是青旨啊

1
用户输入的密码
2
  → UTF-8 字节
3
  → RSA 公钥加密，使用 PKCS#1 v1.5 填充
4
  → 密文字节转 Base64 文本
5
  → 加上 __RSA__ 前缀
6
  → 放入 password 字段，随整个表单做 URL 编码

1
import base64
2
import subprocess
3
import tempfile
4
from pathlib import Path
5

6

7
def encrypt_cas_password(public_key_pem: str, password: str) -> str:
8
    with tempfile.TemporaryDirectory() as directory:
9
        key_path = Path(directory) / "cas-public.pem"
10
        key_path.write_text(public_key_pem, encoding="utf-8")
11
        result = subprocess.run(
12
            [
13
                "openssl", "pkeyutl", "-encrypt", "-pubin",
14
                "-inkey", str(key_path),
15
                "-pkeyopt", "rsa_padding_mode:pkcs1",
16
            ],
17
            input=password.encode("utf-8"),
18
            stdout=subprocess.PIPE,
19
            stderr=subprocess.PIPE,
20
            check=True,
21
        )
22
    ciphertext = base64.b64encode(result.stdout).decode("ascii")
23
    return "__RSA__" + ciphertext

1
import base64
2
import json
3
from gmssl.sm4 import CryptSM4, SM4_DECRYPT
4

5

6
def decrypt_sm4_data(encoded: str, key: bytes) -> bytes:
7
    if len(key) != 16:
8
        raise ValueError("SM4 密钥必须为 16 字节")
9
    ciphertext = base64.b64decode(encoded, validate=True)
10
    if not ciphertext or len(ciphertext) % 16:
11
        raise ValueError("密文长度不符合 SM4 分组要求")
12

13
    # 禁用库的自动去填充，接下来显式验证填充字节。
14
    crypt = CryptSM4(padding_mode=-1)
15
    crypt.set_key(key, SM4_DECRYPT)
16
    padded = crypt.crypt_ecb(ciphertext)
17
    count = padded[-1]
18
    if not 1 <= count <= 16:
19
        raise ValueError("PKCS#7 填充长度无效")
20
    if padded[-count:] != bytes([count]) * count:
21
        raise ValueError("PKCS#7 填充内容无效")
22
    return padded[:-count]
23

24

25
def decode_newcard_response(payload: dict, key: bytes) -> dict:
26
    if payload.get("success") or not payload.get("data"):
27
        return payload
28
    plaintext = decrypt_sm4_data(payload["data"], key)
29
    result = json.loads(plaintext.decode("utf-8"))
30
    if not isinstance(result, dict):
31
        raise ValueError("解密结果不是业务对象")
32
    return result

1
/auth/getEncrypt
2
  ├─ id → 原样放入本次请求外层
3
  └─ publicKey → Base64 解码 → SM4 解密 → SM2 公钥
4

5
房间定位、金额、支付方式等业务参数
6
  → 紧凑 JSON → UTF-8 → SM2（C1C3C2）→ 十六进制文本
7
  → {"id": "…", "params": "…"}

1
from gmssl import sm2
2

3

4
def encrypt_sensitive_request(
5
    business_payload: dict, encrypt_config: dict, sm4_key: bytes
6
) -> dict:
7
    public_key = decrypt_sm4_data(
8
        encrypt_config["publicKey"], sm4_key
9
    ).decode("utf-8")
10
    if len(public_key) not in (128, 130) or any(
11
        char not in "0123456789abcdefABCDEF" for char in public_key
12
    ):
13
        raise ValueError("SM2 公钥格式无效")
14

15
    text = json.dumps(
16
        business_payload, ensure_ascii=False, separators=(",", ":")
17
    )
18
    crypt = sm2.CryptSM2(
19
        private_key="", public_key=public_key, mode=1
20
    )
21
    ciphertext = crypt.encrypt(text.encode("utf-8"))
22
    if not ciphertext:
23
        raise ValueError("SM2 加密失败")
24
    return {"id": str(encrypt_config["id"]), "params": ciphertext.hex()}