eKYC Platform Integration Guidelines

https://ekyc-platform-vn-staging.trustingsocial.com/lu/[EncodedBase64Token]?flow_id=id_selfie&language=vi

https://ekyc-platform-vn-staging.trustingsocial.com/lu/[EncodedBase64Token]?flow_id=[YOUR_ID_ONLY_FLOW_ID]&card_types=vn.national_id&language=en

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwC4C2c+nbI5GN3RseYUE
6xB1SObAk1HNFrs41sbBL1ZgMcYmXnuPrqXehzdqbBSYnWwFufLwFnFfAox7dInw
2olB8QCX9aOYXxcCX+T4JKJxYMuMC7+vuKVip22U+6WUTOaHqGAB2ZmsGPp7dpN4
Q+5duwiYam4izHwiFZ2bGmXbDqARtRlO+UnA8JMVE9LISQD1p238Id+AY3K9W8GQ
W3luLJttKZ0/ulJ54JsVxg5wF3EtohfcvVSJD/6rY0BLUINB5o9nLuGYkjpd+7V0
oB+o4YDMPMOTu8IJa0tbZg8HClr+/Rq3W4xle/NFS1YbLmp45MJ8APsbX9OkG+jM
JwIDAQAB
-----END PUBLIC KEY-----

package com.trustingsocial.example;

import java.io.IOException;
import java.math.BigDecimal;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.KeyFactory;
import java.security.PublicKey;
import java.security.Signature;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;
import java.util.Map;

import com.fasterxml.jackson.core.JsonGenerator;
import com.fasterxml.jackson.core.SerializableString;
import com.fasterxml.jackson.core.io.CharacterEscapes;
import com.fasterxml.jackson.core.io.SerializedString;
import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.DeserializationFeature;
import com.fasterxml.jackson.databind.JsonSerializer;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.SerializationFeature;
import com.fasterxml.jackson.databind.SerializerProvider;
import com.fasterxml.jackson.databind.module.SimpleModule;

public class VerifySignature {

  public static void main(String[] args) throws Exception {
    String input = "YOUR_DATA";
    String publicKeyPem =
        "-----BEGIN PUBLIC KEY-----\n"
            + "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwC4C2c+nbI5GN3RseYUE\n"
            + "6xB1SObAk1HNFrs41sbBL1ZgMcYmXnuPrqXehzdqbBSYnWwFufLwFnFfAox7dInw\n"
            + "2olB8QCX9aOYXxcCX+T4JKJxYMuMC7+vuKVip22U+6WUTOaHqGAB2ZmsGPp7dpN4\n"
            + "Q+5duwiYam4izHwiFZ2bGmXbDqARtRlO+UnA8JMVE9LISQD1p238Id+AY3K9W8GQ\n"
            + "W3luLJttKZ0/ulJ54JsVxg5wF3EtohfcvVSJD/6rY0BLUINB5o9nLuGYkjpd+7V0\n"
            + "oB+o4YDMPMOTu8IJa0tbZg8HClr+/Rq3W4xle/NFS1YbLmp45MJ8APsbX9OkG+jM\n"
            + "JwIDAQAB\n"
            + "-----END PUBLIC KEY-----";

    ObjectMapper mapper = canonicalJsonMapper();

    // Extract signature and prepare data for verification
    Map<String, Object> rawData =
        mapper.readValue(input, new TypeReference<Map<String, Object>>() {});
    String signature = (String) rawData.remove("signature");
    String data = mapper.writeValueAsString(rawData);

    // Load the RSA public key PEM string (be careful with the \n, space, tab) or from file
    PublicKey publicKey = loadRSAPublicKeyString(publicKeyPem);
    // PublicKey publicKey = loadRSAPublicKey("key.pub");

    // Verify the signature
    if (verify(publicKey, data, signature)) {
      System.out.println("Signature is valid!");
    } else {
      System.out.println("Error verifying signature: signature does not match");
    }
  }

  /*
   * The signature was produced over the canonical encoding of the payload: object keys sorted
   * alphabetically at every level, <, > and & escaped rather than emitted raw, and every number
   * spelled exactly as it arrived. Jackson does none of these by default, and any difference in
   * the bytes changes the SHA-1 digest, so this configuration is what makes the re-encoded
   * payload byte-identical to the one that was signed.
   */
  private static ObjectMapper canonicalJsonMapper() {
    ObjectMapper mapper = new ObjectMapper();
    mapper.enable(SerializationFeature.ORDER_MAP_ENTRIES_BY_KEYS);
    // Read decimals as BigDecimal, which keeps their exact digits. Parsing them into a double
    // instead reformats on the way out — a score of 0.0005 comes back as 5.0E-4 — and the
    // signature then fails on a payload that is perfectly genuine.
    mapper.enable(DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS);
    mapper.registerModule(exponentCaseModule());
    mapper.getFactory().setCharacterEscapes(new HtmlCharacterEscapes());
    return mapper;
  }

  /** BigDecimal prints an upper-case exponent (1E-7); the signed form uses lower case (1e-7). */
  private static SimpleModule exponentCaseModule() {
    SimpleModule module = new SimpleModule();
    module.addSerializer(
        BigDecimal.class,
        new JsonSerializer<BigDecimal>() {
          @Override
          public void serialize(BigDecimal value, JsonGenerator gen, SerializerProvider provider)
              throws IOException {
            gen.writeNumber(value.toString().replace('E', 'e'));
          }
        });
    return module;
  }

  private static class HtmlCharacterEscapes extends CharacterEscapes {
    private static final long serialVersionUID = 1L;

    private final int[] escapes = CharacterEscapes.standardAsciiEscapesForJSON();

    HtmlCharacterEscapes() {
      escapes['<'] = CharacterEscapes.ESCAPE_CUSTOM;
      escapes['>'] = CharacterEscapes.ESCAPE_CUSTOM;
      escapes['&'] = CharacterEscapes.ESCAPE_CUSTOM;
    }

    @Override
    public int[] getEscapeCodesForAscii() {
      return escapes;
    }

    @Override
    public SerializableString getEscapeSequence(int ch) {
      switch (ch) {
        case '<':
          return new SerializedString("\\u003c");
        case '>':
          return new SerializedString("\\u003e");
        case '&':
          return new SerializedString("\\u0026");
        default:
          return null;
      }
    }
  }

  private static PublicKey loadRSAPublicKey(String filePath) throws Exception {
    return loadRSAPublicKeyString(
        new String(Files.readAllBytes(Paths.get(filePath)), StandardCharsets.UTF_8));
  }

  private static PublicKey loadRSAPublicKeyString(String pem) throws Exception {
    String base64 =
        pem.replace("-----BEGIN PUBLIC KEY-----", "")
            .replace("-----END PUBLIC KEY-----", "")
            .replaceAll("\\s", "");
    X509EncodedKeySpec spec = new X509EncodedKeySpec(Base64.getDecoder().decode(base64));
    return KeyFactory.getInstance("RSA").generatePublic(spec);
  }

  /** RSASSA-PKCS1-v1_5 over a SHA-1 digest — the scheme the signature was produced with. */
  private static boolean verify(PublicKey publicKey, String msg, String signature)
      throws Exception {
    Signature verifier = Signature.getInstance("SHA1withRSA");
    verifier.initVerify(publicKey);
    verifier.update(msg.getBytes(StandardCharsets.UTF_8));
    return verifier.verify(Base64.getDecoder().decode(signature));
  }
}