[Day3] 安全签章 - XOR加密(HashID)

API流程

I have A Nonce, I have A key, Uh It's time to Crypto.

为确保资料安全性，每次呼叫API都必须取得Nonce後计算出安全签章及讯息加密，概述基本流程如下:

前一天的文章结尾，包含一个取得Nonce的API Request，之後将利用该API结合金钥资讯产生安全签章(Sign)

产生HashID

由四组Hash金钥进行两两XOR位元运算，再相加的32位元字串，後续用作AES加密的Key使用

计算流程参考XOR运算

1. A1：4D9709D699CA40EE
2. A2：5A4FEF83140C4E9E
3. B1：BC74301945134CB4
4. B2：961F67F8FCA44AB9
5. 字串１(A1 XOR A2)：17d8e6558dc60e70
6. 字串２(B1 XOR B2)：2a6b57e1b9b7060d
7. Hash ID(字串 1+字串 2 後英文转大写)：17D8E6558DC60E702A6B57E1B9B7060D

以Python实现

def xor_two_str(a,b):
    a = int(a,base=16)
    b = int(b,base=16)
    return hex(a ^ b)

def HashID(Hash:SimpleNamespace):
    str1 = (xor_two_str(Hash.A1, Hash.A2)[2:]).upper()
    str2 = (xor_two_str(Hash.B1, Hash.B2)[2:]).upper()
    print(f"str1:{str1}, str2:{str2}")
    return str1 + str2 

产生出来的HashID必须搭配其他参数一起使用，在此必须先撰写一个产生API服务规格的程序，以JSON格式的API Request，可以自行撰写，或参考我的写法

{
  //API服务规格范例
 "ShopNo": "BA0026_001",
 "OrderNo": "A201804270001",
 "Amount": 50000,
 "CurrencyID": "TWD",
 "PayType": "A",
 "ATMParam": { "ExpireDate": "20180502" },
 "CardParam": { },
"ConvStoreParam": { },
 "PrdtName": "虚拟帐号订单",
 "ReturnURL": "http://10.11.22.113:8803/QPay.ApiClient/Store/Return",
 "BackendURL": "http://10.11.22.113:8803/QPay.ApiClient/AutoPush/PushSuccess"
}

以Python实现产生API服务规格的资料结构(建立订单)

def ReqOrderCreate(ShopNo = "", OrderNo = "", Amount = 0, CurrencyID = "TWD", PrdtName = "", Memo = "", \
    Param1 = "", Param2 = "", Param3 = "", ReturnURL = "", BackendURL = "", PayType = "", ExpireDate = "", \
    AutoBilling = "Y", ExpBillingDays = 7, ExpMinutes = 10, PayTypeSub = "ONE"):
    # 永丰银行- 数位金流 API 技术规格文件 page 32
    return SimpleNamespace(ShopNo = ShopNo, OrderNo = OrderNo, Amount = Amount, CurrencyID = CurrencyID, PrdtName = PrdtName, Memo = Memo, \
    Param1 = Param1, Param2 = Param2, Param3 = Param3, ReturnURL = ReturnURL, BackendURL = BackendURL, PayType = PayType, \
    ATMParam = SimpleNamespace(ExpireDate = ExpireDate), CardParam = SimpleNamespace(AutoBilling = AutoBilling, \
    ExpBillingDays = ExpBillingDays, ExpMinutes = ExpMinutes, PayTypeSub = PayTypeSub))