any help/directions to try and test will be really nice, stuck with the last part of a RSA256 JWT... cant for the love of god pull this damn multiline private key file from the api secrets module, the logs just keep slapping me with a

{
   Error: {
      type: "error.SuiteScriptError",
      name: "AN_ERROR_OCCURRED_WHILE_DECRYPT_PASSWORDGUID",
      message: "An error occurred while decrypting a credential."
   }
}

Aint even trying a guid though damn, or just tell me its impossible because of a secure string issue and i'll try to shim my way towards light? (if thats even possible?)

require(['N/record','N/runtime','N/search','N/format',"N/encode","N/crypto"], function(record,runtime,search,format,encode,crypto) {
  try{
    var header = 'base64_clean_str1';
    var body = 'base64_clean_str2';
    var privateKey = "{custsecret_1}";
        
    var rsa4096 = crypto.createSecretKey({
    secret: privateKey,
    encoding: encode.Encoding.UTF_8
 });

    var biscuit = crypto.createHmac({
    algorithm: crypto.HashAlg.SHA256,
    key:rsa4096
 });

 biscuit.update({
    input:header +"."+ body,
    inputEncoding: encode.Encoding.UTF_8
 });

    var signature = biscuit.digest({
    outputEncoding:encode.Encoding.BASE_64_URL_SAFE
 })

    log.debug("signature",signature);

  var abc = 1;

  } catch (e) {
    var scriptId = runtime.getCurrentScript().id;
    log.error('ERROR:'+scriptId+':fn:'+runtime.executionContext, JSON.stringify({type: e.type,name: e.name,message: e.message,stack: e.stack,cause: JSON.stringify(e.cause),id: e.id}));
  }
});

its extremely unlikely that your private key is encoded using utf-8

I may be attempting some manual JWT generation as well - was assuming I would leverage the

Certificates

store in NS?

@battk its one of those that go

-----BEGIN PRIVATE KEY-----
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDB676k31ygRVmc
...
vDFbIqe9mWaLPZ+eGTMVXqxGYZgpC0f47jnr0om3jzFFLM7+zDhztIRkXnfHKNJk
GUFNkknDR6s+oCA/Xej+utA/tUf2nQ==
-----END PRIVATE KEY-----

thats a private key for use in asymmetric encryption

you're right I did some research and its asym because i'm doing RS256, not the HS256, but my other file isn't a pem. but a csr file. I'm not a cryptography expert, but from research so far I think I can use the synchronous method, with the private key?

there is no support for asymmetric crypto in suitescript

@battk do you think in theory use cryptojs with a shim? and leave it out of the secure string?

same answer actually, there is no support for asymmetric crypto in cryptojs

@battk i did find this jsrsasign, i guess this is the last straw to try then

short answer is no, long answer is you dont know the difference between encryption and digital signature/signing

It looks like they are trying to do signing, not encryption.

@battk true. what I do know is I have only one set of keys in common to both systems, hopefully that puts me on symmetric the csr that I uploaded verified against the private key on their system api-sdk, so probably something in the signature generation is wrong for me but for me I do need to figure out the technology and theory

thats a hmac, which should correspond to HS256

@battk OK, so that means where i broke is probably indeed netsuite side 😂

actually, that isnt a hmac

@battk you're right, thats just a hash on the header that's signed can we break it down further?

a hash would only be useful if there is some other encryption going on inside that body json

@battk indeed, i think what this is is a HS256 variant, but the signed key is different

meh, im assuming something is missing

@battk indeed, and my current issue i've had is either the last part is super short, or i'm getting the GUID error

im not sure what json body you are hashing, but once its hashed, the receiver of the hash wont be able to tell what the original data was

i mean i'm checking the signature and its

AslST2owWI56Akl2t0QYTLZCnsvqEUJyJV6oUVuyGbM

vs

jsnBEBlcogkB2MHQmH2axqAKdK5splDXnrzZ_MHWaCeKqoX-kMorQzuEltUIuTM1PXFC_5ts9YqiWon7M4ye9fQ8l4xye9M4pXf_TqVAOsm9sJsYxDbEcyeZkNQ5A9mZfXwQ8JaFj6_a56ovEaupsQX2aa0AVVo0hihwnHAF0Ubn0MgnkEqQ6Ax2EWoJrPcQy5-nQkoowqPHL4kMfeUslstNXljpzqSLmuECQNF8b_0SVoLzTCRlRXXMCr3-0CxBuxmOenve_eWXIT5PyOihYtx0LDGQBjHtIosfMRyh8VmTw8meVl-TIKyWPD0rKGKh8T76zJ0XxQVQsH0DmTnQkK9nXg_N_1yxp-xQl6X01hqN1-8f2mqg64TE9z5bn4llhFpuQwv_WFKYW2XjXH_PPL9CpraLYe_ezJ53Aevg0m1oiUg7paiGGjK-gdvkDtSpmmyEaJWU5z_FhJHR8ro-meI_FEzGYa4qWNXSyZvEOyY4hNHiS1AJb1u9znacA0oCeF9YLnhVllrcL6_28LXOU5CisxkVxw7ECi1X4IwcOiBlDnDAp8lPKd2rghwBfB-BwsNo_vIy1_xfN4SPli0ObCnSk96LMqVn5Mu3CKNM_6Wxt-Ht8SRt1KXUkSzQ6ffJabRLDYHgPOYMkBscMCrkRNLT6FesiemOtfTiBz4AsAk

AslST2owWI56Akl2t0QYTLZCnsvqEUJyJV6oUVuyGbM

is a proper sha-256 hash

jsnBEBlcogkB2MHQmH2axqAKdK5splDXnrzZ_MHWaCeKqoX-kMorQzuEltUIuTM1PXFC_5ts9YqiWon7M4ye9fQ8l4xye9M4pXf_TqVAOsm9sJsYxDbEcyeZkNQ5A9mZfXwQ8JaFj6_a56ovEaupsQX2aa0AVVo0hihwnHAF0Ubn0MgnkEqQ6Ax2EWoJrPcQy5-nQkoowqPHL4kMfeUslstNXljpzqSLmuECQNF8b_0SVoLzTCRlRXXMCr3-0CxBuxmOenve_eWXIT5PyOihYtx0LDGQBjHtIosfMRyh8VmTw8meVl-TIKyWPD0rKGKh8T76zJ0XxQVQsH0DmTnQkK9nXg_N_1yxp-xQl6X01hqN1-8f2mqg64TE9z5bn4llhFpuQwv_WFKYW2XjXH_PPL9CpraLYe_ezJ53Aevg0m1oiUg7paiGGjK-gdvkDtSpmmyEaJWU5z_FhJHR8ro-meI_FEzGYa4qWNXSyZvEOyY4hNHiS1AJb1u9znacA0oCeF9YLnhVllrcL6_28LXOU5CisxkVxw7ECi1X4IwcOiBlDnDAp8lPKd2rghwBfB-BwsNo_vIy1_xfN4SPli0ObCnSk96LMqVn5Mu3CKNM_6Wxt-Ht8SRt1KXUkSzQ6ffJabRLDYHgPOYMkBscMCrkRNLT6FesiemOtfTiBz4AsAk

and

AslST2owWI56Akl2t0QYTLZCnsvqEUJyJV6oUVuyGbM

is actually the signature after hmac that i'm comparing

the output you are getting from the api is not a hash or hmac

@battk i was thinking in one case the hmac with key as param null, and the other with the key as some 3000 characters would elongate it and make the difference?

the output of a hmac and hash is fixed in length

oh i see, ok i get you, which means in my code im missing something or some massaging or the likes

whatever you are working with is not the end product

@battk i see, let me test, will keep you updated many thanks @battk!!!

which api are you trying to work with

Someone just raised my attention that creating a JWT example code is right there in the HTTPS module documentation https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4418229131.html

hs256 is hmac based, which is something that N/crypto will do