狠狠撸

introduction?to
jsrsasign
pure?JavaScript?cryptographic?library
slide?r1.0?(2016?Sep?3?for?jsrsasign?5.0.15)
press ← ↑ → ↓ key or right bottom buttons to move slides
https://kjur.github.io/jsrsasign
@kjur / Kenji Urushima

Table?of?Contents
Overview
How to use or install
RSA/DSA/ECDSA public key cryptography
Cryptographic Hash (SHA1/SHA2/MD5/RIPEMD160)
Message Authentication Code (HmacSHA1/SHA2/MD5)
short ASN.1 introduction
ASN1HEX: simple ASN.1 parser
X509: simple X.509 certi cate parser
generate and encode ASN.1
JSON Web Key/Signature/Token (JWK/JWS/JWT)
Tools, Demos, Tutorials and API Docs

Overview
The "jsrsasign" ( ) is a open source
free cryptograhic library implemented by pure JavaScript. It supports a
lot of features such as following:
strong RSA/DSA/ECDSA key utility
RSA/DSA/ECDSA digital signature
message authentication code(MAC)
hash (MD5,RIPEMD,SHA1,SHA2)
simple ASN.1 parser
ASN.1 object generator
X.509 certi cate and CRL
PKCS#1/5/8 private/public key
PKCS#10/CSR
CMS SignedData
RFC 3161 TimeStamp
CAdES long term signature
JWS (JSON Web Signatures)
JWT (JSON Web Token)
JWK (JSON Web Key)
string utility
https://kjur.github.io/jsrsasign/

Overview?(cont'd)
well-documented
"jsrsasign" has rich and so that you can learn
easily.
many samples and tools
"jsrsasign" provides many samples and tools.
easy installation
"jsrsasign" can be easily installed by "git clone", bower and npm.
There is no dependency to other package or module.
works on most of browsers and Node.js
"jsrsasign" doesn't require any special feature of JavaScript on the
browser such like W3C Web Crypto or Promise. This works on most
of browsers and Node.js as if old one.
MIT license
"jsrsasign" is licensed under "MIT License" which is short and
permissive for developers convenience.
API reference tutorial

How?to?use?or?install
For bower:
For Node.js:
O course, you can use git:
Or to use it in your web page, add following in your HTML:
% bower install jsrsasign
% npm install -g jsrsasign (for global installation)
% git clone https://github.com/kjur/jsrsasign.git
<script src=/slideshow/introduction-to-jsrsasign/65680143/"https:/kjur.github.io/jsrsasign/jsrsasign-
latest-all-min.js"></script>

RSA/DSA/ECDSA?public?key
cryptography

KEYUTIL?class:?Features
supports RSA/DSA/ECC algorithm
generateKeypair() for RSA/ECC
getKey(): key loader
PKCS#1/5 plain/encryptped private/public PEM/HEX key
PKCS#8 plain/encryptped private/public PEM/HEX key
X.509 PEM certi cate
public/private RFC 7517 JSON Web Key (JWK)
getPEM() to get plain/encrypted private/public PKCS#1/5/8 PEM
getJWKFromKey() to get RFC 7517 JSON Web Key (JWK)

KEYUTIL.generateKeypair()
generateKeypair method can be used to generate RSA/ECC key pair.
// RSA
keypair = KEYUTIL.generateKeypair("RSA", 2048);
// ECC
keypair = KEYUTIL.generateKeypair("EC", "secp256r1");
//
// private key object: keypair.prvKeyObj
// public key object: keypair.pubKeyObj

KEYUTIL.getKey()
getKey method can load a lot of format of public and private key such
as PKCS#1/5/8 or JWK very easily.
// PKCS#8 public key
pub = KEYUTIL.getKey("-----BEGIN PUBLIC KEY...");
// public key from X.509 certi cate
pub = KEYUTIL.getKey("-----BEGIN CERTIFICATE...");
// PKCS#8 encrypted private with password
prv = KEYUTIL.getKey("-----BEGIN ENCRYPTED PRIVATE KEY...", "pass");

sign?data
sign a data with your private key using Signature object as like Java JCE.
// load private key
prv = KEYUTIL.getKey("-----BEGIN ENCRYPTED PRIVATE KEY...", "pass");
// generate Signature object
sig = new KJUR.crypto.Signature({"alg": "SHA256withRSA"});
// set private key for sign
sig.init(prv);
// update data
sig.updateString("aaa");
// calclate signature
sigHex = sig.sign();

verify?signature
sign a data with your private key using Signature object as like Java JCE.
// load public key
pub = KEYUTIL.getKey("-----BEGIN CERTIFICATE...");
// generate Signature object
sig = new KJUR.crypto.Signature({"alg": "SHA256withRSA"});
// set private key for sign
sig.init(pub);
// update data
sig.updateString("aaa");
// verify signature
isValid = sig.verify(sigValueHex);

Cryptographic?Hash
SHA1/SHA2/MD5/RIPEMD160

calculate?hash?by
MessageDigest?class
calculate hash using MessageDigest class just like Java JCE
// generate MessageDigest object for SHA384
md = new KJUR.crypto.MessageDigest({alg: "sha384"});
// append data for hash
md.updateString("aaa");
// calculate hash nally
mdHex = md.digest();
// or use Util class in short. These three will get the same result.
mdHex = KJUR.crypto.Util.sha384("aaa");
mdHex = KJUR.crypto.Util.hashString("aaa","sha384");
mdHex = KJUR.crypto.Util.hashHex("616161","sha384");

Message?Authentication?Code
(HmacSHA1/SHA2/MD5)

calculate?Mac?by?Mac?class
calculate message authentication code by Mac class just like Java JCE
// generate Mac class
mac = new KJUR.crypto.Mac({alg: "HmacSHA256", pass: "pass"});
// append data for Mac
mac.updateString('aaa');
// get Mac value
macHex = md.doFinal();
pass parameter supports some value formats like this:
hexadecimal {hex: "616161"}
UTF-8 {utf8: "東京"}
Base64 {b64: "Mi02/+...a=="}
Base64URL {b64u: "Mi02_-...a"}

short?ASN.1?introduction
ASN.1 is a binary encording of structured data consists of a data type
tag(T), byte length(L) and value(V).
ASN.1 encoding is used in network protocol or format such like X.509
certi cate, private/public key formats, S/MIME data, digital time stamp,
Radius.
FEATURE1: variable length data exceeds int or long.
FEATURE2: structured data is also available.

short?ASN.1?introduction
(cont'd)
Structured data can be represented by SEQUENCE or SET.

ASN1HEX
simple?ASN.1?parser?for?hexadecimal?string

ASN1HEX?basic?methods
ASN1HEX methods can be used for getting tag, length or value of ASN.1
object of hexadecimal string at speci ed position.

ASN1HEX?basic?methods
(cont'd)
get a list of indexes of child elements.

ASN1HEX?for?decendant
element
To refer a decendant element of nested structured ASN.1, use "nthList"
which represent indexes for each nested layer. This is very useful to
specify a deep nested element such like subject name of X.509
certi cate.
getDecendantHexTLVByNthList(s,0,[0,0]) → "020104"
getDecendantHexLByNthList(s,0,[0,0]) → "01"
getDecendantHexVByNthList(s,0,[0,0]) → "04"
getDecendantIndexByNthList(s,0,[0,0]) → 8
←

X509
simple?X.509?certificate?parser?as?ASN.1

X509?class
Basic?fields?and?extensions?can?be?get?by?X509?class.
x = new X509();
x.readCertPEM(sCertPEM);
hex = X.509.pemToHex(sCertPEM);
// get subject
subject = x.getSubjectString(); // return like "/C=US/O=OTEST"
// get subjectAltName
san = X.509.getExtSubjectAltName(hex);
// return like ["example.com", "example.org"]
There are a lot of methods to get elds and extensions.
Please see in detail.manual

generate?and?encode?ASN.1?(cont'd)
Classes for ASN.1 primitives and structured types, as well as X.509
certi cate, CRL, CSR, CMS signed data, digital time stamp and CAdES are
de ned in jsrsasign.
i1 = new KJUR.asn1.DERInteger({int: 234});
s1 = new KJUR.asn1.DERUTF8String({str: 'Tokyo'}});
seq = new KJUR.asn1.DERSequence({array: [i1, s1]});
hex = seq.getEncodedHex();
Please see in detail.
It's very similar to BoucyCastle or IAIK Java ASN.1 classes.
However, there is much more easy way...
manual

generate?and?encode?ASN.1?using
newObject
It's very easy to generate complicated ASN.1 object by
ASN1Util.newObject
var hex = new KJUR.asn1.ASN1Util.newObject(
　　{seq: [　　　　　　　　　　　　　　// SEQUENCE
　　　　　{int: 234},　　　　　　　　　　// INTEGER
　　　　　{utf8str: 'Tokyo'}　　　　　　// UTF8String
　　　　　]}
).getEncodedHex();

get?PEM?of?X.509?certificate?by
X509Util.newCertPEM
It's very easy to generate PEM of X.509 certi cate by
.
pem = new KJUR.asn1.x509.X509Util.newCertPEM({
　　serial: {int: 4},
　　sigalg: {name: 'SHA256withECDSA', paramempty: true},
　　issuer: {str: '/C=US/O=CA1'},
　　notbefore: {str: '130504235959Z'}, notafter: {str: '140504235959Z'},
　　subject: {str: '/C=US/O=T1'},
　　sbjpubkey: "-----BEGIN PUBLIC KEY...",
　　ext: [
　　　　{basicConstraints: {cA: true, critical: true}},
　　　　{keyUsage: {bin: '11'}},
　　],
　　cakey: ["-----BEGIN PRIVATE KEY...", "pass"]
});
X509Util.newCertPEM

get?PEM?of?PKCS#10/CSRT?by
CSRUtil.newCSRPEM
It's very easy to generate PEM of CSR(certi cate signing request) by
.
kp = KEYUTIL.generateKeypair("RSA", 2048);
pem = new KJUR.asn1.csr.CSRUtil.newCSRPEM({
　　subject: {str: '/C=US/O=Test/CN=example.com'},
　　sbjpubkey: kp.pubKeyObj,
　　sigalg: "SHA256withRSA",
　　sbjprvkey: kp.prvKeyObj
});
CSRUtil.newCSRPEM

JWK?(JSON?Web?Key)
jsrsasign can load and export RFC 7517 JSON Web Key (JWK).
// load JWK
jwkPub = {kty: "EC", crv: "P-256", x: "f830J3..." ...};
keyObj = KEYUTIL.getKey(jwkPub);
// export to JWK
kp = KEYUTIL.generateKeypair("RSA", 2048);
jwkPrv = KEYUTIL.getJWKFromKey(kp.prvKeyObj);
jwkPub = KEYUTIL.getJWKFromKey(kp.pubKeyObj);

JWS?(JSON?Web?Signatures)
jsrsasign can sign and verify RFC 7515 JSON Web Signatures (JWS).
// sign JWS
header = {alg: "HS256"};
payload = {fruit: "orange"};
jws = KJUR.jws.JWS.sign("HS256", header, payload, {utf8: "secret"});
// eyJhbGciOiJIUzI1NiJ9.eyJmcnVpdCI6Im9yYW5nZSJ9.
// qbIF5WMbXYMFMh_UXjL2CGts5KPVU7yF7AbOdoyoPZI
// verify JWS
isValid = KJUR.jws.JWS.verify(jws, {utf8: "secret"}, ["HS256"]);
This result can also be veri ed at .jwt.io

JWT?(JSON?Web?Token)
jsrsasign can sign and verify RFC 7519 JSON Web Token (JWT).
// sign JWT
header = {alg: "HS256", typ: "JWT"};
payload = {sub: "123456789", name: "John Doe", admin: true};
jwt = KJUR.jws.JWS.sign("HS256", header, payload, {utf8: "secret"});
// eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY
// 3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95
// OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ
// verify JWT
isValid = KJUR.jws.JWS.verifyJWT(jwt, {utf8: "secret"}, {
　alg: ["HS256"], sub: ["John Doe"]
});
This result can also be veri ed at .jwt.io

jsrsasign?at?jwt.io
site have kindly listed jsrsasign. jwt.io provides JWT validator
which uses .
jwt.io
old version of jsrsasign 4.1.5

Tools,?Demos,?Tutorials?and?API
Docs

Tools?and?demos
jsrsasign provides a lot of tools which use
jsrsasign as example.
Please see the as for onliene
tools.
Also see as for Node tools.
As for demonstrations, please see
.
this list
list
this list

Tutorials
jsrsasign provides to
make it easy to learn jsrsasign programming.
tutorial documents

API?Reference
jsrsasign provides detailed
document. API reference also has examples.
API Reference

狠狠撸

introduction to jsrsasign

Recommended

More Related Content

Viewers also liked (12)

Similar to introduction to jsrsasign (20)

Recently uploaded (20)

introduction to jsrsasign