匿名密钥证明(ArkTS)
=============

在使用本功能时，需确保网络通畅。

#### 开发步骤

1.  指定密钥别名，密钥别名命名规范参考[密钥生成介绍及算法规格](https://developer.huawei.com/consumer/cn/doc/harmonyos-guides/huks-key-generation-overview)。
    
2.  初始化参数集。
    
    [HuksOptions](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-huks#huksoptions)中的properties字段中的参数必须包含[HUKS\_TAG\_ATTESTATION\_CHALLENGE](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-huks#hukstag)属性,可选参数包含[HUKS\_TAG\_ATTESTATION\_ID\_VERSION\_INFO](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-huks#hukstag)，[HUKS\_TAG\_ATTESTATION\_ID\_ALIAS](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-huks#hukstag)属性。
    
3.  生成非对称密钥，具体请参考[密钥生成](https://developer.huawei.com/consumer/cn/doc/harmonyos-guides/huks-key-generation-overview)。
    
4.  将密钥别名与参数集作为参数传入[anonAttestKeyItem](https://developer.huawei.com/consumer/cn/doc/harmonyos-references/js-apis-huks#huksanonattestkeyitem11)方法中，即可证明密钥。
    

#### 开发案例

/\*
 \* 以下以anonAttestKey的Promise接口操作验证为例
 \*/
import { huks } from '@kit.UniversalKeystoreKit';

/\* 1.确定密钥别名 \*/
let keyAliasString = 'key anon attest';
let aliasString = keyAliasString;
let aliasUint8 = stringToUint8Array(keyAliasString);
let securityLevel = stringToUint8Array('sec\_level');
let challenge = stringToUint8Array('challenge\_data');
let versionInfo = stringToUint8Array('version\_info');
let anonAttestCertChain: string\[\];

class ThrowObject {
  public isThrow: boolean = false;
}

/\* 封装生成时的密钥参数集 \*/
let genKeyProperties: huks.HuksParam\[\] = \[
  {
    tag: huks.HuksTag.HUKS\_TAG\_ALGORITHM,
    value: huks.HuksKeyAlg.HUKS\_ALG\_RSA
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_KEY\_SIZE,
    value: huks.HuksKeySize.HUKS\_RSA\_KEY\_SIZE\_2048
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_PURPOSE,
    value: huks.HuksKeyPurpose.HUKS\_KEY\_PURPOSE\_VERIFY
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_DIGEST,
    value: huks.HuksKeyDigest.HUKS\_DIGEST\_SHA256
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_PADDING,
    value: huks.HuksKeyPadding.HUKS\_PADDING\_PSS
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_KEY\_GENERATE\_TYPE,
    value: huks.HuksKeyGenerateType.HUKS\_KEY\_GENERATE\_TYPE\_DEFAULT
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_BLOCK\_MODE,
    value: huks.HuksCipherMode.HUKS\_MODE\_ECB
  }
\]
let genOptions: huks.HuksOptions = {
  properties: genKeyProperties
};

/\* 2.封装证明密钥的参数集 \*/
let anonAttestKeyProperties: huks.HuksParam\[\] = \[
  {
    tag: huks.HuksTag.HUKS\_TAG\_ATTESTATION\_ID\_SEC\_LEVEL\_INFO,
    value: securityLevel
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_ATTESTATION\_CHALLENGE,
    value: challenge
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_ATTESTATION\_ID\_VERSION\_INFO,
    value: versionInfo
  },
  {
    tag: huks.HuksTag.HUKS\_TAG\_ATTESTATION\_ID\_ALIAS,
    value: aliasUint8
  }
\]
let huksOptions: huks.HuksOptions = {
  properties: anonAttestKeyProperties
};

function stringToUint8Array(str: string) {
  let arr: number\[\] = \[\];
  for (let i = 0, j = str.length; i < j; ++i) {
    arr.push(str.charCodeAt(i));
  }
  return new Uint8Array(arr);
}

function generateKeyItem(keyAlias: string, huksOptions: huks.HuksOptions, throwObject: ThrowObject) {
  return new Promise<void>((resolve, reject) => {
    try {
      huks.generateKeyItem(keyAlias, huksOptions, (error, data) => {
        if (error) {
          reject(error);
        } else {
          resolve(data);
        }
      });
    } catch (error) {
      throwObject.isThrow = true;
      throw (error as Error);
    }
  });
}

/\* 3.生成密钥 \*/
async function publicGenKeyFunc(keyAlias: string, huksOptions: huks.HuksOptions) {
  console.info(\`enter promise generateKeyItem\`);
  let throwObject: ThrowObject = { isThrow: false };
  try {
    await generateKeyItem(keyAlias, huksOptions, throwObject)
      .then((data) => {
        console.info(\`promise: generateKeyItem success, data = ${JSON.stringify(data)}\`);
      })
      .catch((error: Error) => {
        if (throwObject.isThrow) {
          throw (error as Error);
        } else {
          console.error(\`promise: generateKeyItem failed, ${JSON.stringify(error)}\`);
        }
      });
  } catch (error) {
    console.error(\`promise: generateKeyItem input arg invalid, ${JSON.stringify(error)}\`);
  }
}

/\* 4.证明密钥 \*/
function anonAttestKeyItem(keyAlias: string, huksOptions: huks.HuksOptions, throwObject: ThrowObject) {
  return new Promise<huks.HuksReturnResult>((resolve, reject) => {
    try {
      huks.anonAttestKeyItem(keyAlias, huksOptions, (error, data) => {
        if (error) {
          reject(error);
        } else {
          resolve(data);
        }
      });
    } catch (error) {
      throwObject.isThrow = true;
      throw (error as Error);
    }
  });
}

async function publicAnonAttestKey(keyAlias: string, huksOptions: huks.HuksOptions): Promise<string> {
  console.info(\`enter promise anonAttestKeyItem\`);
  let throwObject: ThrowObject = { isThrow: false };
  try {
    await anonAttestKeyItem(keyAlias, huksOptions, throwObject)
      .then((data) => {
        console.info(\`promise: anonAttestKeyItem success, data = ${JSON.stringify(data)}\`);
        if (data !== null && data.certChains !== null) {
          anonAttestCertChain = data.certChains as string\[\];
        }
      })
      .catch((error: Error) => {
        if (throwObject.isThrow) {
          throw (error as Error);
        } else {
          console.error(\`promise: anonAttestKeyItem failed, ${JSON.stringify(error)}\`);
        }
      });
    return 'Success';
  } catch (error) {
    console.error(\`promise: anonAttestKeyItem input arg invalid, ${JSON.stringify(error)}\`);
    return 'Failed';
  }
}

async function anonAttestKeyTest(): Promise<string> {
  await publicGenKeyFunc(aliasString, genOptions);
  let ret = await publicAnonAttestKey(aliasString, huksOptions);
  console.info('anon attest certChain data: ' + anonAttestCertChain)
  return ret;
}