代付提单签名规则

使用场景：该签名规则代付提单时使用，回调接口的还是沿用通用的签名(md5)

✅ 签名说明 ：

1. 参数名区分大小写。

2. 如果参数的值为空不参与签名,注意一些特定字段也不参与签名，具体参见接口参数说明。

3. 参数名 ASCIl 码从小到大排序（字典序）。

4. 排序后按照（key1=value1&key2=value2&key3=value3...）的格式拼接成字符串 A。

5. 用A拼接 ’key=密钥值‘ 生成最终字符串 S，key密钥值由商户创建时生成提供，请勿泄露给不相关人员。

6. 使用RSA对字符串S进行加密(填充方式:RSA/ECB/PKCS1Padding)，生成最终字符串 sign作为请求参数之一参与请求api接口，RSA密钥(2048 位 PKCS#8格式,Base64编码无头尾,一行格式)请商户自行生成后，将解密的私钥上传到商户后台，加密的公钥请商户妥善保管，防止盗窃或者丢失。

✅ 签名示例 ：

{
	"merchant_id": "202366100",
	"order_id": "0ec2b66b8afb3752fa9c",
	"amount": "10000",
	"name": "Khaing",
	"bank_code": "HDFC0001234",
	"account": "501001212789",
	"withdraw_type": "1",
	"notify_url": "http://43.218.221.162:8888/cash/tk",
	"phone": "[phone]",
	"email": "[email protected]",
	"currency": "INR",
	"sign": "由其他参数拼接，RSA签名后后生成"
}

示例RSA公钥：

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBFkE1MMG98bmILPnLFMgSJncpUIP10OlJPpMI0NVL1OpUhvIADcC3O3fqXGTdKvk5u65KJLkPz1GeSJlPyKhJr/8uFLQzMAG1X+495HJzc75SCMJXcSA3CVXTty8qs715/Y2L+n0oi0818eFYX7s02YDaRP+TAsJ3fxtD337tpLFQ24UK7/R4dHj2YGymco1K838zeawgJTyCew1P4Yx71ksUgt8T3E3Sq7HFw/jqNmcItoREWGOhM8eC9mWWw+kzfZy7+3HUGclJ62fOXfi2ToLtIB21NeFsnFVVLRY4nCFKvfZjbcsmL8JMbsyTcaHh9x4Dcv4yJMNr9yVgb32wIDAQAB

最终字符串S:

⚠️签名串中的参数不是全部 参数拼接，是部分参数的拼接，具体请看代付参数说明，根据是否参与签名进行排序以及加密

account=501001212789&amount=10000&bank_code=HDFC0001234&merchant_id=202366100&name=Khaing&order_id=0ec2b66b8afb3752fa9c&key=keyValue

RSA公钥加密后为(PKCS1Padding方式，加密串每次是变化的，以下只是随机的一种加密结果)：

JpE8D/Xs3HE2ytpocKKwjI1MW983dQIDc9NXo05rN0as9kIAD+GNclo9h2tGOGa5nfk0sJUB0E9Kd1MC9NKbPUFNRowncj1ecfaoob23BXEJQuI9YvPWSVls2EJTThr264jPGdN8Wx1kYBOCJqc/6P9NkZzGcQkSSb5tOl7IVvy/f700w20R1UZ/k9Q3SI3yPehbvMNMvqTllMlr62tqJGPtaA6kED5VCXqamB4Ti2TnyjzGqRCaMMew7gv00W0oOMnrTd2LtC6vXEHc5+KSb9F0yx8UeFr23G/1gFGBv04VKNQxPlAUZO9kPuTe2grCY9BSOlw9+vXKsMdWaZuNow==

完整请求参数JSON为：

{
    "amount": "10000",
    "currency": "INR",
    "merchant_id": "202366100",
    "notify_url": "https://www.google.com",
    "order_id": "202366100160101",
    "pay_type": "1",
    "return_url": "https://www.google.com",
    "sign": "JpE8D/Xs3HE2ytpocKKwjI1MW983dQIDc9NXo05rN0as9kIAD+GNclo9h2tGOGa5nfk0sJUB0E9Kd1MC9NKbPUFNRowncj1ecfaoob23BXEJQuI9YvPWSVls2EJTThr264jPGdN8Wx1kYBOCJqc/6P9NkZzGcQkSSb5tOl7IVvy/f700w20R1UZ/k9Q3SI3yPehbvMNMvqTllMlr62tqJGPtaA6kED5VCXqamB4Ti2TnyjzGqRCaMMew7gv00W0oOMnrTd2LtC6vXEHc5+KSb9F0yx8UeFr23G/1gFGBv04VKNQxPlAUZO9kPuTe2grCY9BSOlw9+vXKsMdWaZuNow=="
}

✅ JAVA 实现：

   
 public static String encrypt(String plaintext, String base64PublicKey) throws Exception {
        byte[] keyBytes = Base64.getDecoder().decode(base64PublicKey);
        PublicKey pubKey = KeyFactory.getInstance("RSA")
                .generatePublic(new X509EncodedKeySpec(keyBytes));

        Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
        cipher.init(Cipher.ENCRYPT_MODE, pubKey);
        byte[] encryptedBytes = cipher.doFinal(plaintext.getBytes("UTF-8"));
        return Base64.getEncoder().encodeToString(encryptedBytes);
    }

🐘PHP 实现:

function rsa_encrypt($plaintext, $base64PublicKey) {
    $publicKey = "-----BEGIN PUBLIC KEY-----\n" .
                 chunk_split($base64PublicKey, 64, "\n") .
                 "-----END PUBLIC KEY-----";

    openssl_public_encrypt($plaintext, $encrypted, $publicKey, OPENSSL_PKCS1_PADDING);
    return base64_encode($encrypted);
}

🟦 Node.js 实现（使用 crypto模块）:

const crypto = require("crypto");

function rsaEncrypt(plaintext, base64PublicKey) {
    const publicKey = `-----BEGIN PUBLIC KEY-----\n${base64PublicKey.match(/.{1,64}/g).join('\n')}\n-----END PUBLIC KEY-----`;
    const buffer = Buffer.from(plaintext, "utf8");
    const encrypted = crypto.publicEncrypt(
        {
            key: publicKey,
            padding: crypto.constants.RSA_PKCS1_PADDING
        },
        buffer
    );
    return encrypted.toString("base64");
}

🟨 Go 实现（使用 crypto/rsa+ encoding/pem）:

import (
    "crypto/rsa"
    "crypto/x509"
    "crypto/rand"
    "encoding/base64"
    "encoding/pem"
    "errors"
    "strings"
)

func RsaEncrypt(plaintext string, base64PublicKey string) (string, error) {
    keyPem := "-----BEGIN PUBLIC KEY-----\n" + insertLineBreaks(base64PublicKey, 64) + "\n-----END PUBLIC KEY-----"
    block, _ := pem.Decode([]byte(keyPem))
    if block == nil {
        return "", errors.New("failed to parse PEM block")
    }

    pub, err := x509.ParsePKIXPublicKey(block.Bytes)
    if err != nil {
        return "", err
    }

    rsaPub, ok := pub.(*rsa.PublicKey)
    if !ok {
        return "", errors.New("not RSA public key")
    }

    encryptedBytes, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPub, []byte(plaintext))
    if err != nil {
        return "", err
    }

    return base64.StdEncoding.EncodeToString(encryptedBytes), nil
}

func insertLineBreaks(s string, every int) string {
    var b strings.Builder
    for i := 0; i < len(s); i += every {
        end := i + every
        if end > len(s) {
            end = len(s)
        }
        b.WriteString(s[i:end] + "\n")
    }
    return b.String()
}

✅ C++ 实现（使用 OpenSSL）:

#include <openssl/rsa.h>
#include <openssl/pem.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <iostream>
#include <string>
#include <vector>
#include <memory>
#include <openssl/buffer.h>

std::string base64Decode(const std::string &input) {
    BIO *bio, *b64;
    int decodeLen = (int)input.length() * 3 / 4;
    std::vector<char> buffer(decodeLen);
    bio = BIO_new_mem_buf(input.c_str(), -1);
    b64 = BIO_new(BIO_f_base64());
    bio = BIO_push(b64, bio);
    BIO_set_flags(bio, BIO_FLAGS_BASE64_NO_NL);
    int len = BIO_read(bio, buffer.data(), (int)input.length());
    BIO_free_all(bio);
    return std::string(buffer.data(), len);
}

std::string rsaEncrypt(const std::string &plaintext, const std::string &base64PubKey) {
    std::string pubKeyPem = base64Decode(base64PubKey);

    BIO* bio = BIO_new_mem_buf((void*)pubKeyPem.c_str(), -1);
    RSA* rsa = PEM_read_bio_RSA_PUBKEY(bio, nullptr, nullptr, nullptr);
    BIO_free(bio);

    if (!rsa) {
        throw std::runtime_error("Failed to load public key");
    }

    std::vector<unsigned char> encrypted(RSA_size(rsa));
    int len = RSA_public_encrypt(plaintext.length(),
                                 (const unsigned char*)plaintext.c_str(),
                                 encrypted.data(),
                                 rsa,
                                 RSA_PKCS1_PADDING);

    RSA_free(rsa);

    if (len == -1) {
        throw std::runtime_error("RSA encryption failed");
    }

    return std::string(encrypted.begin(), encrypted.begin() + len);
}

✅ C# 实现(.NET) ：

using System;
using System.Security.Cryptography;
using System.Text;

public class RSAEncryptor
{
    public static string Encrypt(string plaintext, string base64PublicKey)
    {
        byte[] keyBytes = Convert.FromBase64String(base64PublicKey);
        using (var rsa = RSA.Create())
        {
            rsa.ImportSubjectPublicKeyInfo(keyBytes, out _);
            var data = Encoding.UTF8.GetBytes(plaintext);
            var encrypted = rsa.Encrypt(data, RSAEncryptionPadding.Pkcs1);
            return Convert.ToBase64String(encrypted);
        }
    }
}

商户后台上传密钥说明：

✅ 补充说明

1. 公钥必须是 X.509 格式的 RSA 公钥，Base64 编码字符串，和 Java 的 X509EncodedKeySpec 匹配。

2. 所有语言的输出是 Base64 编码的密文字符串。

3. 加密结果在跨语言中应保持一致，只要公钥和填充方式一致。

4. 加密使用相同的算法（RSA/ECB/PKCS1Padding）和 Base64 编码。

5. 示例代码都是常见的库实现方案，涉及到代码调试不做技术支持，请自行解决。

6. 加密的字段不是所有的请求参数是选择部分加密的，加起来长度不会超过245，不用分块。