RSA Encryption

[lintangtimur]

Flow enkripsi V3 accounts/login

Entah ini benar apa engga, flownya:

1. Data yang di encrypt ada deviceId, kyc, notelp
2. Data dijadikan json
3. json di encrypt dengan RSA public key, didapat base64
4. Lalu di sign dengan private key, output base64

Bisa dikoreksi jika ada yang salah

[ii64]

Tambahan untuk data nya signFirstTime

datSharing = DataSharing(deviceId, kyc, phoneNumber, signFirstTime)

json = JSON.stringify(datSharing)
var sjson string

// encrypt data with RSA/ECB PKCS1-Pad - x509 pub
// result base64 encoded
var x509key = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgRjK/3xgE0NsWJ5AK+RTAqWVghZH83Fhnxu2lSvcDUTXUhCyhlKGgDIWWswe/S7cWiuPYebHoo0vp2bHUQLHNFfyzh/IWAaR+uF1gunu2YtH05CB7Jbb+ePajiBIsmxtmXHMuR1oiL2vISyrX1aV2xdewL8Tac9LhNroMMuojp+ezh+gIzePA/OSiyrc0WZwljQmLIAG/XtOU7HKHaAGEkZ5d231l5WwDwRbeGOTEn4mN6cwRtwNk5Q1kYxaI51Q1WBC9oN21jY9+3PSJctYbAIjhzHa3A+n79+2hQeFiXtElwxmwDcrC3mtWZn2L22lvoHln44PSftP4J3tJJP0pwIDAQAB"
var pubKey = KeyFactory.getInstance("RSA").generatePublic(X509EncodedKeySpec(x509key));
var cip = Cipher.getInstance("RSA/ECB/PKCS1Padding");
cip.init(Cipher.ENCRYPT_MODE, pubKey);
bjson = json.getBytes("UTF-8");
bjson = cip.doFinal(bjson);
if (sjson = Base64.encodeToString(bjson, 0)) {
	sjson = "";
}

// ----==----
var data = sjson

// signing data with SHA256WithRSA or RSA_SHA256
// result base64 encoded
var privateKeyString = "MIIEowIBAAKCAQEA6spowYp8cYY7eEzbxdqJzAVO8sIPYZFgCEJMJtCuNFgqRHGiYVFnAEHq7VUYWGWBwy6680PQ/8jhxVZLU8uemhGQdRd378HyIbyqYWbipioiBo/izRB1FIix+z73ltMS6jsYeKskHLIXhAfpzUMg58Bfz9z4K6uTgG0NcV097xYQ2LBL9Jgz7ZHFRrL4tm3HEwSAyoYg3D+zvmPlepuDzpmdneA2IOaPHigCQu9oU3tQFJV0suC7ngsKMgm0x7KshrzP4baIpDLl644ol8YhJApa1jLO4ZLeoFYmOwAOxb2r5Gv9JIaco8du1sxVCBMItEbHeAOp12Mi4LrtnzDg/QIDAQABAoIBAQCM94H10ePtdR53mA3LuO5K5FUGQ6VgexwhWUzHcTtmihi2h1NrAqjI6srWO+UmDavfOEteizUMnduP08PeR76t2iXVZ4XHGbb6sn/JgzBJe7p6HiGZ5WumLHxP0PpuP8R3hYunx3kjEXo091tUth0nh8T+1DjcX2NsFA2iJs1sobhsEdj9FJqk58tw5YLAQMhpGN5/fvpnpxJ++zKxUiZQuxaYB2JBURblt1EcXl1qjaYRyDkPT3JjTrm74dZkFcI67fbe/j+TbZ08/8V6wmZkXkLrtyrT3iHdrQ/vckxiA05p92jiGSiqYZjvvSYYPiIplvw89R6QbbVDI1WerNOBAoGBAPyjiV7ZtFBj8DJTGLVl7xTsysw/lm6uUiloh4OB+NOyQRp57NEY/NsHx0oj7RJMcHJVPbB6yHzadpaN0tYlocNpEJvDoJFi3lDdK8IQEDeR26c02brHewlagHQR+YSZCQAH6fhkmZtWeiWT06C+IYzlzYacZbVA6QDi3TzKcyiFAoGBAO3qFWEGFiSxQAh46xis4kKY7oYjov2HQmQrqiUmOXLOFPU10QchjQ5SMWo07MbCIu89SPdcFTce+DjB/SIZ7rnMqHhsv+nDhY4x3/N8mVs6CMNWBTZHKSdoCZqNkYk8WSrgjkiPF1QWgZloTXqph1df3QSqDuCkqJMw/+hag/wZAoGAQm19oUL89mZQserHhGrZAleAu1O86j1LvTeO6jUyh/dGxv9oFVLMqYrSC9yGaVlP98ASCGVAchO/OrbvyP78GbV2eH5nqdKlQf3lk5FFslbXuo9a8JGi+EKjo+FWCldy1l8+VeGdwgpq85Z6/rj/eVyzPcHBvHbkzSbZpTJWNUECgYApk7fqvcKO5P74vBDxvfzIgKtme8HXJpUeplbUqSpu+r7E34PJCD77WrfSBK/ASFsMjhw7Rjda66mbWaNgG0IR7EcgzHh5ZLbpU6P8jDDMtYakhFri0mrJvS+4d7cQUaCPkrCq037TLh+17Hllz0yco18fmoyBC6V+G5kNRQw9uQKBgDOhVbFPYVIwpuvFxytZh+aATYrLCkVw3IHmuuZMqaZSYHip2Tn1nyokpYnujMljJXCnXIFivejCMvX35HUpTU8NJ9laoA2Vixw1t+qtYVjYFXUnJoOlEcX29KuTNPkPNm3GwQd9cQ1XphuL8yrp0pxnvOfBYixOX5sFCjfMBrXN"
var privKey = KeyFactory.getInstance("RSA").generatePrivate(PKCS8EncodedKeySpec(privateKeyString));
var sig = Signature.getInstance("SHA256WithRSA");
sig.initSign(privKey);
var bdata = data.getBytes("UTF-8");
sig.update(bdata);
var bsig = sig.sign();
Base64.encodeToString(bsig, 10)

[lintangtimur]

java.security.InvalidKeyException: IOException : algid parse error, not a sequence

KeyFactory instance = KeyFactory.getInstance("RSA");

            String private_key_string = "MIIEowIBAAKCAQEA6spowYp8cYY7eEzbxdqJzAVO8sIPYZFgCEJMJtCuNFgqRHGiYVFnAEHq7VUYWGWBwy6680PQ/8jhxVZLU8uemhGQdRd378HyIbyqYWbipioiBo/izRB1FIix+z73ltMS6jsYeKskHLIXhAfpzUMg58Bfz9z4K6uTgG0NcV097xYQ2LBL9Jgz7ZHFRrL4tm3HEwSAyoYg3D+zvmPlepuDzpmdneA2IOaPHigCQu9oU3tQFJV0suC7ngsKMgm0x7KshrzP4baIpDLl644ol8YhJApa1jLO4ZLeoFYmOwAOxb2r5Gv9JIaco8du1sxVCBMItEbHeAOp12Mi4LrtnzDg/QIDAQABAoIBAQCM94H10ePtdR53mA3LuO5K5FUGQ6VgexwhWUzHcTtmihi2h1NrAqjI6srWO+UmDavfOEteizUMnduP08PeR76t2iXVZ4XHGbb6sn/JgzBJe7p6HiGZ5WumLHxP0PpuP8R3hYunx3kjEXo091tUth0nh8T+1DjcX2NsFA2iJs1sobhsEdj9FJqk58tw5YLAQMhpGN5/fvpnpxJ++zKxUiZQuxaYB2JBURblt1EcXl1qjaYRyDkPT3JjTrm74dZkFcI67fbe/j+TbZ08/8V6wmZkXkLrtyrT3iHdrQ/vckxiA05p92jiGSiqYZjvvSYYPiIplvw89R6QbbVDI1WerNOBAoGBAPyjiV7ZtFBj8DJTGLVl7xTsysw/lm6uUiloh4OB+NOyQRp57NEY/NsHx0oj7RJMcHJVPbB6yHzadpaN0tYlocNpEJvDoJFi3lDdK8IQEDeR26c02brHewlagHQR+YSZCQAH6fhkmZtWeiWT06C+IYzlzYacZbVA6QDi3TzKcyiFAoGBAO3qFWEGFiSxQAh46xis4kKY7oYjov2HQmQrqiUmOXLOFPU10QchjQ5SMWo07MbCIu89SPdcFTce+DjB/SIZ7rnMqHhsv+nDhY4x3/N8mVs6CMNWBTZHKSdoCZqNkYk8WSrgjkiPF1QWgZloTXqph1df3QSqDuCkqJMw/+hag/wZAoGAQm19oUL89mZQserHhGrZAleAu1O86j1LvTeO6jUyh/dGxv9oFVLMqYrSC9yGaVlP98ASCGVAchO/OrbvyP78GbV2eH5nqdKlQf3lk5FFslbXuo9a8JGi+EKjo+FWCldy1l8+VeGdwgpq85Z6/rj/eVyzPcHBvHbkzSbZpTJWNUECgYApk7fqvcKO5P74vBDxvfzIgKtme8HXJpUeplbUqSpu+r7E34PJCD77WrfSBK/ASFsMjhw7Rjda66mbWaNgG0IR7EcgzHh5ZLbpU6P8jDDMtYakhFri0mrJvS+4d7cQUaCPkrCq037TLh+17Hllz0yco18fmoyBC6V+G5kNRQw9uQKBgDOhVbFPYVIwpuvFxytZh+aATYrLCkVw3IHmuuZMqaZSYHip2Tn1nyokpYnujMljJXCnXIFivejCMvX35HUpTU8NJ9laoA2Vixw1t+qtYVjYFXUnJoOlEcX29KuTNPkPNm3GwQd9cQ1XphuL8yrp0pxnvOfBYixOX5sFCjfMBrXN";
            System.out.println(private_key_string);
            byte[] decode = Base64.decode(private_key_string, 0);

            PrivateKey generatePrivate = instance.generatePrivate(new PKCS8EncodedKeySpec(decode));

            Signature instance2 = Signature.getInstance("SHA256WithRSA");
            instance2.initSign(generatePrivate);
            byte[] bytes = string.getBytes(StandardCharsets.UTF_8);
            instance2.update(bytes);
            byte[] sign = instance2.sign();

            strSign = Base64.encodeToString(sign, 10);

pas sign malah error, tau dimana errornya?? penulisan privateKey apakah benar?

[derodevil]

Saya ga pake java tp pake C#. Kurang tau dg error di java

[namdevel]

{
"security_code": "<security_code>",
}

[derodevil]

security_code ini maksdunya ditambahkan ke DataSharing yg json itu kah?

[SilentX26]

ada yang udah bisa ngatasin error Bad Request: Invalid decrypted string?

[ii64]

Key awal pake apa ini?

[lintangtimur]

sepertinya ga ada isinya

[SilentX26]

signFirstTime tipe data nya long, value nya ini time disaat pertama kita request otp atau apa ya?

[lintangtimur]

pada waktu HIT api ini mungkin

[SilentX26]

Flow enkripsi accounts/login

Kemarin saya sudah baca-baca decompile aplikasi ovo, saya menemukan flow berikut (sudah di test dan hasilnya success):

1. data yang di enkripsi berupa string dengan pola berikut: "LOGIN|" + securityCode + "|" + currentTimeMillies + "|" + deviceId + "|" + phoneNumber + "|" + deviceId + "|" + otpRefId.
2. Keterangan:
   • securityCode: berupa PIN akun ovo anda
   • currentTimeMillies: berupa waktu (dalam milisecond) pada saat anda hit ke API OVO
   • deviceId: berupa device id anda
   • phoneNumber: berupa nomor HP anda
   • otpRefId: berupa ref id otp yang didapat pada saat request OTP
3. Contoh: "LOGIN|123456|1628222553987|abcdefgh|+628xxxxxxx|abcdefgh|xxxxxxxxxxx"
4. data di enkripsi menggunakan public key yang didapat dari user/public_keys
5. di encoding menggunakan base64

[notme1001]

iya mas, lagi nyoba" sih ini @apriady .

[apriady]

boleh share bagian enkripsi menggunakan publickeynya mas @notme1001 ?
ini kebetulan saya kemarin masih stuck di sana.

[notme1001]

Encryptnya saya pake versi pythonnya dari mas @herihermwn , untuk jsnya sy blm cb lg

[notme1001]

@apriady untuk encrypt jsnya sy udh coba pake ini , berhasil

[ipkzone]

mas mau tanya kalo untuk registrasinya gmna ya untuk pola encript nya
apa aja ya yang di encript untuk registrasi akun nya