sahamati / aa-redirection-guidelines Goto Github PK

WE need to discuss redirection guidelines for AA-TSP if the flow is entirely offline journye.

Need encryption decryption format written on crypto.js methodology for frontend use.

• we have a sample of java how we will encrypt web redirection essential values in ASE 256 algo but we need a javascript
  description where we can identify how will we do a code in same format using ASE 256 with given keys as mention on
  below.

• Facing a issue while we generate secretkey using salt and key in JS so aeed a javascript code using crypto.js lib will help
  us to encrypt or decrypt value similar format as backend on frontend-side.

• We are using same value as mention on doc:

  IV – This can be 0
  SALT – This will be the reqdate or resdate
  FI – This will be the unique FIU ID ( i.e. the FIU entity id )
  SECRETKEY – This will be the secret passphrase shared by the AA with the FIU.
  

• Sample of JS code what we have designed

// generate secret key using key and salt
const getSecretKey = () => {
  var secretkey = redirectionSecretKey;
  var saltKey = "abcde";
  var key = CryptoJS.enc.Utf8.parse(secretkey);
  var salt = CryptoJS.enc.Utf8.parse(saltKey);
   const generateKey = CryptoJS.PBKDF2(key, salt, {
      keySize: 256,
       iterations: 1000,
   });
 return generateKey;
};

// generate IV
const getIv = () => {
 var iv2 = CryptoJS.lib.WordArray.create([
   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 ]);
 return iv2;
};

// Encryption method
export const encodeDataInASE2 = (data) => {
 var encrypted = CryptoJS.AES.encrypt(
   data,
   getSecretKey2(),
   {
     iv: getIv2(),
     mode: CryptoJS.mode.CBC,
     padding: CryptoJS.pad.Pkcs7,
   }
 ).toString();

 return encrypted;
};

// Decryption method
export const decodeDataFromASE = (ciphertext) => {
 const decryptCiphertext = CryptoJS.AES.decrypt(ciphertext, getSecretKey(), {
   iv: getIv(),
   mode: CryptoJS.mode.CBC,
   padding: CryptoJS.pad.Pkcs7,
 });
 const decryptedData = JSON.parse(
   decryptCiphertext.toString(CryptoJS.enc.Utf8)
 );

 return decryptedData;
};

As AA, do we need to show all unapproved LSP based consent requests in LSP based redirection flow?
This will have more consents in customers AA portal. How to handle it.
My suggestion is whether can we have timeout to unapproved consent once the customer partially selects 3-4 FIUs from LSP or reject the unapproved consent immediately once the LSP flow is done.

The datetime format mentioned in the gitbook for reqdate is ddmmyyyyhh24misss, but the description is unclear for it

Ambiguous text:

then they can pass this info to AA as a comma separated array in curly braces

The ecreq parameters are expected in standard application/x-www-form-urlencoded format. Thus for supplying multiple FIP identifiers, the format should be &fipid=XXXX&fipid=YYYY.