javascript - 如何使用Javascript WebCrypto API加载PKCS＃12数字证书

我正在尝试使用WebCrypto API签名数据，但不是创建私钥/公钥并将其导出到pkcs＃1或8，而是希望使用用户的PKCS＃12签名数据。我已经阅读了W3C规范，但不能做太多事情，也找不到关于如何执行此操作的任何好 Material 。现在，我想将ActiveX和Java Applets放在一旁。有没有办法调整以下内容:

var buffer = encode(prompt("Please enter your password"));
    //TODO:
    //implement a prompt for a pfx or cert

  return crypto.subtle.importKey("raw", buffer, "PBKDF2", false, usages);
    //TODO:
    //instead of importing it, ask for the certificate's pass to sign data
    //with crypto.subtle.sign

有指针吗？

更新
这是我一直在工作的代码

<script src="forge.min.js"></script>

<script>
    var errorsReportedByVerifier;
    errorsReportedByVerifier = checkStorage() && checkBrowserAPIs();
    if (!errorsReportedByVerifier){
        console.log("adding click event");
        document.getElementById('btnPfx').addEventListener('click', handlePFXFile, false);
        storeVariables();
        getVariables();
    }


    function handlePFXFile(evnt) {
        console.log("handling pfx")
        //alert(document.getElementById('pfx').value);

        //error happens in 1st line
        //error object does not accept property replace
        //forge.min.js Line 1, Column: 17823
        var p12Der = forge.util.decode64(document.getElementById('pfx').valueOf());
        //var pkcs12Asn1 = forge.asn1.fromDer(p12Der);
        //var pkcs12 = forge.pkcs12.pkcs12FromAsn1(pkcs12Asn1, false, 'pss');
        console.log("pkcs12");
    }
</script>

最佳答案

Web加密API不支持PKCS＃12。您可以使用第三方库将p12解码为伪造https://github.com/digitalbazaar/forge#pkcs12并在webcrypto中加载privateKey

读取PKCS＃12证书

PKCS＃12存储在DER中，因此首先从文件中读取它或使用预存储的base64

//Reading certificate from a 'file' form field
var reader = new FileReader();
reader.onload = function(e) {
    var contents = e.target.result;
    var pkcs12Der = arrayBufferToString(contents)
    var pkcs12B64 = forge.util.encode64(pkcs12Der);
    //do something else...

}
reader.readAsArrayBuffer(file);

function arrayBufferToString( buffer ) {
    var binary = '';
    var bytes = new Uint8Array( buffer );
    var len = bytes.byteLength;
    for (var i = 0; i < len; i++) {
        binary += String.fromCharCode( bytes[ i ] );
    }
    return binary;
}

//p12 certificate stored in Base64 format
var pkcs12Der= forge.util.decode64(pkcs12B64);

使用伪造解码PKCS＃12并提取私钥

然后将DER格式解码为ASN1，然后让伪造读取内容

var pkcs12Asn1 = forge.asn1.fromDer(pkcs12Der);
var pkcs12 = forge.pkcs12.pkcs12FromAsn1(pkcs12Asn1, false, password);

然后从所需证书的pkcs12中获取私钥(请参阅伪造文档)，并转换为PKCS＃8以通过webcrypto导入

// load keypair and cert chain from safe content(s)
for(var sci = 0; sci < pkcs12.safeContents.length; ++sci) {
    var safeContents = pkcs12.safeContents[sci];

    for(var sbi = 0; sbi < safeContents.safeBags.length; ++sbi) {
        var safeBag = safeContents.safeBags[sbi];

        // this bag has a private key
        if(safeBag.type === forge.pki.oids.keyBag) {
            //Found plain private key
            privateKey = safeBag.key;
        } else if(safeBag.type === forge.pki.oids.pkcs8ShroudedKeyBag) {
            // found encrypted private key
            privateKey = safeBag.key;
        } else if(safeBag.type === forge.pki.oids.certBag) {
            // this bag has a certificate...
        }
    }
}

转换为PKCS＃8

function _privateKeyToPkcs8(privateKey) {
     var rsaPrivateKey = forge.pki.privateKeyToAsn1(privateKey);
     var privateKeyInfo = forge.pki.wrapRsaPrivateKey(rsaPrivateKey);
     var privateKeyInfoDer = forge.asn1.toDer(privateKeyInfo).getBytes();
     var privateKeyInfoDerBuff = stringToArrayBuffer(privateKeyInfoDer);
     return privateKeyInfoDerBuff;
 }
 function stringToArrayBuffer(data){
     var arrBuff = new ArrayBuffer(data.length);
     var writer = new Uint8Array(arrBuff);
     for (var i = 0, len = data.length; i < len; i++) {
         writer[i] = data.charCodeAt(i);
     }
     return arrBuff;
  }

Webcrypto中的导入密钥

最后将密钥导入webcrypto

function _importCryptoKeyPkcs8(privateKey,extractable) {
    var privateKeyInfoDerBuff = _privateKeyToPkcs8(privateKey);

    //Import the webcrypto key
    return crypto.subtle.importKey(
            'pkcs8',
            privateKeyInfoDerBuff,
            { name: "RSASSA-PKCS1-v1_5", hash:{name:"SHA-256"}},
            extractable,
            ["sign"]);

}
_importCryptoKeyPkcs8(entry.privateKey,extractable).
        then(function(cryptoKey) {
            //your cryptokey is here!!!
        });

数字签名

通过上述方法返回的导入的cryptoKey，您可以使用webcrypto签名。

var digestToSign = forge.util.decode64(digestToSignB64);
var digestToSignBuf = stringToArrayBuffer(digestToSign);

crypto.subtle.sign(
            {name: "RSASSA-PKCS1-v1_5"},
            cryptoKey,
            digestToSignBuf)
.then(function(signature){
    signatureB64 = forge.util.encode64(arrayBufferToString(signature))
});

我包括来自base64的编码，因为数据转换并非易事

在pkc12中，如果您需要构建高级格式(如AdES)，则还具有认证链

关于javascript - 如何使用Javascript WebCrypto API加载PKCS＃12数字证书，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/36018233/