详解Java 加密解密和数字签名问题

<em>/**
 * 对称加密-3DES算法，取代旧的DES
 */</em>
SecretKey desKey = KeyGenerator.getInstance("DESede").generateKey();

<em>/**
* 生成AES算法的密钥
*/</em>
SecretKey aesKey = KeyGenerator.getInstance("AES").generateKey();

SecretKey desKey = KeyGenerator.getInstance("DESede").generateKey();
<em>// 二进制密钥</em>
byte[] bkey = desKey.getEncoded();
<em>// 转成十六进制</em>
String keyStr = Hex.byteCoverToString(bkey);

<em>// bkey是byte数组</em>
DESedeKeySpec keySpec = new DESedeKeySpec(bkey);
<em>// 读取AES密钥</em>
SecretKey srtKey = SecretKeyFactory.getInstance("AES").generateSecret(keySpec);

<em>/**
 * 可以传RSA或DSA算法
 */</em>
KeyPair keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
<em>// 私钥</em>
PrivateKey prvKey = keyPair.getPrivate();
<em>// 公钥</em>
PublicKey pubKey = keyPair.getPublic();

<em>// 私钥串</em>
String prvKeyStr = Base64.getEncoder().encodeToString(prvKey.getEncoded());
<em>// 公钥串</em>
String pubKeyStr = Base64.getEncoder().encodeToString(pubKey.getEncoded());

<em>// 从二进制中读取私钥</em>
byte[] bPrvKey = Base64.getDecoder().decode(prvKeyStr);
PKCS8EncodedKeySpec rsaKeySpec = new PKCS8EncodedKeySpec(bPrvKey);
PrivateKey prvKey = KeyFactory.getInstance("RSA").generatePrivate(rsaKeySpec);

<em>// 从二进制中读取公钥</em>
byte[] bPubKey = Base64.getDecoder().decode(pubKeyStr);
X509EncodedKeySpec rsaKeySpec1 = new X509EncodedKeySpec(bPubKey);
PublicKey pubKey = KeyFactory.getInstance("RSA").generatePublic(rsaKeySpec1);

<em>// keyFilePath是证书文件</em>
try (InputStream fin = new FileInputStream(keyFilePath)) {
    CertificateFactory f = CertificateFactory.getInstance("X.509");
    X509Certificate certificate = (X509Certificate) f.generateCertificate(fin);
    PublicKey pubKey = certificate.getPublicKey();
} catch (IOException | CertificateException e) {
    e.printStackTrace();
}

try (InputStream is = new FileInputStream(keyFilePath)) {
    <em>// pkcs12或jks</em>
    KeyStore store = KeyStore.getInstance("pkcs12");
    <em>// 密码</em>
    store.load(is, "密码".toCharArray());
    <em>// 获取所有密钥别名列表</em>
    Enumeration<String> e = store.aliases();
    <em>// 如果有，读取第一个密钥</em>
    if (e.hasMoreElements()) {
        String alias = e.nextElement();
        <em>// 私钥</em>
        PrivateKey prvKey = (PrivateKey) store.getKey(alias, password.toCharArray());
        <em>// 公钥</em>
        PublicKey pubKey = store.getCertificate(alias).getPublicKey();
        <em>// 创建密钥对</em>
        KeyPair keyPare = new KeyPair(pubKey, prvKey);
    }

} catch (IOException | KeyStoreException | CertificateException | NoSuchAlgorithmException | UnrecoverableKeyException e) {
    e.printStackTrace();
}

<em>// 密文</em>
String ciphertext = null;

{
    String plaintext = "加密内容";
    <em>// 密钥算法，RSA/DAS/AESDESed</em>
    Cipher cipher = Cipher.getInstance("RSA");
    <em>// 设置加密模式</em>
    cipher.init(Cipher.ENCRYPT_MODE, prvKey);
    <em>// 加密后的byte数组</em>
    byte[] cipherbyte = cipher.doFinal(plaintext.getBytes());
    <em>// 转成base64</em>
    ciphertext = Base64.getEncoder().encodeToString(cipherbyte);
    logger.info(ciphertext);
}

{
    <em>// 密钥算法，RSA/DAS/AESDESed</em>
    Cipher cipher = Cipher.getInstance("RSA");
    <em>// 设置解密模式</em>
    cipher.init(Cipher.DECRYPT_MODE, pubKey);
    <em>// base64解码获得密文byte数组</em>
    byte[] cipherbyte = Base64.getDecoder().decode(ciphertext);
    <em>// 解密后的byte数组</em>
    byte[] plainbyte = cipher.doFinal(cipherbyte);
    <em>// byte数组转字符串</em>
    String plaintext = new String(plainbyte);
    logger.info(plaintext);
}

<em>// 可传入MD5或SHA算法</em>
MessageDigest md = MessageDigest.getInstance("MD5");
<em>// 对str数据签名</em>
byte[] bSign = md.digest(str.getBytes());
<em>// 转成十六进制签名串</em>
String signStr = Hex.byteCoverToString(bSign);

<em>/**
 * 签名
 * @param key
 * @param algorithm
 * @param data
 * @return
 */</em>
public static byte[] sign(PrivateKey key, String algorithm, byte[] data) {

    try {

        Signature signature = Signature.getInstance(algorithm);
        signature.initSign(key);
        signature.update(data);
        return signature.sign();

    } catch (NoSuchAlgorithmException | SignatureException | InvalidKeyException e) {
        throw new CommonException(e);
    }
}

<em>/**
 * 验签
 * @param key
 * @param algorithm
 * @param sign
 * @param data
 * @return
 */</em>
public static boolean verify(PublicKey key, String algorithm, byte[] sign, byte[] data) {

    try {

        Signature signature = Signature.getInstance(algorithm);
        signature.initVerify(key);
        signature.update(data);
        return signature.verify(sign);

    } catch (NoSuchAlgorithmException | SignatureException | InvalidKeyException e) {
        throw new CommonException(e);
    }
}