Question

我正在尝试测试我的服务器端IAB签名验证方法。我想使用我的公钥和私钥（不是谷歌的那些），所以我伪造收据并用id_rsa.pub签名：

openssl dgst -binary -sha1 -sign /Users/user/.ssh/id_rsa receipt.json | openssl base64 > signature.txt

在php中我想用openssl_verify验证它：

$publicKey = // content of /Users/user/.ssh/id_rsa.pub

// Public key in id_rsa.pub with proper header and footer
$publicKeyFull = "-----BEGIN PUBLIC KEY-----\n" . chunk_split($publicKey, 64, "\n") .  "-----END PUBLIC KEY-----";

// Data
$data = // content of receipt.json WITHOUT LINE BREAKS

// Public key id
$publicKeyId = openssl_get_publickey($publicKeyFull);

// Signature
$signature = // content of signature.txt generated previously

// receipt.json, signature.txt, id_rsa.public
$verified = openssl_verify($data, base64_decode($signature), $publicKeyId, OPENSSL_ALGO_SHA1);

var_dump($verified);

验证总是假的，我得到：

Warning: openssl_verify(): supplied key param cannot be coerced into a public key in...

我的id_rsa.pub密钥出了什么问题？

Answer 1

你因为同一类型的错误而提到的@the-awnry-bear错误传递$ valid错误。

请查看以下内容：

android in app billing v3 with php

Billing App和“openssl_verify（）：提供的密钥参数不能强制转换为公钥”

1 个答案: