //check signature
     $fileMd5 = md5_file($archivePath);
     $rsa = new \Crypt_RSA();
     $rsa->loadKey($this->publicKey);
     $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
     $verified = $rsa->verify($fileMd5, base64_decode($signature));
     if (!$verified) {
         throw new \Ip\Exception('Plugin signature verification failed.');
     }
     //extract
     $secureTmpDir = ipFile('file/secure/tmp/');
     $tmpExtractedDir = \Ip\Internal\File\Functions::genUnoccupiedName($name, $secureTmpDir);
     \Ip\Internal\Helper\Zip::extract($secureTmpDir . $pluginTempFilename, $secureTmpDir . $tmpExtractedDir);
     unlink($archivePath);
     //install
     $extractedDir = $this->getFirstDir($secureTmpDir . $tmpExtractedDir);
     $installDir = Model::pluginInstallDir();
     $newPluginDir = \Ip\Internal\File\Functions::genUnoccupiedName($name, $installDir);
     rename($secureTmpDir . $tmpExtractedDir . '/' . $extractedDir, $installDir . $newPluginDir);
     Service::activatePlugin($name);
 }

	private function checkRsaSignature($toCheck, $signature, $rsaKey) {
		# de signature is base64 encoded, eerst decoden
		$signature = base64_decode($signature);

		# Controleer of we de native OpenSSL libraries moeten
		# gebruiken om RSA signatures te controleren
		if (CRYPT_RSA_MODE != CRYPT_RSA_MODE_OPENSSL) {
			# Initialize the public key to verify with
			$pubKey['n'] = new Math_BigInteger(base64_decode($rsaKey['modulo']), 256);
			$pubKey['e'] = new Math_BigInteger(base64_decode($rsaKey['exponent']), 256);
					
			# and verify the signature
			$rsa = new Crypt_RSA();
			$rsa->loadKey($pubKey, CRYPT_RSA_PUBLIC_FORMAT_RAW);
			$rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);

			# Supress notice if the signature was invalid
			$saveErrorReporting = error_reporting(E_ERROR);
			$tmpSave = $rsa->verify($toCheck, $signature);
			error_reporting($saveErrorReporting);
		} else {
			# Initialize the public key to verify with
			$pubKey['n'] = base64_decode($rsaKey['modulo']);
			$pubKey['e'] = base64_decode($rsaKey['exponent']);

			$nativeVerify = new SpotSeclibToOpenSsl();
			$tmpSave = $nativeVerify->verify($pubKey, $toCheck, $signature);
		} # else

		return $tmpSave;
	} # checkRsaSignature

 public function downloadTheme($name, $url, $signature)
 {
     $model = Model::instance();
     //download theme
     $net = new \Ip\Internal\NetHelper();
     $themeTempFilename = $net->downloadFile($url, ipFile('file/secure/tmp/'), $name . '.zip');
     if (!$themeTempFilename) {
         throw new \Ip\Exception('Theme file download failed.');
     }
     $archivePath = ipFile('file/secure/tmp/' . $themeTempFilename);
     //check signature
     $fileMd5 = md5_file($archivePath);
     $rsa = new \Crypt_RSA();
     $rsa->loadKey($this->publicKey);
     $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
     $verified = $rsa->verify($fileMd5, base64_decode($signature));
     if (!$verified) {
         throw new \Ip\Exception('Theme signature verification failed.');
     }
     //extract
     $helper = Helper::instance();
     $secureTmpDir = ipFile('file/secure/tmp/');
     $tmpExtractedDir = \Ip\Internal\File\Functions::genUnoccupiedName($name, $secureTmpDir);
     \Ip\Internal\Helper\Zip::extract($secureTmpDir . $themeTempFilename, $secureTmpDir . $tmpExtractedDir);
     unlink($archivePath);
     //install
     $extractedDir = $helper->getFirstDir($secureTmpDir . $tmpExtractedDir);
     $installDir = $model->getThemeInstallDir();
     $newThemeDir = \Ip\Internal\File\Functions::genUnoccupiedName($name, $installDir);
     rename($secureTmpDir . $tmpExtractedDir . '/' . $extractedDir, $installDir . $newThemeDir);
 }

 public function verify($data, $signature, $publicKey)
 {
     $this->requireLibrary();
     $rsa = new Crypt_RSA();
     $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
     $rsa->loadKey($publicKey);
     $errorCatcher = new MWP_Debug_ErrorCatcher();
     $errorCatcher->register();
     $verify = $rsa->verify($data, $signature);
     $errorMessage = $errorCatcher->yieldErrorMessage(true);
     if (!$verify && $errorMessage !== null && $errorMessage !== 'Signature representative out of range' && $errorMessage !== 'Invalid signature') {
         throw new MWP_Worker_Exception(MWP_Worker_Exception::PHPSECLIB_VERIFY_ERROR, null, array('error' => $errorMessage));
     }
     return $verify;
 }

 private function verifySignature()
 {
     if (function_exists('openssl_public_decrypt')) {
         openssl_public_decrypt($sign, $request_sign, $pub_key);
         $ret = $text == $request_sign;
         return $ret;
     } else {
         set_include_path(main::getPluginDir() . '/libs/phpseclib');
         require_once 'Crypt/RSA.php';
         $rsa = new Crypt_RSA();
         $rsa->loadKey($pub_key);
         $ret = $rsa->verify($text, $sign2);
         return $ret;
     }
 }

 private function checkRsaSignature($toCheck, $signature, $rsaKey)
 {
     # de signature is base64 encoded, eerst decoden
     $signature = base64_decode($signature);
     # Initialize the public key to verify with
     $pubKey['n'] = new Math_BigInteger(base64_decode($rsaKey['modulo']), 256);
     $pubKey['e'] = new Math_BigInteger(base64_decode($rsaKey['exponent']), 256);
     # and verify the signature
     $rsa = new Crypt_RSA();
     $rsa->loadKey($pubKey, CRYPT_RSA_PUBLIC_FORMAT_RAW);
     $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
     # Supress notice if the signature was invalid
     $saveErrorReporting = error_reporting(E_ERROR);
     $tmpSave = $rsa->verify($toCheck, $signature);
     error_reporting($saveErrorReporting);
     return $tmpSave;
 }

 public function pac_message_receiver()
 {
     $content = Req::post("content");
     if (!isset($content)) {
         $this->returnXML("false", "S09", "返回报文为空");
     }
     $signature = Req::post("data_digest");
     if (!isset($signature)) {
         $this->returnXML("false", "S09", "返回报文为空");
     }
     Tiny::log("异步审批结果回执信息【content:" . $content . "】data_digest【" . $signature . "】");
     // 测试密钥
     $aeskey = base64_decode($this->jkf['aes_key']);
     //AES解密，采用ECB模式
     $aes = new Crypt_AES(CRYPT_MODE_ECB);
     //设置AES密钥
     $aes->setKey($aeskey);
     //解密AES密文
     $plaintext = $aes->decrypt(base64_decode($content));
     //测试rsa公钥
     $publickey = $this->jkf['public_key'];
     $rsa = new Crypt_RSA();
     //设置RSA签名模式 CRYPT_RSA_SIGNATURE_PSS or CRYPT_RSA_SIGNATURE_PKCS1
     $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
     //使用RSA公钥验证签名
     $rsa->loadKey(base64_decode($publickey));
     //签名通过
     if ($rsa->verify($plaintext, base64_decode($signature))) {
         $contentXML = simplexml_load_string($plaintext);
         $businessType = (string) $contentXML->head->businessType;
         $model = new GatewayModel();
         if ($businessType == "RESULT") {
             $model->insertResult($contentXML, "1");
         } else {
             if ($businessType == "PRODUCT_RECORD") {
                 $model->insertExamineResult($contentXML);
             }
         }
         $this->returnXML();
     } else {
         $this->returnXML("false", "S02", "非法的数字签名");
     }
 }

function _pugpig_google_verify_token($public_key, $signature, $signed_data, $sku, $base_url, $subscriptionPrefix, $allowedSubscriptionArray)
{
    $comments = array();
    $error = '';
    $status = 'unknown';
    if (!class_exists('Crypt_RSA')) {
        $comments[] = 'PHPSecLib is not in the PHP path.';
    }
    $comments[] = "The public key is '{$public_key}'";
    $comments[] = "The signature is '{$signature}'";
    $comments[] = "The receipt is '{$signed_data}'";
    $comments[] = "The sku is '{$sku}'";
    $comments[] = "The base url is '{$base_url}'";
    $comments[] = "The subscription prefix is '{$subscriptionPrefix}'";
    $comments[] = 'The subscription array is (' . implode(', ', $allowedSubscriptionArray) . ')';
    $purchaseToken = _pugpig_google_get_sku_product_token($signed_data, $sku, $subscriptionPrefix, $allowedSubscriptionArray);
    if (empty($purchaseToken)) {
        $status = 'invalid';
        $error = 'The SKU is not present in the data.';
    } else {
        $status = 'unverified';
        // unverified until verified
        $comments[] = 'The SKU is present in the data.';
        $comments[] = 'The purchase token is ' . str_replace("--", "-\n-", $purchaseToken);
        // Split any --'s otherwise XML is not well-formed
        // verify the data signature
        if (!class_exists('Crypt_RSA')) {
            $error = 'PHPSecLib is not in the PHP path.';
        } else {
            $rsa = new Crypt_RSA();
            $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
            $rsa->loadKey("-----BEGIN PUBLIC KEY-----\n" . $public_key . "\n-----END PUBLIC KEY-----");
            if ($rsa->verify($signed_data, base64_decode($signature))) {
                $comments[] = 'verified ok';
                $status = 'OK';
            } else {
                $comments[] = 'verification failed';
            }
        }
    }
    return array('status' => $status, 'comments' => $comments, 'error' => $error);
}

 public function verifySignature($sign, $sign2, $pub_key, $text)
 {
     if (function_exists('openssl_public_decrypt')) {
         openssl_public_decrypt($sign, $request_sign, $pub_key);
         $ret = $text == $request_sign;
         return $ret;
     } else {
         set_include_path(get_include_path() . PATH_SEPARATOR . self::getPluginDir() . '/modules/phpseclib');
         require_once 'Crypt/RSA.php';
         $rsa = new Crypt_RSA();
         $rsa->loadKey($pub_key);
         $ret = $rsa->verify($text, $sign2);
         return $ret;
     }
 }

 public function verify_signature($message, $signature, $key, $hash_algorithm = 'sha256')
 {
     $this->ensure_crypto_loaded();
     $rsa = new Crypt_RSA();
     $rsa->setHash(strtolower($hash_algorithm));
     // This is not the default, but is what we use
     $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
     $rsa->loadKey($key);
     // Don't hash it - Crypt_RSA::verify() already does that
     // 		$hash = new Crypt_Hash($hash_algorithm);
     // 		$hashed = $hash->hash($message);
     $verified = $rsa->verify($message, base64_decode($signature));
     if ($this->debug) {
         $this->log('Signature verification result: ' . serialize($verified));
     }
     return $verified;
 }

 protected function verify_phpseclib($data, $sigBin, $publickey, $algo = 'sha256WithRSAEncryption')
 {
     $isHash = preg_match("/^([a-z]+[0-9]).+/", $algo, $hashinfo);
     $hash = $isHash ? $hashinfo[1] : 'sha256';
     $rsa = new Crypt_RSA();
     $rsa->setHash($hash);
     $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
     $rsa->setEncryptionMode(CRYPT_RSA_ENCRYPTION_PKCS1);
     $rsa->loadKey($publickey);
     return $rsa->verify($data, $sigBin) === TRUE ? TRUE : FALSE;
 }

//.........这里部分代码省略.........
                     $spot['SubCat'] = (int) substr($list[0], 1);
                 }
                 # else if $recentKey
                 # Break up the subcategories per subcat-type
                 if (strlen($expression) > 0) {
                     $subcats = explode('|', $expression);
                     $spot['SubCatA'] = '';
                     $spot['SubCatB'] = '';
                     $spot['SubCatC'] = '';
                     $spot['SubCatD'] = '';
                     foreach ($subcats as $subcat) {
                         if (array_search(strtolower(substr($subcat, 0, 1)), array('a', 'b', 'c', 'd')) !== false) {
                             $spot['SubCat' . strtoupper(substr($subcat, 0, 1))] .= $subcat . '|';
                         }
                         # if
                     }
                     # foreach
                 }
                 # if
                 if (strpos($subj, "=?") !== false && strpos($subj, "?=") !== false) {
                     # Make sure its as simple as possible
                     $subj = str_replace("?= =?", "?==?", $subj);
                     $subj = str_replace("\r", "", trim($this->OldEncodingParse($subj)));
                     $subj = str_replace("\n", "", $subj);
                 }
                 # if
                 if ($recentKey) {
                     if (strpos($subj, "|") !== false) {
                         $tmp = explode("|", $subj);
                         $spot['Title'] = trim($tmp[0]);
                         $spot['Tag'] = trim($tmp[1]);
                     } else {
                         $spot['Title'] = trim($subj);
                         $spot['Tag'] = '';
                     }
                     # else
                 } else {
                     $tmp = explode("|", $subj);
                     if (count($tmp) <= 1) {
                         $tmp = array($subj);
                     }
                     # if
                     $spot['Tag'] = trim($tmp[count($tmp) - 1]);
                     # remove the tags from the array
                     array_pop($tmp);
                     array_pop($tmp);
                     $spot['Title'] = trim(implode('|', $tmp));
                     if (strpos($spot['Title'], chr(0xc2)) !== false | strpos($spot['Title'], chr(0xc3)) !== false) {
                         $spot['Title'] = trim($this->OldEncodingParse($spot['Title']));
                     }
                     # if
                 }
                 # if recentKey
                 $spot['Stamp'] = $fields[$_STAMP];
                 if (strlen($spot['Title']) != 0 && strlen($spot['Poster']) != 0 && ($spot['ID'] >= 1000000 || $recentKey)) {
                     # Vanaf spot-id 1385910 komen we KeyID's 2 tegen, dus vanaf daar gaan we alle niet-signed posts weigeren.
                     $mustbeSigned = $recentKey | !$recentKey & $spot['ID'] > 1385910;
                     # FIXME
                     #
                     # somehow there is a check that the key is only validated for spots with key id 2 ?
                     # not sure about the code as it only seems to execute for more than 25000 spots or something?
                     #
                     $mustbeSigned = $mustbeSigned & $spot['KeyID'] >= 2;
                     # and verify the signature it
                     if ($mustbeSigned) {
                         $spot['HeaderSign'] = $fields[count($fields) - 1];
                         if (strlen($spot['HeaderSign']) != 0) {
                             $spot['WasSigned'] = true;
                             # This is the string to verify
                             $toCheck = $spot['Title'] . substr($spot['Header'], 0, strlen($spot['Header']) - strlen($spot['HeaderSign']) - 1) . $spot['Poster'];
                             # Initialize the public key to verify with
                             $pubKey['n'] = new Math_BigInteger(base64_decode($rsakeys[$spot['KeyID']]['modulo']), 256);
                             $pubKey['e'] = new Math_BigInteger(base64_decode($rsakeys[$spot['KeyID']]['exponent']), 256);
                             # the signature this header is signed with
                             $signature = base64_decode($this->UnspecialString($spot['HeaderSign']));
                             # and verify the signature
                             $rsa = new Crypt_RSA();
                             $rsa->loadKey($pubKey, CRYPT_RSA_PUBLIC_FORMAT_RAW);
                             $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
                             # Supress notice if the signature was invalid
                             $saveErrorReporting = error_reporting(E_ERROR);
                             $spot['Verified'] = $rsa->verify($toCheck, $signature);
                             error_reporting($saveErrorReporting);
                         }
                         # if
                     } else {
                         $spot['Verified'] = true;
                         $spot['WasSigned'] = false;
                     }
                     # if doesnt need to be signed, pretend that it is
                 }
                 # if
             }
             # if
         }
         # if
     }
     # if
     return $spot;
 }

function sixscan_signatures_update_check_ssl_signature($response_data, $response_headers)
{
    if (isset($response_headers[SIXSCAN_SIGNATURE_HEADER_NAME])) {
        $openssl_sha1_signature = $response_headers[SIXSCAN_SIGNATURE_HEADER_NAME];
    } else {
        return "SixScan signature not present in the response";
    }
    /*	Verify that program data was signed by 6Scan */
    if (function_exists('openssl_verify')) {
        $sig_ver_result = openssl_verify($response_data, base64_decode($openssl_sha1_signature), SIXSCAN_SIGNATURE_PUBLIC_KEY);
        if ($sig_ver_result != 1) {
            return "openssl_verify() failed with error code " . $sig_ver_result;
        }
    } else {
        /*	If there is no openssl library, fallback to pure PHP implementation of RSA signature verification, take from
        			http://phpseclib.sourceforge.net/   */
        include 'Crypt/RSA.php';
        $rsa = new Crypt_RSA();
        /*	SHA1 key is chosen by default */
        $rsa->loadKey(SIXSCAN_SIGNATURE_PUBLIC_KEY);
        $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);
        if ($rsa->verify($response_data, base64_decode($openssl_sha1_signature)) == FALSE) {
            return "Crypt_RSA->verify() failed";
        }
    }
    return TRUE;
}