今天阅读了一篇新文章 [iOS App 签名的原理 « bang’s blog]（http://blog.cnbang.net/tech/3386/) 文章详细的描述了 对于iOS 开发者来说十分重要的 APP 签名的相关流程以及原因。当然，这篇文章直接导致了已经写了一半的的文章流产了。
为了不浪费自己最近的学习成果（实际上，只是为了做个笔记），特地把这篇文章没有提及的地方记下来。
公钥中 e 的取值尽可能小
公钥 (n,e) 中的 e，一般情况下会比较小，比如 3 或者 65537(=2^16+1) 。
先拿淘宝验证一下这个结论。
在终端输入以下命令，
echo -n | openssl s_client -connect www.taobao.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
结果如下所示：
-----BEGIN CERTIFICATE-----
MIIIwjCCB6qgAwIBAgIMRUsPhLMOq0wb94GfMA0GCSqGSIb3DQEBCwUAMGYxCzAJ
BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTwwOgYDVQQDEzNH
bG9iYWxTaWduIE9yZ2FuaXphdGlvbiBWYWxpZGF0aW9uIENBIC0gU0hBMjU2IC0g
RzIwHhcNMTYxMjA2MDYxNzAyWhcNMTcxMjAzMDE1NjAyWjB4MQswCQYDVQQGEwJD
TjERMA8GA1UECBMIWmhlSmlhbmcxETAPBgNVBAcTCEhhbmdaaG91MS0wKwYDVQQK
EyRBbGliYWJhIChDaGluYSkgVGVjaG5vbG9neSBDby4sIEx0ZC4xFDASBgNVBAMM
CyoudG1hbGwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA206O
cPEMZ2ytiwxoKQhXRAq2sB3q6q7cjP+FsZb7neL/aNWZkUdR2AlImAqLb/yJB7C8
RNFN1fhxcyxRJ82i6M3xwqXkYXMiai0lyX2Ta721WMSEinq+ih8sGhlv1Focf+kD
+VerQTopMwVGU2j9S3R2kLUTfkja8JoYOEdeivScZmxJt2sMsaDMMTSKFydYCX0T
9UXh7BxCbUrncwczOawxT1BHZylw82nLsYMOBnmxKmxyrUU3/8xfcsfDOk9/JUhh
Wl4ONgzqj+l2LuNTrcEsvx9lyy0c/qUZgTaFT/D8xpgKWyCBG0lmvkzTS3vCIc8T
dKRAJjI44lMln9MBKwIDAQABo4IFXDCCBVgwDgYDVR0PAQH/BAQDAgWgMIGgBggr
BgEFBQcBAQSBkzCBkDBNBggrBgEFBQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxz
aWduLmNvbS9jYWNlcnQvZ3Nvcmdhbml6YXRpb252YWxzaGEyZzJyMS5jcnQwPwYI
KwYBBQUHMAGGM2h0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc29yZ2FuaXph
dGlvbnZhbHNoYTJnMjBWBgNVHSAETzBNMEEGCSsGAQQBoDIBFDA0MDIGCCsGAQUF
BwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAIBgZn
gQwBAgIwCQYDVR0TBAIwADBJBgNVHR8EQjBAMD6gPKA6hjhodHRwOi8vY3JsLmds
b2JhbHNpZ24uY29tL2dzL2dzb3JnYW5pemF0aW9udmFsc2hhMmcyLmNybDCCA5QG
A1UdEQSCA4swggOHggsqLnRtYWxsLmNvbYIKKi4xNjg4LmNvbYIOKi4zYy50bWFs
bC5jb22CDSouYWxpYmFiYS5jb22CEiouYWxpcWluLnRtYWxsLmNvbYINKi5hbGl0
cmlwLmNvbYIMKi5hbGl5dW4uY29tgg0qLmNhaW5pYW8uY29tghAqLmNhaW5pYW8u
Y29tLmNughAqLmNoaS50YW9iYW8uY29tgg8qLmNoaS50bWFsbC5jb22CEiouY2hp
bmEudGFvYmFvLmNvbYIOKi5kaW5ndGFsay5jb22CDiouZG9uZ3RpbmcuY29tggoq
LmV0YW8uY29tggsqLmZlaXpodS5jboIMKi5mZWl6aHUuY29tggwqLmZsaWdneS5j
b22CCyouZmxpZ2d5LmhrghAqLmZvb2QudG1hbGwuY29tghAqLmppYS50YW9iYW8u
Y29tgg8qLmppYS50bWFsbC5jb22CDyouanUudGFvYmFvLmNvbYIPKi5qdWh1YXN1
YW4uY29tgg8qLmx3LmFsaWltZy5jb22CDCoubS4xNjg4LmNvbYIPKi5tLmFsaWJh
YmEuY29tgg8qLm0uYWxpdHJpcC5jb22CDyoubS5jYWluaWFvLmNvbYIMKi5tLmV0
YW8uY29tgg4qLm0udGFvYmFvLmNvbYITKi5tLnRhb3BpYW9waWFvLmNvbYINKi5t
LnRtYWxsLmNvbYIMKi5tLnRtYWxsLmhrghEqLm0ueWFvLjk1MDk1LmNvbYIMKi50
YW9iYW8uY29tghEqLnRhb3BpYW9waWFvLmNvbYIKKi50bWFsbC5oa4IRKi50cmlw
LnRhb2Jhby5jb22CCyoudHRwb2QuY29tggsqLnhpYW1pLmNvbYIPKi55YW8uOTUw
OTUuY29tgggxNjg4LmNvbYILYWxpYmFiYS5jb22CC2FsaXRyaXAuY29tggphbGl5
dW4uY29tggtjYWluaWFvLmNvbYIOY2Fpbmlhby5jb20uY26CDGRpbmd0YWxrLmNv
bYIMZG9uZ3RpbmcuY29tgghldGFvLmNvbYIJZmVpemh1LmNuggpmZWl6aHUuY29t
ggpmbGlnZ3kuY29tgg1qdWh1YXN1YW4uY29tggp0YW9iYW8uY29tgg90YW9waWFv
cGlhby5jb22CCHRtYWxsLmhrggl0dHBvZC5jb22CCXhpYW1pLmNvbYIJdG1hbGwu
Y29tMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUwxE1
f+vqBciaAxwMpmT9Yy5C0WMwHwYDVR0jBBgwFoAUlt5h8b0cFilTHMDMfTuDAEDm
GnwwDQYJKoZIhvcNAQELBQADggEBAJxqkSJ99iZfVCg4AQP0yX2CazmFlecgfIMm
+UT8m7XwaSy/RPseYMLcSPN7THsOhf3UE8mfRIIrCuIfyhJ2ILMLHFKsCwGG6EIp
/Sz/Ixhrm75UQj+On6IFTbo1CSjF9uYBngkTegIru53cZv6AbLz8AW2RJ4uo8hbW
qrCGaAp/grZkGBldsrVkCuKuOY6Qdi/n7UsWuw/0KXFJ/TAYPMkgpdYfGsUeBDnU
j1E4rmbkf/p1+myt862eVNCOReM9NpORls8Kx++kW69Qpg0604aFanPlyV/1S8O5
oEbRjKqyjccunWiGYMucGc7kU9xAYjDRmMbKXowRZmjapxWQYQA=
-----END CERTIFICATE-----
通过 https://certlogik.com/decoder/ 提供的解析工具，我们可以看到解析后的内容
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
45:4b:0f:84:b3:0e:ab:4c:1b:f7:81:9f
Signature Algorithm: sha256WithRSAEncryption
Issuer:
commonName = GlobalSign Organization Validation CA - SHA256 - G2
organizationName = GlobalSign nv-sa
countryName = BE
Validity
Not Before: Dec 6 06:17:02 2016 GMT
Not After : Dec 3 01:56:02 2017 GMT
Subject:
commonName = *.tmall.com
organizationName = Alibaba (China) Technology Co., Ltd.
localityName = HangZhou
stateOrProvinceName = ZheJiang
countryName = CN
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:db:4e:8e:70:f1:0c:67:6c:ad:8b:0c:68:29:08:
57:44:0a:b6:b0:1d:ea:ea:ae:dc:8c:ff:85:b1:96:
fb:9d:e2:ff:68:d5:99:91:47:51:d8:09:48:98:0a:
8b:6f:fc:89:07:b0:bc:44:d1:4d:d5:f8:71:73:2c:
51:27:cd:a2:e8:cd:f1:c2:a5:e4:61:73:22:6a:2d:
25:c9:7d:93:6b:bd:b5:58:c4:84:8a:7a:be:8a:1f:
2c:1a:19:6f:d4:5a:1c:7f:e9:03:f9:57:ab:41:3a:
29:33:05:46:53:68:fd:4b:74:76:90:b5:13:7e:48:
da:f0:9a:18:38:47:5e:8a:f4:9c:66:6c:49:b7:6b:
0c:b1:a0:cc:31:34:8a:17:27:58:09:7d:13:f5:45:
e1:ec:1c:42:6d:4a:e7:73:07:33:39:ac:31:4f:50:
47:67:29:70:f3:69:cb:b1:83:0e:06:79:b1:2a:6c:
72:ad:45:37:ff:cc:5f:72:c7:c3:3a:4f:7f:25:48:
61:5a:5e:0e:36:0c:ea:8f:e9:76:2e:e3:53:ad:c1:
2c:bf:1f:65:cb:2d:1c:fe:a5:19:81:36:85:4f:f0:
fc:c6:98:0a:5b:20:81:1b:49:66:be:4c:d3:4b:7b:
c2:21:cf:13:74:a4:40:26:32:38:e2:53:25:9f:d3:
01:2b
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
Authority Information Access:
CA Issuers - URI:http://secure.globalsign.com/cacert/gsorganizationvalsha2g2r1.crt
OCSP - URI:http://ocsp2.globalsign.com/gsorganizationvalsha2g2
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.4146.1.20
CPS: https://www.globalsign.com/repository/
Policy: 2.23.140.1.2.2
X509v3 Basic Constraints:
CA:FALSE
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.globalsign.com/gs/gsorganizationvalsha2g2.crl
X509v3 Subject Alternative Name:
DNS:*.tmall.com, DNS:*.1688.com, DNS:*.3c.tmall.com, DNS:*.alibaba.com, DNS:*.aliqin.tmall.com, DNS:*.alitrip.com, DNS:*.aliyun.com, DNS:*.cainiao.com, DNS:*.cainiao.com.cn, DNS:*.chi.taobao.com, DNS:*.chi.tmall.com, DNS:*.china.taobao.com, DNS:*.dingtalk.com, DNS:*.dongting.com, DNS:*.etao.com, DNS:*.feizhu.cn, DNS:*.feizhu.com, DNS:*.fliggy.com, DNS:*.fliggy.hk, DNS:*.food.tmall.com, DNS:*.jia.taobao.com, DNS:*.jia.tmall.com, DNS:*.ju.taobao.com, DNS:*.juhuasuan.com, DNS:*.lw.aliimg.com, DNS:*.m.1688.com, DNS:*.m.alibaba.com, DNS:*.m.alitrip.com, DNS:*.m.cainiao.com, DNS:*.m.etao.com, DNS:*.m.taobao.com, DNS:*.m.taopiaopiao.com, DNS:*.m.tmall.com, DNS:*.m.tmall.hk, DNS:*.m.yao.95095.com, DNS:*.taobao.com, DNS:*.taopiaopiao.com, DNS:*.tmall.hk, DNS:*.trip.taobao.com, DNS:*.ttpod.com, DNS:*.xiami.com, DNS:*.yao.95095.com, DNS:1688.com, DNS:alibaba.com, DNS:alitrip.com, DNS:aliyun.com, DNS:cainiao.com, DNS:cainiao.com.cn, DNS:dingtalk.com, DNS:dongting.com, DNS:etao.com, DNS:feizhu.cn, DNS:feizhu.com, DNS:fliggy.com, DNS:juhuasuan.com, DNS:taobao.com, DNS:taopiaopiao.com, DNS:tmall.hk, DNS:ttpod.com, DNS:xiami.com, DNS:tmall.com
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Subject Key Identifier:
C3:11:35:7F:EB:EA:05:C8:9A:03:1C:0C:A6:64:FD:63:2E:42:D1:63
X509v3 Authority Key Identifier:
keyid:96:DE:61:F1:BD:1C:16:29:53:1C:C0:CC:7D:3B:83:00:40:E6:1A:7C
Signature Algorithm: sha256WithRSAEncryption
9c:6a:91:22:7d:f6:26:5f:54:28:38:01:03:f4:c9:7d:82:6b:
39:85:95:e7:20:7c:83:26:f9:44:fc:9b:b5:f0:69:2c:bf:44:
fb:1e:60:c2:dc:48:f3:7b:4c:7b:0e:85:fd:d4:13:c9:9f:44:
82:2b:0a:e2:1f:ca:12:76:20:b3:0b:1c:52:ac:0b:01:86:e8:
42:29:fd:2c:ff:23:18:6b:9b:be:54:42:3f:8e:9f:a2:05:4d:
ba:35:09:28:c5:f6:e6:01:9e:09:13:7a:02:2b:bb:9d:dc:66:
fe:80:6c:bc:fc:01:6d:91:27:8b:a8:f2:16:d6:aa:b0:86:68:
0a:7f:82:b6:64:18:19:5d:b2:b5:64:0a:e2:ae:39:8e:90:76:
2f:e7:ed:4b:16:bb:0f:f4:29:71:49:fd:30:18:3c:c9:20:a5:
d6:1f:1a:c5:1e:04:39:d4:8f:51:38:ae:66:e4:7f:fa:75:fa:
6c:ad:f3:ad:9e:54:d0:8e:45:e3:3d:36:93:91:96:cf:0a:c7:
ef:a4:5b:af:50:a6:0d:3a:d3:86:85:6a:73:e5:c9:5f:f5:4b:
c3:b9:a0:46:d1:8c:aa:b2:8d:c7:2e:9d:68:86:60:cb:9c:19:
ce:e4:53:dc:40:62:30:d1:98:c6:ca:5e:8c:11:66:68:da:a7:
15:90:61:00
我们可以注意到Exponent 字段的值为 65537 (0x10001)
对摘要做签名而不是全部内容
文中虽然提到了这一点，但是，这样设计的出发点还有一个原因就是为了降低客户端的计算量。
RSA算法原理（二） 的 八、加密和解密 提到了如下的计算公式，
m^e ≡ c (mod n)
这个公式涉及到了指数计算，当 e 等于 3 或者 65537 (0x10001)
当 m 和 e 变小时，客户端的计算量也会急剧减少。
与此同时，也可以把更难以猜测的私钥 d 放到服务端进行保存。毕竟，值越大越难以被黑客猜到。
网友评论