0x1 前言

今天因為時間不是很夠，所以很快地介紹 Message 解密的部分

0x2 Message 解密

• 因為 AES 是對稱性加密，所以能被還原。
• 加密時運用到的有兩個東西，分別為 Hash Id 以及 IV，而昨天有看到同為挑戰此次的鐵人賽的文章，裡面有提到這裡用的填充方式是 PKCS7 標準，所以只要讀訊息的最後一位，就能知道要移除多少被填充的字元

https://ithelp.ithome.com.tw/articles/10263469

• 流程如下
  1. 取得 Nonce : 會在回覆內文附上
  2. 計算 Hash Id : 這裡跟第 4 天的計算方式一樣，銀行提供的 4 把 key 來做 XOR 運算
  3. 計算 IV : 根據第一步的 Nonce 來計算
  4. 解密內文

範例提供的回覆內容

{
    "Version": "1.0.0",
    "ShopNo": "BA0026_001",
    "APIService": "OrderCreate",
    "Sign": "24CBD10DC8752BF5AEB55EC930F1D57638312D2BD1A7E3EBF0E45DA78721CF04",
    "Nonce": "NjM2NjA0MzI4ODU1MDcuMzo1MzE5ZWIwNGZjNzZlZGJhOGM5M2U1YTM0Nzk2MGM5NThhZjJiMTFiYjNiYmZmNjk1ZGMzYTFlMTEyMDA0MGU2",
    "Message": "8C3CFD579B58FDAC6C1DF8C8EB8B79F49DD533F8D8C5DC181074397D21E7364E26D347DF264C76A59886DEA58F742C068BB66D6918791797B4DC31245E8E621F3791938F0A716AC20BFDC50A268CF9FDAF01149B73F8E5A2D61928AB79E30CA35C7DD55698010FEC071C2628444348C7B628ED4DCEE281234C31617B5441A3C64466A824BC8907A2D8571F58C4F780EBBB5D6DD98631A867A807718FDD34833FFB2C72F2731D715A35F1BA145C8D1E656136623FFD60EFDAAB87EF1674EA1BD19868DCBC6552D48D9728AB020E75AA6E7804FB9D7FB4AA7E92F89DFFCFA9D263EE9B043AA7A8DB22ECA894F8D5621BF8E6DF5B250CCA9D1C499EF8896B64617FD9FCF142665EA3A660DC6B7296CFE03C80B6FC96CA5B805ADEE4AF9784FF1A6886FCE42C7FA4575FFF4D3AD302B583D08346DD4F876A7BF2B60D514CA021F62293E960458BF886C6CB746A6EEE0EBB3916EE6B861B32D75CE93F8988215D76DEFEE72F4429B2ED48A5AB8FF04683B409FF8072EB1C5E5162EDC625557328F506520AE3DBD2C19F6327AA97911BF2789373CE4DBBB6EC52A2EB9263ADAB1767B4FC7646440BA34E3716BC25E81A86FE5EF432E0C8D40A5BC25EDE8E2D1CC56A2C"
}

節省時間，直接參考範例程式，加密反向操作

function DecryptAesCBC($data, $key, $iv) {
    $result = '';

    $encrypt = hex2bin($data);

    $decrypt = openssl_decrypt($encrypt, 'AES-256-CBC', $key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $iv);

    $padding = ord($decrypt[strlen($decrypt) - 1]);
    $result = substr($decrypt, 0, -$padding);

    return $result;
}

搭配自己前兩天寫的函數

$responce = WebApi($nonce_url, ['ShopNo' => "BA0026_001"]);
$hash_id = calcHashID($a1, $a2, $b1, $b2);
$iv = calcurateIv($responce['Nonce']);

$message = DecryptAesCBC($responce['Message'], $hash_id, $iv);
$reply = json_decode($message, true);
/* result: [
    "OrderNo" => "A201804270001",
    "ShopNo" => "BA0026_001",
    "TSNo" => "BA002600000037",
    "PayType" => "A",
    "Amount" => 50000,
    "Status" => "S",
    "Description" => "S0000 – 處理成功",
    "ATMParam" => [
    "AtmPayNo" => "99922511001200",
    "WebAtmURL" => "http://10.11.34.58:7101/QPay.WebPaySite/Bridge/PayWebATM?TD=BA002600000037&TK=6fecec25-daae-4b5b-b45e-80bc9ee6f7ed",
    "OtpURL" => "http://10.11.34.58:7101/QPay.WebPaySite/Bridge/PayOTP?TD=BA002600000037&TK=6fecec25-daae-4b5b-b45e-80bc9ee6f7ed",
    ],
]
*/

0x3 今日小結

今天突然擠一堆事情進來，沒想到要連續發文真的很困難，才第六天就想放棄了

明天會先針 Laravel 連接資料庫的設定，以及資料表的開立
今天就先這樣，明天見