Sertifikat olingYANGIW3Schools ilovasiiOS va AndroidSarguzashtni boshlang

Sign ma’lumotnomasi

ULASHISH

Obyektni imzolash

Sign klassi Node.js crypto modulining bir qismidir. Bu kriptografik raqamli imzolarni yaratish usulini taqdim etadi. Sign instances crypto.createSign() usuli yordamida yaratiladi.

Raqamli imzolar xabarning haqiqiyligi va yaxlitligini tekshirishga imkon beradi, bu esa xabarning ma’lum jo‘natuvchi tomonidan yaratilganligini va tranzit paytida o‘zgartirilmaganligini ta’minlaydi.

Kripto modulini import qilish

// Import the crypto module
const crypto = require('crypto');

// Create a Sign object
const sign = crypto.createSign('RSA-SHA256');
Misolni ishga tushirish »

Belgilash usullari

Metod Tavsif
sign.update(data[, inputEncoding]) Sign tarkibini berilgan data bilan yangilaydi. Agar inputEncoding ko‘rsatilgan bo‘lsa, data belgilangan kodlashdan foydalanadigan stringdir; aks holda, data buffer, TypedArray yoki DataView hisoblanadi. Ushbu metodni yangi ma’lumotlar bilan bir necha marta chaqirish mumkin.
sign.sign(privateKey[, outputEncoding]) sign.update() yordamida Signga o‘tkazilgan barcha ma’lumotlarga imzoni hisoblab chiqadi. privateKey - bu PEM-kodlangan shaxsiy kalit yoki "xususiy" turdagi KeyObject-ni o‘z ichiga olgan string yoki buffer. Agar outputEncoding berilsa, string qaytariladi; aks holda buffer qaytariladi.

Asosiy belgi misoli

Quyidagi misol xabarning raqamli imzosini qanday yaratishni ko‘rsatadi:

const crypto = require('crypto');
const fs = require('fs');

// Generate a keypair for this example
function generateKeyPair() {
  return crypto.generateKeyPairSync('rsa', {
    modulusLength: 2048,
    publicKeyEncoding: {
      type: 'spki',
      format: 'pem'
    },
    privateKeyEncoding: {
      type: 'pkcs8',
      format: 'pem'
    }
  });
}

// For this example, generate keys in memory
// In a real application, you would load existing keys from storage
const { privateKey, publicKey } = generateKeyPair();

// Message to sign
const message = 'This is a message to be signed';

// Create a Sign object
const sign = crypto.createSign('SHA256');

// Update with the message
sign.update(message);

// Sign the message with the private key
const signature = sign.sign(privateKey, 'hex');

console.log('Message:', message);
console.log('Signature:', signature);

// We'll save these for the verification example
fs.writeFileSync('message.txt', message);
fs.writeFileSync('signature.hex', signature);
fs.writeFileSync('public_key.pem', publicKey);
Misolni ishga tushirish »

Turli xil algoritmlar bilan imzolash

Sign klassi kripto provayderiga qarab turli imzo algoritmlarini qo‘llab-quvvatlaydi:

const crypto = require('crypto');

// Generate key pairs for different algorithms
function generateRSAKeyPair() {
  return crypto.generateKeyPairSync('rsa', {
    modulusLength: 2048,
    publicKeyEncoding: {
      type: 'spki',
      format: 'pem'
    },
    privateKeyEncoding: {
      type: 'pkcs8',
      format: 'pem'
    }
  });
}

function generateECKeyPair() {
  return crypto.generateKeyPairSync('ec', {
    namedCurve: 'prime256v1',
    publicKeyEncoding: {
      type: 'spki',
      format: 'pem'
    },
    privateKeyEncoding: {
      type: 'sec1',
      format: 'pem'
    }
  });
}

// Generate different key pairs
const rsaKeys = generateRSAKeyPair();
const ecKeys = generateECKeyPair();

// Message to sign
const message = 'Message to sign with different algorithms';

// Function to sign with a specific algorithm
function signWithAlgorithm(algorithm, privateKey, message) {
  try {
    const sign = crypto.createSign(algorithm);
    sign.update(message);
    return sign.sign(privateKey, 'hex');
  } catch (error) {
    return `Error: ${error.message}`;
  }
}

// Test various signature algorithms
console.log(`Message: "${message}"`);
console.log('-----------------------------------------------');

// RSA signatures with different hash algorithms
console.log('RSA-SHA256:', signWithAlgorithm('SHA256', rsaKeys.privateKey, message));
console.log('RSA-SHA384:', signWithAlgorithm('SHA384', rsaKeys.privateKey, message));
console.log('RSA-SHA512:', signWithAlgorithm('SHA512', rsaKeys.privateKey, message));

console.log('-----------------------------------------------');

// ECDSA signatures
console.log('ECDSA-SHA256:', signWithAlgorithm('SHA256', ecKeys.privateKey, message));
console.log('ECDSA-SHA384:', signWithAlgorithm('SHA384', ecKeys.privateKey, message));
Misolni ishga tushirish »

Mavjud imzo algoritmlari Node.js versiyangizga va o‘rnatilgan OpenSSL versiyasiga bog‘liq. Umumiy imzo algoritmlari quyidagilarni o‘z ichiga oladi:

Algoritm Tavsif Asosiy turlari
RSA-SHA256 SHA-256 xeshli RSA imzosi RSA
RSA-SHA384 SHA-384 xeshli RSA imzosi RSA
RSA-SHA512 SHA-512 xeshli RSA imzosi RSA
RSA-PSS-SHA256 SHA-256 xeshli RSA-PSS imzosi RSA
ECDSA-SHA256 SHA-256 xeshli ECDSA imzosi EC
ECDSA-SHA384 SHA-384 xeshli ECDSA imzosi EC
Ed25519 EdDSA signature using Curve25519 Ed25519
Ed448 EdDSA signature using Curve448 Ed448

Bir nechta update() chaqiruvi bilan imzolash

Imzoni hisoblashdan oldin bir nechta ma’lumotlar bo‘laklari bilan Sign obyektini yangilashingiz mumkin:

const crypto = require('crypto');

// Generate a keypair for this example
const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem'
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem'
  }
});

// Create a Sign object
const sign = crypto.createSign('SHA256');

// Update with multiple pieces of data
sign.update('First part of the message. ');
sign.update('Second part of the message. ');
sign.update('Third part of the message.');

// Create the signature
const signature = sign.sign(privateKey, 'hex');

console.log('Combined message: First part of the message. Second part of the message. Third part of the message.');
console.log('Signature:', signature);

// You can achieve the same result with a single update
const singleSign = crypto.createSign('SHA256');
singleSign.update('First part of the message. Second part of the message. Third part of the message.');
const singleSignature = singleSign.sign(privateKey, 'hex');

console.log('Single update signature matches multiple updates?', singleSignature === signature);
Misolni ishga tushirish »

Fayllarni imzolash

Fayl mazmuni uchun raqamli imzo yaratishingiz mumkin:

const crypto = require('crypto');
const fs = require('fs');

// Function to sign a file
function signFile(filePath, privateKey, algorithm = 'SHA256') {
  return new Promise((resolve, reject) => {
    // Create Sign object
    const sign = crypto.createSign(algorithm);
    
    // Create read stream
    const readStream = fs.createReadStream(filePath);
    
    // Handle stream events
    readStream.on('data', (data) => {
      sign.update(data);
    });
    
    readStream.on('end', () => {
      // Create signature
      const signature = sign.sign(privateKey, 'hex');
      resolve(signature);
    });
    
    readStream.on('error', (error) => {
      reject(error);
    });
  });
}

// Generate a keypair for this example
const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem'
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem'
  }
});

// Save the public key for verification
fs.writeFileSync('public_key_file.pem', publicKey);

// Example usage (adjust file path as needed)
const filePath = 'example_to_sign.txt';

// Create a test file if it doesn't exist
if (!fs.existsSync(filePath)) {
  fs.writeFileSync(filePath, 'This is a test file for digital signature.\n'.repeat(100));
  console.log(`Created test file: ${filePath}`);
}

// Sign the file
signFile(filePath, privateKey)
  .then(signature => {
    console.log(`File: ${filePath}`);
    console.log(`Signature: ${signature}`);
    
    // Save the signature for later verification
    fs.writeFileSync(`${filePath}.sig`, signature);
    console.log(`Signature saved to: ${filePath}.sig`);
  })
  .catch(error => {
    console.error('Error signing file:', error.message);
  });
Misolni ishga tushirish »

Har xil turdagi kalitlardan foydalanish

Sign klassi shaxsiy kalitlarning turli formatlari bilan ishlashi mumkin:

const crypto = require('crypto');

// Message to sign
const message = 'Message to sign with different key formats';

// Function to sign with different key formats
function signWithKey(privateKey, keyFormat) {
  try {
    const sign = crypto.createSign('SHA256');
    sign.update(message);
    return {
      format: keyFormat,
      signature: sign.sign(privateKey, 'hex')
    };
  } catch (error) {
    return {
      format: keyFormat,
      error: error.message
    };
  }
}

// Generate a new RSA key pair
const { privateKey: pemPrivateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem'
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem'
  }
});

console.log(`Message: "${message}"`);

// 1. Sign with PEM-encoded private key (string)
console.log('\n1. PEM-encoded private key (string):');
console.log(signWithKey(pemPrivateKey, 'PEM string'));

// 2. Sign with PEM-encoded private key (buffer)
console.log('\n2. PEM-encoded private key (buffer):');
console.log(signWithKey(Buffer.from(pemPrivateKey), 'PEM buffer'));

// 3. Sign with KeyObject
console.log('\n3. KeyObject:');
const keyObject = crypto.createPrivateKey(pemPrivateKey);
console.log(signWithKey(keyObject, 'KeyObject'));

// 4. Sign with PassThrough crypto engine (if available)
try {
  // Note: This might not be available in all Node.js versions/configurations
  console.log('\n4. Private key with engine:');
  const engineKey = {
    key: pemPrivateKey,
    padding: crypto.constants.RSA_PKCS1_PADDING
  };
  console.log(signWithKey(engineKey, 'Key with options'));
} catch (error) {
  console.log('\n4. Private key with engine:');
  console.log({ format: 'Key with options', error: error.message });
}

// 5. Sign with JSON Web Key (JWK)
// Note: This requires conversion, as Node.js doesn't directly support JWK for sign
console.log('\n5. JWK (requires conversion):');
try {
  // This is a simplified example - actual JWK handling would be more complex
  const pemToJwk = require('pem-jwk').pem2jwk; // You would need to install this package
  const jwk = pemToJwk(pemPrivateKey);
  console.log({ format: 'JWK', note: 'JWK needs to be converted to PEM or KeyObject first' });
} catch (error) {
  console.log({ format: 'JWK', note: 'Example requires pem-jwk package' });
}
Misolni ishga tushirish »

To‘liq imzolash va tasdiqlash misoli

Ushbu misol raqamli imzoni yaratish va tekshirishning to‘liq jarayonini ko‘rsatadi:

const crypto = require('crypto');

// Generate a keypair
const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem'
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem'
  }
});

// Original message
const message = 'This is the original message to sign and verify';
console.log(`Original message: "${message}"`);

// Sign the message
function signMessage(message, privateKey) {
  const sign = crypto.createSign('SHA256');
  sign.update(message);
  return sign.sign(privateKey, 'hex');
}

const signature = signMessage(message, privateKey);
console.log(`Signature: ${signature}`);

// Verify the message (using the Verify class)
function verifySignature(message, signature, publicKey) {
  const verify = crypto.createVerify('SHA256');
  verify.update(message);
  return verify.verify(publicKey, signature, 'hex');
}

// Verify the original message
const isValidOriginal = verifySignature(message, signature, publicKey);
console.log(`Original message verification: ${isValidOriginal}`);

// Try to verify a tampered message
const tamperedMessage = message + ' with some tampering';
const isValidTampered = verifySignature(tamperedMessage, signature, publicKey);
console.log(`Tampered message verification: ${isValidTampered}`);

// Try to use a different public key
const { publicKey: differentPublicKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem'
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem'
  }
});

const isValidDifferentKey = verifySignature(message, signature, differentPublicKey);
console.log(`Verification with different public key: ${isValidDifferentKey}`);
Misolni ishga tushirish »

DSA va ECDSA imzolari

Ushbu misol raqamli imzolar uchun DSA va ECDSA dan foydalanishni ko‘rsatadi:

const crypto = require('crypto');

// Message to sign
const message = 'Message for DSA and ECDSA signatures';

// Generate ECDSA key pair
function generateECKeyPair(curveName = 'prime256v1') {
  return crypto.generateKeyPairSync('ec', {
    namedCurve: curveName,
    publicKeyEncoding: {
      type: 'spki',
      format: 'pem'
    },
    privateKeyEncoding: {
      type: 'sec1', // or 'pkcs8'
      format: 'pem'
    }
  });
}

// Function to sign and verify with a specific algorithm and key pair
function testSignatureAlgorithm(algorithm, keyType, keyPair, message) {
  try {
    // Sign the message
    const sign = crypto.createSign(algorithm);
    sign.update(message);
    const signature = sign.sign(keyPair.privateKey, 'hex');
    
    // Verify the signature
    const verify = crypto.createVerify(algorithm);
    verify.update(message);
    const isValid = verify.verify(keyPair.publicKey, signature, 'hex');
    
    return {
      algorithm: `${keyType}-${algorithm}`,
      signatureLength: signature.length / 2, // Convert hex to bytes
      isValid
    };
  } catch (error) {
    return {
      algorithm: `${keyType}-${algorithm}`,
      error: error.message
    };
  }
}

// Test ECDSA with different curves
const curves = ['prime256v1', 'secp384r1', 'secp521r1'];

console.log(`Message: "${message}"`);
console.log('\nECDSA Signatures:');

curves.forEach(curve => {
  const ecKeyPair = generateECKeyPair(curve);
  
  // Test with different hash algorithms
  const hashAlgos = ['SHA256', 'SHA384', 'SHA512'];
  
  hashAlgos.forEach(hashAlgo => {
    const result = testSignatureAlgorithm(hashAlgo, `ECDSA-${curve}`, ecKeyPair, message);
    console.log(result);
  });
});

// Test EdDSA if available
try {
  console.log('\nEdDSA Signatures:');
  
  // Ed25519
  const ed25519KeyPair = crypto.generateKeyPairSync('ed25519', {
    publicKeyEncoding: {
      type: 'spki',
      format: 'pem'
    },
    privateKeyEncoding: {
      type: 'pkcs8',
      format: 'pem'
    }
  });
  
  // Sign with Ed25519
  const sign = crypto.createSign('SHA512'); // Hash algorithm is ignored for Ed25519
  sign.update(message);
  const signature = sign.sign(ed25519KeyPair.privateKey, 'hex');
  
  // Verify with Ed25519
  const verify = crypto.createVerify('SHA512');
  verify.update(message);
  const isValid = verify.verify(ed25519KeyPair.publicKey, signature, 'hex');
  
  console.log({
    algorithm: 'Ed25519',
    signatureLength: signature.length / 2,
    isValid
  });
} catch (error) {
  console.log({
    algorithm: 'Ed25519',
    error: error.message
  });
}
Misolni ishga tushirish »

OpenSSL Options bilan imzolash

Muayyan OpenSSL opsiyalari bilan kengaytirilgan imzolash:

const crypto = require('crypto');

// Generate RSA key pair
const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem'
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem'
  }
});

// Message to sign
const message = 'Message to sign with different options';

// Function to sign with specific options
function signWithOptions(algorithm, message, privateKey, options = {}) {
  try {
    // Create private key with options
    const keyWithOptions = {
      key: privateKey,
      ...options
    };
    
    // Sign the message
    const sign = crypto.createSign(algorithm);
    sign.update(message);
    return sign.sign(keyWithOptions, 'hex');
  } catch (error) {
    return `Error: ${error.message}`;
  }
}

console.log(`Message: "${message}"`);
console.log('\nRSA Signatures with Different Options:');

// 1. Standard PKCS#1 v1.5 padding (default)
console.log('\n1. Standard PKCS#1 v1.5 padding:');
const sig1 = signWithOptions('SHA256', message, privateKey);
console.log(sig1);

// 2. PSS padding
console.log('\n2. PSS padding:');
const sig2 = signWithOptions('SHA256', message, privateKey, {
  padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
  saltLength: 32
});
console.log(sig2);

// 3. Different salt lengths with PSS padding
console.log('\n3. PSS padding with different salt lengths:');
[20, 32, 48].forEach(saltLength => {
  try {
    const sigSalt = signWithOptions('SHA256', message, privateKey, {
      padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
      saltLength
    });
    console.log(`Salt length ${saltLength}: ${sigSalt.substring(0, 64)}...`);
  } catch (error) {
    console.log(`Salt length ${saltLength}: Error - ${error.message}`);
  }
});

// 4. Try to use no padding (will likely fail for signatures)
console.log('\n4. No padding (expect error):');
const sig4 = signWithOptions('SHA256', message, privateKey, {
  padding: crypto.constants.RSA_NO_PADDING
});
console.log(sig4);
Misolni ishga tushirish »

Xavfsizlik bo‘yicha eng yaxshi amaliyotlar

Raqamli imzodan foydalanganda xavfsizlik bo‘yicha ushbu eng yaxshi amaliyotlarni ko‘rib chiqing:

  1. Kuchli kalitlardan foydalaning: RSA uchun kamida 2048 bitdan foydalaning. ECDSA uchun prime256v1 (P-256) yoki undan kuchliroq kabi egri chiziqlardan foydalaning.
  2. Zamonaviy imzo algoritmlaridan foydalaning: PKCS#1 v1.5 o‘rniga RSA-PSS-ni afzal ko‘ring va yaxshiroq ishlash uchun ECDSA yoki EdDSA-ni ko‘rib chiqing.
  3. Shaxsiy kalitlarni himoya qilish: Shaxsiy kalitlarni xavfsiz saqlang, ehtimol apparat xavfsizlik moduli (HSM) yoki kalitlarni boshqarish xizmatidan foydalaning.
  4. Kuchli xesh algoritmlaridan foydalaning: Asosiy xesh funksiyasi uchun har doim SHA-256 yoki undan kuchliroqdan foydalaning.
  5. Imzolashdan oldin ma’lumotlarni tasdiqlang: Zararli kontentni imzolamaslik uchun mo‘ljallangan ma’lumotlarni imzolaganingizga ishonch hosil qiling.
  6. Kalitlarni aylantirishni ko‘rib chiqing: Imzolash kalitlarini muntazam yangilang, ayniqsa uzoq muddatli ilovalar uchun.
  7. KeyObject-dan foydalaning: Iloji bo‘lsa, xavfsizlikni yaxshilash va nozik kalit materiallariga bevosita kirishning oldini olish uchun KeyObject API-dan foydalaning.

Raqamli imzolar uchun umumiy foydalanish holatlari

  • Kodni imzolash: Dastur paketlari, bajariladigan fayllar yoki skriptlarning haqiqiyligi va yaxlitligini tekshirish uchun imzolash.
  • Hujjatlarni imzolash: PDF va boshqa hujjatlar uchun qonuniy majburiy elektron imzolarni yaratish.
  • JWT imzolash: Xavfsiz autentifikatsiya va avtorizatsiya uchun JSON veb tokenlarini (JWTs) imzolash.
  • API autentifikatsiyasi: API mijozlarining identifikatorini tekshirish va so‘rovning yaxlitligini ta’minlash.
  • Sertifikat imzolash: PKI tizimida sertifikat zanjirlarini yaratish va tasdiqlash.
  • Xavfsiz aloqa: Xavfsiz aloqa protokollarida xabarlarni autentifikatsiya qilish.
‹ OrqagaKeyingisi

W3Schools Pathfinder

Yutuqlaringizni kuzating – bu bepul!

Ro'yxatdan o'tishKirish