API (MeaWallet)

<dependency>
  <groupId>com.meawallet.commons</groupId>
  <artifactId>mw-totp</artifactId>
  <version>4.8.100</version>
</dependency>

import com.meawallet.commons.totp.CardSecretGenerationConfig;
import com.meawallet.commons.totp.CardSecretGenerator;
import com.meawallet.commons.totp.CardSecretKey;
import com.meawallet.commons.totp.GeneratedCardSecret;
import com.meawallet.commons.totp.TimestepProvider;
import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Hex;

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.time.Clock;
import java.time.Duration;

public class MeaWalletSecretsGenerator {

    private static final String SEPARATOR = "#";
    private static final String ALGORITHM = "AES/CBC/PKCS5Padding";
    private static final String AES = "AES";
    private static final String KEY_ID = "001";
    private static final String M12_TOTP_KEY = "...";
    private static final String M11_API_KEY_ID = "...";
    private static final String M11_API_KEY = "...";

    public String generateTotpSecret(String cardToken) {
        CardSecretKey sha512key = CardSecretKey
                .builder()
                .sharedKey(M12_TOTP_KEY)
                .cardId(cardToken)
                .algorithm(com.meawallet.commons.totp.HmacHashAlgorithm.SHA_512);

        TimestepProvider timestepProvider = new TimestepProvider(Clock.systemUTC());
        CardSecretGenerator generator = new CardSecretGenerator(timestepProvider);
        CardSecretGenerationConfig config = CardSecretGenerationConfig
                .builder(sha512key)
                .timestepWindowSize(Duration.ofSeconds(60))
                .cardSecretLength(8);

        GeneratedCardSecret cardSecret = generator.generate(config);
        String secret = cardSecret.getSecret();
        return KEY_ID + SEPARATOR + secret;
    }

    public String getEncryptedMeaSecretHeader(String meaTraceId) throws GeneralSecurityException, DecoderException {
        String inputForSecret = meaTraceId + SEPARATOR + M11_API_KEY_ID;
        byte[] inputBytes = inputForSecret.getBytes(StandardCharsets.US_ASCII);

        byte[] encryptedSecret = initCipher().doFinal(inputBytes);

        return Hex.encodeHexString(encryptedSecret, false);
    }

    private Cipher initCipher() throws GeneralSecurityException {
        SecretKeySpec secretKeySpec = new SecretKeySpec(Hex.decodeHex(M11_API_KEY), AES);

        byte[] ivBytes = new byte[16];
        IvParameterSpec ivParameterSpec = new IvParameterSpec(ivBytes);

        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, ivParameterSpec);

        return cipher;
    }
}

String meaTraceId = UUID.randomUUID().toString();
String encryptedMeaSecretHeader = meaWalletSecretsGenerator.getEncryptedMeaSecretHeader(meaTraceId);
String totpSecret = meaWalletSecretsGenerator.generateTotpSecret(cardToken);
String g1fingerprint = G1_FINGERPRINT_CONSTANT;
EncryptedPanResponse encryptedPanResponse = webClient.post()
	.contentType(MediaType.APPLICATION_JSON)
  .header(MEA_TRACE_ID_HEADER, meaTraceId)
  .header(MEA_API_KEY_ID_HEADER, M11_API_KEY_ID)
  .header(MEA_SECRET_HEADER, encryptedMeaSecretHeader)
  .bodyValue(new MeaWalletGetPanRequest(cardToken, totpSecret, encryptedSessionKey, g1fingerprint))
  .exchange()
  .flatMap(clientResponse -> {
   	return clientResponse.bodyToMono(EncryptedPanResponse.class);
	})
.block();

const showCardDetails = async () => {
  try {
    const { sessionKey, encryptedSessionKey } = await getSessionKey( // generate the session key
      process.env.REACT_APP_MEA_WALLET_G1_KEY!
    );
    const { encryptedData, iv } = await api.getCardSensitiveData( // call the Pliant API
      card.cardId,
      encryptedSessionKey
    );
    const cardDetailsJSON = await decryptWithSessionKey( // decrypt the received data
      sessionKey,
      encryptedData,
      iv
    );
    setCardDetails(JSON.parse(cardDetailsJSON));
  } catch (error) {
    // some error handling
  }
};

import { pem2jwk } from 'pem-jwk';
import KeyEncoder from 'key-encoder';

const arrayBufferToHex = (buffer: ArrayBuffer) => {
  return Array.prototype.map
    .call(new Uint8Array(buffer), (x) => ('00' + x.toString(16)).slice(-2))
    .join('');
};

export const getSessionKey = async (rawPublicKey: string) => {
  const keyEncoder = new KeyEncoder('secp256k1');
  const pemPublicKey = keyEncoder.encodePublic(rawPublicKey, 'raw', 'pem');
  const jwkA = pem2jwk(pemPublicKey);
  const [rsaKey, sessionKey] = await Promise.all([
    crypto.subtle.importKey(
      'jwk',
      jwkA,
      { name: 'RSA-OAEP', hash: 'SHA-512' },
      false,
      ['wrapKey']
    ),
    crypto.subtle.generateKey({ name: 'AES-CBC', length: 256 }, true, [
      'decrypt',
    ]),
  ]);
  const wrappedKey = await window.crypto.subtle.wrapKey(
    'raw',
    sessionKey,
    rsaKey,
    { name: 'RSA-OAEP' }
  );

  return {
    sessionKey,
    encryptedSessionKey: arrayBufferToHex(wrappedKey).toUpperCase(),
  };
};

export const decryptWithSessionKey = async (
  sessionKey: CryptoKey,
  encryptedData: string,
  iv: string
) => {
  const bufferResult = await crypto.subtle.decrypt(
    {
      name: 'AES-CBC',
      iv: Uint8Array.from(Buffer.from(iv, 'hex')).buffer,
    },
    sessionKey,
    Buffer.from(encryptedData, 'hex')
  );

  let json = '';
  new Uint8Array(bufferResult).forEach(
    (byte: number) => (json += String.fromCharCode(byte))
  );

  return json;
};

{
  "encryptedData": {
    "pan": "5555444433338888123",
    "cvv": "878",
    "expiry": "2025-05-31",
    "embossname": "JOHN SMITH"
  },
  "iv": "31323334353637383930313233343536"
}