公私钥生成
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;
import java.security.Key;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.util.HashMap;
import java.util.Map;
public class CreateSecrteKey {
public class Keys {
}
public static final String KEY_ALGORITHM = "RSA";
//public static final String SIGNATURE_ALGORITHM = "MD5withRSA";
private static final String PUBLIC_KEY = "knpubPublicKey";
private static final String PRIVATE_KEY = "knpubPrivateKey";
//获得公钥
public static String getPublicKey(Map<String, Object> keyMap) throws Exception {
//获得map中的公钥对象 转为key对象
Key key = (Key) keyMap.get(PUBLIC_KEY);
//byte[] publicKey = key.getEncoded();
//编码返回字符串
return encryptBASE64(key.getEncoded());
}
//获得私钥
public static String getPrivateKey(Map<String, Object> keyMap) throws Exception {
//获得map中的私钥对象 转为key对象
Key key = (Key) keyMap.get(PRIVATE_KEY);
//byte[] privateKey = key.getEncoded();
//编码返回字符串
return encryptBASE64(key.getEncoded());
}
//解码返回byte
public static byte[] decryptBASE64(String key) throws Exception {
return (new BASE64Decoder()).decodeBuffer(key);
}
//编码返回字符串
public static String encryptBASE64(byte[] key) throws Exception {
return (new BASE64Encoder()).encodeBuffer(key);
}
//map对象中存放公私钥
public static Map<String, Object> initKey() throws Exception {
//获得对象 KeyPairGenerator 参数 RSA 1024个字节
KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance(KEY_ALGORITHM);
keyPairGen.initialize(1024);
//通过对象 KeyPairGenerator 获取对象KeyPair
KeyPair keyPair = keyPairGen.generateKeyPair();
//通过对象 KeyPair 获取RSA公私钥对象RSAPublicKey RSAPrivateKey
RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
//公私钥对象存入map中
Map<String, Object> keyMap = new HashMap<String, Object>(2);
keyMap.put(PUBLIC_KEY, publicKey);
keyMap.put(PRIVATE_KEY, privateKey);
return keyMap;
}
public static void main(String[] args) {
Map<String, Object> keyMap;
try {
keyMap = initKey();
String publicKey = getPublicKey(keyMap);
System.out.println(publicKey);
String privateKey = getPrivateKey(keyMap);
System.out.println(privateKey);
} catch (Exception e) {
e.printStackTrace();
}
}
}
加解密工具类
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang.ArrayUtils;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.crypto.Cipher;
import java.io.ByteArrayOutputStream;
import java.security.*;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.HashMap;
import java.util.Map;
/**
* RSA加解密工具类
*/
public final class RSARightUtil {
private static Logger logger = LoggerFactory.getLogger(RSARightUtil.class);
private static final String CHARSET = "UTF-8";
private static final String ALGORITHM_RSA = "RSA";
private static final String ALGORITHM_RSA_SIGN = "SHA1withRSA";
private static final int ALGORITHM_RSA_PRIVATE_KEY_LENGTH = 2048;
/*加解密算法/工作模式/填充方式,Java6.0支持PKCS5Padding填充方式,BouncyCastle支持PKCS7Padding填充方式
工作模式有ECB--电子密码本模式,CBC--加密分组链接模式,CFB--加密反馈模式,OFB--输出反馈模式,CTR--计数器模式
其中ECB过于简单而不安全,已被弃用,相对的CBC模式是最安全的,http://www.moye.me/2015/06/14/cryptography_rsa/
private static final String ALGORITHM_CIPHER_AES = "AES/ECB/PKCS5Padding";
private static final String ALGORITHM_CIPHER_AES_PKCS7 = "AES/CBC/PKCS7Padding";
private static final String ALGORITHM_CIPHER_DESede = "DESede/ECB/PKCS5Padding";*/
private static final String ALGORITHM_CIPHER_ECB = "RSA/ECB/PKCS1Padding";
private RSARightUtil() {
}
/**
* 初始化RSA算法密钥对
*
* @param keysize RSA1024已经不安全了,建议2048
* @return 经过Base64编码后的公私钥Map, 键名分别为publicKey和privateKey
*/
public static Map<String, String> initRSAKey(int keysize) {
KeyPairGenerator kpg;
try {
kpg = KeyPairGenerator.getInstance(ALGORITHM_RSA);
} catch (NoSuchAlgorithmException e) {
logger.error("initRSAKey fail! RSAUtil text: {} ", e);
throw new IllegalArgumentException("No such algorithm-->[" + ALGORITHM_RSA + "]");
}
// 初始化KeyPairGenerator对象,不要被initialize()源码表面上欺骗,其实这里声明的size是生效的
kpg.initialize(ALGORITHM_RSA_PRIVATE_KEY_LENGTH);
// 生成密匙对
KeyPair keyPair = kpg.generateKeyPair();
// 得到公钥
Key publicKey = keyPair.getPublic();
String publicKeyStr = Base64.encodeBase64URLSafeString(publicKey.getEncoded());
// 得到私钥
Key privateKey = keyPair.getPrivate();
String privateKeyStr = Base64.encodeBase64URLSafeString(privateKey.getEncoded());
Map<String, String> keyPairMap = new HashMap<String, String>();
keyPairMap.put("publicKey", publicKeyStr);
keyPairMap.put("privateKey", privateKeyStr);
return keyPairMap;
}
/**
* RSA算法分段加解密数据
*
* @param cipher 初始化了加解密工作模式后的javax.crypto.Cipher对象
* @param opmode 加解密模式,值为javax.crypto.Cipher.ENCRYPT_MODE/DECRYPT_MODE
* @param datas 待分段加解密的数据的字节数组
* @return 加密或解密后得到的数据的字节数组
*/
private static byte[] rsaSplitCodec(Cipher cipher, int opmode, byte[] datas) throws Exception {
int maxBlock = 0;
if (opmode == Cipher.DECRYPT_MODE) {
maxBlock = ALGORITHM_RSA_PRIVATE_KEY_LENGTH / 16;
} else {
maxBlock = ALGORITHM_RSA_PRIVATE_KEY_LENGTH / 8 - 11;
}
ByteArrayOutputStream out = new ByteArrayOutputStream();
int offSet = 0;
byte[] buff;
int i = 0;
try {
while (datas.length > offSet) {
if (datas.length - offSet > maxBlock) {
buff = cipher.doFinal(datas, offSet, maxBlock);
} else {
buff = cipher.doFinal(datas, offSet, datas.length - offSet);
}
out.write(buff, 0, buff.length);
i++;
offSet = i * maxBlock;
}
} catch (Exception e) {
logger.error("rsaSplitCodec fail! RSAUtil text: {} ", e);
throw new Exception("加解密阀值为[" + maxBlock + "]的数据时发生异常", e);
}
byte[] resultDatas = out.toByteArray();
IOUtils.closeQuietly(out);
return resultDatas;
}
/**
* @param data 待加密的明文字符串
* @param key RSA私钥字符串
* @return RSA私钥加密后的经过Base64编码的密文字符串
*/
public static String buildRSAEncryptByPrivateKey(String data, String key) throws Exception {
try {
// 通过PKCS#8编码的Key指令获得私钥对象
PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(Base64.decodeBase64(key));
KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_RSA);
Key privateKey = keyFactory.generatePrivate(pkcs8KeySpec);
// encrypt
Cipher cipher = Cipher.getInstance(ALGORITHM_CIPHER_ECB);
cipher.init(Cipher.ENCRYPT_MODE, privateKey);
byte[] dataReturn = new byte[]{};
// StringBuilder sb = new StringBuilder();
for (int i = 0; i < data.getBytes(CHARSET).length; i += 100) {
byte[] doFinal = cipher.doFinal(ArrayUtils.subarray(data.getBytes(CHARSET), i, i + 100));
// sb.append(new String(doFinal));
dataReturn = ArrayUtils.addAll(dataReturn, doFinal);
}
return Base64.encodeBase64URLSafeString(dataReturn);
} catch (Exception e) {
logger.error("buildRSAEncryptByPrivateKey fail! RSAUtil text: {} ", e);
throw new Exception("加密字符串[" + data + "]时遇到异常", e);
}
}
/**
* RSA算法公钥加密数据
*
* @param data 待加密的明文字符串
* @param key RSA公钥字符串
* @return RSA公钥加密后的经过Base64编码的密文字符串
*/
public static String buildRSAEncryptByPublicKey(String data, String key) throws Exception {
try {
// 通过X509编码的Key指令获得公钥对象
X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(Base64.decodeBase64(key));
KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_RSA);
Key publicKey = keyFactory.generatePublic(x509KeySpec);
// encrypt
Cipher cipher = Cipher.getInstance(ALGORITHM_CIPHER_ECB);
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
byte[] dataReturn = new byte[]{};
// StringBuilder sb = new StringBuilder();
for (int i = 0; i < data.getBytes(CHARSET).length; i += 100) {
byte[] doFinal = cipher.doFinal(ArrayUtils.subarray(data.getBytes(CHARSET), i, i + 100));
// sb.append(new String(doFinal));
dataReturn = ArrayUtils.addAll(dataReturn, doFinal);
}
return Base64.encodeBase64URLSafeString(dataReturn);
} catch (Exception e) {
throw new Exception("加密字符串[" + data + "]时遇到异常", e);
}
}
/**
* RSA算法公钥解密数据
*
* @param data 待解密的经过Base64编码的密文字符串
* @param key RSA公钥字符串
* @return RSA公钥解密后的明文字符串
*/
public static String buildRSADecryptByPublicKey(String data, String key) throws Exception {
try {
// 通过X509编码的Key指令获得公钥对象
X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(Base64.decodeBase64(key));
KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_RSA, new BouncyCastleProvider());
Key publicKey = keyFactory.generatePublic(x509KeySpec);
// decrypt
Cipher cipher = Cipher.getInstance(ALGORITHM_CIPHER_ECB);
cipher.init(Cipher.DECRYPT_MODE, publicKey);
return new String(rsaSplitCodec(cipher, Cipher.DECRYPT_MODE, Base64.decodeBase64(data)), CHARSET);
} catch (Exception e) {
throw new Exception("解密字符串[" + data + "]时遇到异常", e);
}
}
/**
* RSA算法私钥解密数据
*
* @param data 待解密的经过Base64编码的密文字符串
* @param key RSA私钥字符串
* @return RSA私钥解密后的明文字符串
*/
public static String buildRSADecryptByPrivateKey(String data, String key) throws Exception {
try {
// 通过PKCS#8编码的Key指令获得私钥对象
PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(Base64.decodeBase64(key));
KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_RSA);
Key privateKey = keyFactory.generatePrivate(pkcs8KeySpec);
// decrypt
Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());
cipher.init(Cipher.DECRYPT_MODE, privateKey);
return new String(rsaSplitCodec(cipher, Cipher.DECRYPT_MODE, Base64.decodeBase64(data)), CHARSET);
} catch (Exception e) {
throw new Exception("解密字符串[" + data + "]时遇到异常", e);
}
}
/**
* RSA算法使用私钥对数据生成数字签名
*
* @param data 待签名的明文字符串
* @param key RSA私钥字符串
* @return RSA私钥签名后的经过Base64编码的字符串
*/
public static String buildRSASignByPrivateKey(String data, String key) throws Exception {
try {
// 通过PKCS#8编码的Key指令获得私钥对象
PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(Base64.decodeBase64(key));
KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_RSA);
PrivateKey privateKey = keyFactory.generatePrivate(pkcs8KeySpec);
// sign
Signature signature = Signature.getInstance(ALGORITHM_RSA_SIGN);
signature.initSign(privateKey);
signature.update(data.getBytes(CHARSET));
return Base64.encodeBase64URLSafeString(signature.sign());
} catch (Exception e) {
throw new Exception("签名字符串[" + data + "]时遇到异常", e);
}
}
/**
* RSA算法使用公钥校验数字签名
*
* @param data 参与签名的明文字符串
* @param key RSA公钥字符串
* @param sign RSA签名得到的经过Base64编码的字符串
* @return true--验签通过,false--验签未通过
*/
public static boolean buildRSAverifyByPublicKey(String data, String key, String sign) throws Exception {
try {
// 通过X509编码的Key指令获得公钥对象
X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(Base64.decodeBase64(key));
KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM_RSA, new BouncyCastleProvider());
PublicKey publicKey = keyFactory.generatePublic(x509KeySpec);
// verify
Signature signature = Signature.getInstance(ALGORITHM_RSA_SIGN);
signature.initVerify(publicKey);
signature.update(data.getBytes(CHARSET));
return signature.verify(Base64.decodeBase64(sign));
} catch (Exception e) {
throw new Exception("验签字符串[" + data + "]时遇到异常", e);
}
}
public static void main(String[] args) throws Exception{
String publicKey="MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsrhK2FJnlE8JPtHy79mJL1YCY\n" +
"IWbR6SW5wLLwZV4U2sMrl/1nb1UVAvPVCftYacnz7RU3XdPyVdWer21xunf32e06\n" +
"fLrvt//VTLW9Sou7JlX4AL1m2cPZk0COswZWKTSgiF9MOI9Xg3dGpOo4TIjoCthr\n" +
"6qKsRcVhipwNvaRq3QIDAQAB";
String privateKey="MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAKyuErYUmeUTwk+0\n" +
"fLv2YkvVgJghZtHpJbnAsvBlXhTawyuX/WdvVRUC89UJ+1hpyfPtFTdd0/JV1Z6v\n" +
"bXG6d/fZ7Tp8uu+3/9VMtb1Ki7smVfgAvWbZw9mTQI6zBlYpNKCIX0w4j1eDd0ak\n" +
"Q0QVALIoLgpJvJ8uBCT6ctmhLhsMNCVJXx1z2mJrGuuKbbiEWh1HOmFiailTXT5L\n" +
"6jhMiOgK2GvqoqxFxWGKnA29pGrdAgMBAAECgYEAgwaSrBZ1r5yOlGwfOYB6lZAr\n" +
"TREuJXx0qsU+os5vVQeccRhDShj9YMOwnBG+Xp5KT2qLSG9phrzyGONjW19TYMO6\n" +
"0rVYwVL6yoMsk7D9TwECQQDcu34klYjlNsyNGAqsLhpp3/phRRt0TjgZhFjFECJ8\n" +
"7WEVFz5y7oIPKmmJadNmck/cFEC3CVoJn3EHgq7b3/IbAkEAyEUduLTFKaGgAfTN\n" +
"PRP5FNWTQvKubAKtVL6u1XHVoDTkPm2uQJf9H1VRTPEUfmStzxPJGa0jOYhMxlt6\n" +
"E24mZwJAU8RXl7yj6hDEydrQ2gzY+0sDsvxN8fJpOc3O/mIkJHLVf/KFQYqgEu9O\n" +
"g9aEYoGJKwUIli3XXIWEmIwQneK79wJABa/YwTb45k69oXCXJ2Xay9movdzwUQbe\n" +
"byqfAlaiL1NxK8inixQFzw74KQwrfc9UFC5GpqEBABA7xeIxHD4jfwJAH7FcOx0U\n" +
"EnUdgqIt7XpeMk2+mTJm2P981dpwpYIXoXyd3Nq+cRs7FpEmQWyYy/x81eaywR5Y\n" +
"XXylgsjRFHR2pg==";
String tt = buildRSAEncryptByPrivateKey("大数据生产部",privateKey);
System.out.println(buildRSADecryptByPublicKey(tt,publicKey));
}
}
来源：oschina
链接：https://my.oschina.net/u/2328736/blog/3062499