RSA Encryption & Digital Signature

<?php

class NagadCrypto {

    /**
     * Encrypt sensitive data using Nagad Public Key with PKCS1 Padding
     */
    public static function encrypt(string $data, string $nagadPublicKeyPem): string {
        $publicKey = openssl_pkey_get_public($nagadPublicKeyPem);
        $encrypted = '';
        openssl_public_encrypt($data, $encrypted, $publicKey, OPENSSL_PKCS1_PADDING);
        return base64_encode($encrypted);
    }

    /**
     * Generate SHA1withRSA signature using Merchant Private Key
     */
    public static function sign(string $data, string $merchantPrivateKeyPem): string {
        $privateKey = openssl_pkey_get_private($merchantPrivateKeyPem);
        $signature = '';
        openssl_sign($data, $signature, $privateKey, OPENSSL_ALGO_SHA1);
        return base64_encode($signature);
    }

    /**
     * Decrypt sensitive response data using Merchant Private Key
     */
    public static function decrypt(string $base64Data, string $merchantPrivateKeyPem): string {
        $privateKey = openssl_pkey_get_private($merchantPrivateKeyPem);
        $decrypted = '';
        openssl_private_decrypt(base64_decode($base64Data), $decrypted, $privateKey, OPENSSL_PKCS1_PADDING);
        return $decrypted;
    }

    /**
     * Verify signature using Nagad Public Key
     */
    public static function verify(string $data, string $base64Signature, string $nagadPublicKeyPem): bool {
        $publicKey = openssl_pkey_get_public($nagadPublicKeyPem);
        $result = openssl_verify($data, base64_decode($base64Signature), $publicKey, OPENSSL_ALGO_SHA1);
        return $result === 1;
    }
}

<?php

namespace App\Services;

class NagadService {
    protected string $merchantId;
    protected string $merchantPrivateKey;
    protected string $nagadPublicKey;

    public function __construct() {
        $this->merchantId = config('nagad.merchant_id');
        $this->merchantPrivateKey = config('nagad.merchant_private_key');
        $this->nagadPublicKey = config('nagad.nagad_public_key');
    }

    public function encrypt(string $plainData): string {
        $publicKey = openssl_pkey_get_public($this->nagadPublicKey);
        openssl_public_encrypt($plainData, $encrypted, $publicKey, OPENSSL_PKCS1_PADDING);
        return base64_encode($encrypted);
    }

    public function sign(string $plainData): string {
        $privateKey = openssl_pkey_get_private($this->merchantPrivateKey);
        openssl_sign($plainData, $signature, $privateKey, OPENSSL_ALGO_SHA1);
        return base64_encode($signature);
    }

    public function decrypt(string $cipherBase64): string {
        $privateKey = openssl_pkey_get_private($this->merchantPrivateKey);
        openssl_private_decrypt(base64_decode($cipherBase64), $decrypted, $privateKey, OPENSSL_PKCS1_PADDING);
        return $decrypted;
    }
}

import base64
import json
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5 as Cipher_PKCS1_v1_5
from Crypto.Signature import PKCS1_v1_5 as Signature_PKCS1_v1_5
from Crypto.Hash import SHA1

class NagadCrypto:
    @staticmethod
    def encrypt(data_str: str, nagad_pub_key_pem: str) -> str:
        rsa_key = RSA.import_key(nagad_pub_key_pem)
        cipher = Cipher_PKCS1_v1_5.new(rsa_key)
        encrypted_bytes = cipher.encrypt(data_str.encode('utf-8'))
        return base64.b64encode(encrypted_bytes).decode('utf-8')

    @staticmethod
    def sign(data_str: str, merchant_priv_key_pem: str) -> str:
        rsa_key = RSA.import_key(merchant_priv_key_pem)
        signer = Signature_PKCS1_v1_5.new(rsa_key)
        h = SHA1.new(data_str.encode('utf-8'))
        signature = signer.sign(h)
        return base64.b64encode(signature).decode('utf-8')

    @staticmethod
    def decrypt(cipher_base64: str, merchant_priv_key_pem: str) -> str:
        rsa_key = RSA.import_key(merchant_priv_key_pem)
        cipher = Cipher_PKCS1_v1_5.new(rsa_key)
        cipher_bytes = base64.b64decode(cipher_base64)
        decrypted_bytes = cipher.decrypt(cipher_bytes, sentinel=None)
        return decrypted_bytes.decode('utf-8')

    @staticmethod
    def verify(data_str: str, sig_base64: str, nagad_pub_key_pem: str) -> bool:
        rsa_key = RSA.import_key(nagad_pub_key_pem)
        verifier = Signature_PKCS1_v1_5.new(rsa_key)
        h = SHA1.new(data_str.encode('utf-8'))
        sig_bytes = base64.b64decode(sig_base64)
        return verifier.verify(h, sig_bytes)

package com.nagad.payment;

import java.security.*;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;
import javax.crypto.Cipher;

public class NagadCrypto {

    public static String encrypt(String plainData, String publicKeyPem) throws Exception {
        PublicKey publicKey = loadPublicKey(publicKeyPem);
        Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
        cipher.init(Cipher.ENCRYPT_MODE, publicKey);
        byte[] encryptedBytes = cipher.doFinal(plainData.getBytes("UTF-8"));
        return Base64.getEncoder().encodeToString(encryptedBytes);
    }

    public static String sign(String plainData, String privateKeyPem) throws Exception {
        PrivateKey privateKey = loadPrivateKey(privateKeyPem);
        Signature signature = Signature.getInstance("SHA1withRSA");
        signature.initSign(privateKey);
        signature.update(plainData.getBytes("UTF-8"));
        return Base64.getEncoder().encodeToString(signature.sign());
    }

    public static String decrypt(String base64EncryptedData, String privateKeyPem) throws Exception {
        PrivateKey privateKey = loadPrivateKey(privateKeyPem);
        Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
        cipher.init(Cipher.DECRYPT_MODE, privateKey);
        byte[] decoded = Base64.getDecoder().decode(base64EncryptedData);
        return new String(cipher.doFinal(decoded), "UTF-8");
    }

    private static PublicKey loadPublicKey(String pem) throws Exception {
        String cleanKey = pem.replaceAll("\\n", "").replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "");
        byte[] keyBytes = Base64.getDecoder().decode(cleanKey);
        X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
        return KeyFactory.getInstance("RSA").generatePublic(spec);
    }

    private static PrivateKey loadPrivateKey(String pem) throws Exception {
        String cleanKey = pem.replaceAll("\\n", "").replace("-----BEGIN PRIVATE KEY-----", "").replace("-----END PRIVATE KEY-----", "");
        byte[] keyBytes = Base64.getDecoder().decode(cleanKey);
        PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);
        return KeyFactory.getInstance("RSA").generatePrivate(spec);
    }
}