国资监管接口签名验证：X-Auth-Sign参数排序规则和密钥轮换

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.Security;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.Map;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

public class GzjgSignUtil {

    static {
        Security.addProvider(new BouncyCastleProvider());
    }

    /**
     * 生成签名
     */
    public static String generateSign(
            String method,
            String path,
            Map<String, String> params,
            String appId,
            String timestamp,
            String nonce,
            String keyVersion,
            String secretKey) throws Exception {

        // 1. 构建待签名串
        StringBuilder sb = new StringBuilder();

        // 请求方法
        sb.append(method.toUpperCase()).append("\n");

        // 请求路径
        sb.append(path).append("\n");

        // 参数排序拼接
        List<String> keys = new ArrayList<>(params.keySet());
        Collections.sort(keys); // ASCII升序

        StringBuilder paramStr = new StringBuilder();
        for (int i = 0; i < keys.size(); i++) {
            String key = keys.get(i);
            String value = params.get(key);
            if (value != null) {  // null值不参与签名
                if (paramStr.length() > 0) {
                    paramStr.append("&");
                }
                paramStr.append(key).append("=").append(value);
            }
        }
        sb.append(paramStr.toString()).append("\n");

        // 认证信息
        sb.append(appId).append("\n");
        sb.append(timestamp).append("\n");
        sb.append(nonce).append("\n");
        sb.append(keyVersion);

        // 2. HMAC-SM3计算
        String message = sb.toString();
        Mac mac = Mac.getInstance("HMAC-SM3", "BC");
        SecretKeySpec keySpec = new SecretKeySpec(
            secretKey.getBytes(StandardCharsets.UTF_8), "HMAC-SM3");
        mac.init(keySpec);
        byte[] result = mac.doFinal(message.getBytes(StandardCharsets.UTF_8));

        // 3. 转十六进制小写
        return bytesToHex(result);
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02x", b & 0xff));
        }
        return sb.toString();
    }
}

import hashlib
import hmac
import time
import uuid
from urllib.parse import urlencode

def generate_sign(method, path, params, app_id, secret_key, key_version):
    """
    生成国资监管接口签名

    Args:
        method: HTTP方法 (GET/POST)
        path: 请求路径
        params: 所有请求参数的dict (query + body展开)
        app_id: 应用ID
        secret_key: 密钥
        key_version: 密钥版本号

    Returns:
        dict: 包含所有认证头的字典
    """
    timestamp = time.strftime("%Y%m%d%H%M%S", time.localtime())
    nonce = uuid.uuid4().hex

    # 构建待签名串
    parts = []
    parts.append(method.upper())
    parts.append(path)

    # 参数排序拼接（过滤None值）
    sorted_params = {k: v for k, v in sorted(params.items()) if v is not None}
    param_str = "&".join(f"{k}={v}" for k, v in sorted_params.items())
    parts.append(param_str)

    # 认证信息
    parts.append(app_id)
    parts.append(timestamp)
    parts.append(nonce)
    parts.append(key_version)

    message = "\n".join(parts)

    # HMAC-SM3签名
    sign = hmac.new(
        secret_key.encode("utf-8"),
        message.encode("utf-8"),
        digestmod=hashlib.new("sm3")
    ).hexdigest()

    return {
        "X-Auth-AppId": app_id,
        "X-Auth-Timestamp": timestamp,
        "X-Auth-Nonce": nonce,
        "X-Auth-Sign": sign,
        "X-Auth-KeyVersion": key_version
    }


# 使用示例
if __name__ == "__main__":
    params = {
        "reportType": "quarterly",
        "period": "2024Q2",
        "dataVersion": "3.1",
        "batchNo": "BATCH20240630001"
    }

    headers = generate_sign(
        method="POST",
        path="/api/v1/report/submit",
        params=params,
        app_id="ENT20240001",
        secret_key="your-sm3-secret-key-here",
        key_version="v2"
    )

    print("签名头信息:")
    for k, v in headers.items():
        print(f"  {k}: {v}")

{
    "keys": {
        "v2": {
            "secretKey": "old-key-value",
            "status": "grace",
            "expireAt": "2024-07-15T00:00:00+08:00"
        },
        "v3": {
            "secretKey": "new-key-value",
            "status": "active"
        }
    },
    "signVersion": "v3",
    "verifyVersions": ["v2", "v3"]
}