‌Interface Encryption Usage Instructions

For security reasons, the login API uses encrypted transmission. We implement this with a combination of AES + RSA, and all APIs that require encryption use this same method.

The advantage of symmetric encryption with AES is high efficiency for encryption and decryption, but it is not secure enough on its own, because the key must remain known only to the communicating parties. That is difficult to guarantee using only symmetric encryption.

The advantage of asymmetric encryption with RSA is relatively secure data transmission, but its encryption and decryption efficiency is low. However, when encrypting only a few bytes of AES key data, the time cost is negligible.

Therefore, by combining the strengths of both and avoiding their weaknesses, AES + RSA provides a much more robust data encryption solution.

Use AES to encrypt the data for efficient encryption and decryption

Use RSA to encrypt the AES key to ensure secure transmission of the AES key

Performing encryption and decryption on the browser side can only guarantee that:

The transmitted data is encrypted or encoded, so even if someone intercepts it with packet capture tools, they cannot understand it or it is difficult to decrypt

The data has not been tampered with, and the sender’s identity can be verified

Detailed encryption steps:

The client uses a random function to generate the key required for AES encryption (hereinafter referred to as the AES key)

The AES key length is 32 characters.

// Generate a random string of the specified length
generateRandomStr() {
  let code = '';
  const chars = 'abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789';
  const charsArr = chars.split('');

  for (let i = 0; i < 32; i++) {
    const num = Math.floor(Math.random() * charsArr.length);
    code += charsArr[num];
  }
  return code;
}

The client uses RSA to encrypt the AES key it generated and passes it through the request header with the parameter name: encrypt-key

The AES key must first be Base64-encoded before being encrypted with RSA.

The RSA public key is:

MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKoR8mX0rGKLqzcWmOzbfj64K8ZIgOdHnzkXSOVOZbFu/TJhZ7rFAN+eaGkl3C4buccQd/EjEsj9ir7ijT7h96MCAwEAAQ==

Use the frontend RSA and AES utility libraries for encryption. Frontend library versions:

"crypto-js": "^4.1.1","jsencrypt": "3.3.1"

import JSEncrypt from 'jsencrypt';
import CryptoJS from 'crypto-js';

// Encrypt
export const encrypt = (txt: string) => {
  const encryptor = new JSEncrypt();
  encryptor.setPublicKey(publicKey); // Set public key
  return encryptor.encrypt(txt); // Encrypt data
};

/**
 * Base64 encoding
 * @returns {string}
 */
export const encryptBase64 = (str: CryptoJS.lib.WordArray) => {
  return CryptoJS.enc.Base64.stringify(str);
};

/**
 * Generate a random AES key
 * @returns {string}
 */
export const generateAesKey = () => {
  return CryptoJS.enc.Utf8.parse(generateRandomStr());
};

The specific generation method is:

The client uses AES and the key generated in step 1 to encrypt the data to be transmitted, and sends it in the request body

The client calls the API and sends the encrypted AES key and encrypted data

After setting token, clientid, and encrypt-key, the API can be called.

request.headers['Authorization'] = 'Bearer ' + getToken();
request.headers['clientid'] = clientid;
request.headers['encrypt-key'] = encrypt(encryptBase64(aesKey));

request.data = typeof request.data === 'object'
  ? encryptWithAes(JSON.stringify(request.data), aesKey)
  : encryptWithAes(request.data, aesKey);