小编Fra*_*ank的帖子

这是对这个问题的跟进,但我正在尝试将C#代码移植到Java而不是Ruby代码到C#,就像相关问题中的情况一样.我正在尝试验证从Recurly.js api返回的加密签名是否有效.不幸的是,Recurly没有Java库来协助验证,所以我必须自己实现签名验证.

根据上面的相关问题(this),以下C#代码可以生成验证Recurly返回的签名所需的哈希:

var privateKey = Configuration.RecurlySection.Current.PrivateKey;
var hashedKey = SHA1.Create().ComputeHash(Encoding.UTF8.GetBytes(privateKey));
var hmac = new HMACSHA1(hashedKey);
var hash = hmac.ComputeHash(Encoding.ASCII.GetBytes(dataToProtect));
return BitConverter.ToString(hash).Replace("-", "").ToLower();

Recurly在其签名文档页面上提供以下示例数据:

未加密的验证消息:[1312701386,transactioncreate,[account_code:ABC,amount_in_cents:5000,货币:美元]]

私钥:0123456789ABCDEF0123456789ABCDEF

结果签名:0f5630424b32402ec03800e977cd7a8b13dbd153-1312701386

这是我的Java实现:

String unencryptedMessage = "[1312701386,transactioncreate,[account_code:ABC,amount_in_cents:5000,currency:USD]]";
String privateKey = "0123456789ABCDEF0123456789ABCDEF";
String encryptedMessage = getHMACSHA1(unencryptedMessage, getSHA1(privateKey));

private static byte[] getSHA1(String source) throws NoSuchAlgorithmException, UnsupportedEncodingException{
    MessageDigest md = MessageDigest.getInstance("SHA-1");
    byte[] bytes = md.digest(source.getBytes("UTF-8"));
    return bytes;
}

private static String getHMACSHA1(String baseString, byte[] keyBytes) throws GeneralSecurityException, …