签名算法

最近更新时间:2020-07-15 17:33:17

签名算法

1)根据请求参数(公共参数和业务参数,不包含公共参数Signature)构造规范化请求字符串:CanonicalizedQueryString

第一步:请求参数排序。排序规则以参数名按照字典排序

第二步:请求参数编码。使用UTF-8字符集对每个请求参数的名称和参数取值进行URLEncode,一般在URLEncode后需对三种字符替换:加号(+)替换成 %20、星号(*)替换成 %2A、 %7E 替换回波浪号(~)

第三步:每对URLEncode后的参数名称和参数值,用=进行连接。每对之间使用&进行连接。得到规范化请求字符串CanonicalizedQueryString。

2)计算签名。 sign = hash_hmac('sha256', CanonicalizedQueryString, sk)

sign值为签名算法返回的16进制格式小写字符串

签名样例:
b28616f50f00380341a647c73101a459d8119c9d4a98fcff5fa4a023f82ef229

计算签名时使用的sk为Accesskey对应的秘钥,使用的哈希算法是:HMAC-SHA256。

3)将签名值作为Signature参数值添加到请求参数中。

签名计算完整样例

1> 构造规范化请求字符串样例

请求参数数组: 
{
    "AppId":"ftYXXoM1oNmhUKE0gA3xkUQcvCBVL30NV2bcV1qcnIbOEszG3cxK1orXnwAbGMnDHwxJ0M8MXkIaWZ9B24LCVorNXMPGMgGhaYFovNmBUOG4zVQ==",
    "Token":"2fb2b664ea555fb06b312c92b4a9ae11 CM__1__68d04de46704184607095c0ed13c525c__2.1.3.1__1__STsid00000015881406484578yDK1EVivAwBfOwwxHTxZoNUS6WEXHZO",
    "AuthCode":"123456",
    "Action":"MobileQuery",
    "Version":"2019-05-01",
    "SignatureVersion":"1.0",
    "SignatureMethod":"HMAC-SHA256",
    "Timestamp":"2020-04-15T14:58:22Z",
    "Service":"onepass",
    "Accesskey":"AKxxx"
}

第一步,请求参数排序:排序结果如下。
{
    "Accesskey":"AKxxx",
    "Action":"MobileQuery",
    "AppId":"ftYXXoM1oNmhUKE0gA3xkUQcvCBVL30NV2bcV1qcnIbOEszG3cxK1orXnwAbGMnDHwxJ0M8MXkIaWZ9B24LCVorNXMPGMgGhaYFovNmBUOG4zVQ==",
    "AuthCode":"123456",
    "Service":"onepass",
    "SignatureMethod":"HMAC-SHA256",
    "SignatureVersion":"1.0",
    "Timestamp":"2020-04-15T14:58:22Z",
    "Token":"2fb2b664ea555fb06b312c92b4a9ae11 CM__1__68d04de46704184607095c0ed13c525c__2.1.3.1__1__STsid00000015881406484578yDK1EVivAwBfOwwxHTxZoNUS6WEXHZO",
    "Version":"2019-05-01"
}

第二步请求参数和参数值URLEncode
第三步字符串拼接如下:
Accesskey=AKxxx&Action=MobileQuery&AppId=ftYXXoM1oNmhUKE0gA3xkUQcvCBVL30NV2bcV1qcnIbOEszG3cxK1orXnwAbGMnDHwxJ0M8MXkIaWZ9B24LCVorNXMPGMgGhaYFovNmBUOG4zVQ%3D%3D&AuthCode=123456&Service=onepass&SignatureMethod=HMAC-SHA256&SignatureVersion=1.0&Timestamp=2020-04-15T14%3A58%3A22Z&Token=2fb2b664ea555fb06b312c92b4a9ae11%20CM__1__68d04de46704184607095c0ed13c525c__2.1.3.1__1__STsid00000015881406484578yDK1EVivAwBfOwwxHTxZoNUS6WEXHZO&Version=2019-05-01

2> 根据待签串计算签名
sk = 'SKxxx'
CanonicalizedQueryString = "Accesskey=AKxxx&Action=MobileQuery&AppId=ftYXXoM1oNmhUKE0gA3xkUQcvCBVL30NV2bcV1qcnIbOEszG3cxK1orXnwAbGMnDHwxJ0M8MXkIaWZ9B24LCVorNXMPGMgGhaYFovNmBUOG4zVQ%3D%3D&AuthCode=123456&Service=onepass&SignatureMethod=HMAC-SHA256&SignatureVersion=1.0&Timestamp=2020-04-15T14%3A58%3A22Z&Token=2fb2b664ea555fb06b312c92b4a9ae11%20CM__1__68d04de46704184607095c0ed13c525c__2.1.3.1__1__STsid00000015881406484578yDK1EVivAwBfOwwxHTxZoNUS6WEXHZO&Version=2019-05-01"
//sign = hash_hmac('sha256', CanonicalizedQueryString, sk)
sign: 48d92e6f31d2d7c6b382ae3103105f64cbab3e049bf468a453c49f3b6953f86b

各语言版本的签名

PHP (版本5.5+)

function sign($params, $secret_key)
{
    ksort($params, SORT_STRING);
    $str_encode = '';
    foreach($params as $k=>$v) {
        $str_encode .= rawurlencode($k).'='.rawurlencode($v).'&';
    }
    $str_encode = substr($str_encode, 0, -1);
    return hash_hmac("sha256", $str_encode, $secret_key);
}
//rawurlencode 实现的urlencode,符合上述签名URLEncode的要求,所以无需做替换

Python (版本2.7)

#-*- coding:utf-8 -*-
import sys, os, base64, datetime, hashlib, hmac 
import urllib
def sign(params, secret_key):
    str_encode = ''
    param_keys = sorted(params.keys())
    for key in param_keys:
        str_encode += urllib.quote(key,'~') + '=' + urllib.quote(str(params[key]),'~') + '&'
    print(str_encode[:-1])
    return hmac.new(secret_key, str_encode[:-1], hashlib.sha256).hexdigest()

金山云,开启您的云计算之旅

免费注册