推送验签（收钱吧 → 用户）

加密方式

• 加密方式：SHA256WithRSA
• 公钥格式：PKCS#8

公钥示例

publicKey
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3Hlg887xrRWYxPqLDX53oimjsxfd7PDdhQ4zHUYA1eQP6PMyhAo+GU/oq4RQVpW6LrG0PWA6CoD7qva6T0NwsDWn5/fmWhmH+Ad6K5WG5jY9ZVjnys9R+HGeFyE7hSkhqSgiSlEMv9IBJD5p9ZqBZ0FAPotMS/RIBHANVA37J0Zlp9wakvUegcXb3hl9xp+aRsjikhS5h89qiPPXGkWq9dsQrbpDODP8RziqskxzIzu4tYtvLkUZ/Ak9LCRu63SSGX+yAj24mG9Q+4taWGX32AmuVFK9CGDoec0IYx8ouUtiGWVBqZz0dRteKbBbL6MtnPjUxT+wMc6rarPL8zj9vwIDAQAB

解密方式

• 报文一共有 5 个字段：signature、eventId、timestamp、nonce、content（content 为最后的推送业务数据报文，JSON 格式，nonce 为随机数）
• 验签明文拼接：

plaintext = eventId + timestamp + nonce + content

Java 参考代码

public boolean verifySignatureSHA256WithRSA(String plaintext, String inputSignature, String publicKey) {
    return verifySignatureSHA256WithRSA(plaintext.getBytes(StandardCharsets.UTF_8), inputSignature, publicKey);
}

public boolean verifySignatureSHA256WithRSA(byte[] plaintextByte, String inputSignature, String pubKey) {
    try {
        X509EncodedKeySpec bobPubKeySpec = new X509EncodedKeySpec(Base64
                .getDecoder().decode(pubKey));
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        PublicKey publicKey = keyFactory.generatePublic(bobPubKeySpec);
        byte[] signed = Base64.getDecoder().decode(inputSignature);
        Signature signature = Signature.getInstance("SHA256WithRSA");
        signature.initVerify(publicKey);
        signature.update(plaintextByte);
        return signature.verify(signed);
    } catch (Exception e) {
        // TODO: 记录异常
    }
    return false;
}