签名算法:SHA1withRSA

作者: 许俊贤 | 来源:发表于2018-12-05 22:10 被阅读0次

SHA1withRSA简介

因工作中对接金融机构，对数据的安全性较高故仅作为日志，部分涉及私密的信息就不贴出来。

SHA1withRSA:浅显的理解，用SHA算法进行签名，用RSA算法进行加密。

注：SHA1安全哈希算法（Secure Hash Algorithm）主要适用于数字签名标准（Digital Signature Standard DSS）里面定义的数字签名算法（Digital Signature Algorithm DSA）

附网络上的图示：（图中所示加了一层RSA加密，此次接口不涉及。）

image.png

注：RSA对明文有长度限制，详情移步https://blog.csdn.net/lvxiangan/article/details/45487943 。

生成密钥、公钥证书

** 使用OpenSSL工具,或者直接在unix、Linux系统上执行。**

① openssl genrsa -out rsa_private_key.pem 1024
② pkcs8 -topk8 -inform PEM -in rsa_private_key.pem -outform PEM -nocrypt（java需使用pkcs8 ）
③ openssl rsa -in rsa_private_key.pem -pubout -out rsa_public_key.pem

注：顺序执行，步骤②需注意，转换的pkcs8证书将在控制台输出，注意复制保存下来。（方便测试可以暂时使用网上快速生成的密钥对）

Java代码实现

主要有以下步骤：（前提：已生成一对公钥、私钥。）

所需签名的内容使用私钥进行SHA1WithRSA签名。（SignatureUtil.sign方法）
获取报文，通过签名信息、报文原文及公钥进行验签。（SignatureUtil.virefy方法）
拼装接口信息（json），对PLAIN内所有内容签名，存放于SIGNATURE处。

报文示例：

{
    "IASPDB": {
        "PLAIN": {
            "BODY": {
                "param1": "value1",
                "param2": "value2",
                "param3": "value3"
            },
            "HEAD": {
                "orgId": "1",
                "timeStamp": 1527818279919,
                "subOrgId": "subOrgId",
                "transId": "1",
                "channel": "1",
                "openId": ""
            }
        },
        "SIGNATURE": "Hg6Rc1y4i+2Ms/EWgasRwUW2TNpPZv6KxpeoqoQgSbYyxn0UezhI4CVGCcp4zwhTFV98x7+r0h8kfuPALloYFK1vn1EOGHxRUgvX1xt40jTRXEtZXrX5J0ii0AWihknxdTkQE+Ks/x3QiixnsKieLb0BnqInPbt4eQuudQo2YsE="
    }
}

package com.test.sample;

import java.io.ByteArrayInputStream;
import java.io.InputStreamReader;
import java.io.StringWriter;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Signature;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Map;
import java.util.TreeMap;

import org.apache.commons.codec.binary.Base64;
import org.junit.Test;

import com.test.sample.util.StreamUtil;

public class SignatureUtil {
    private final static String SIGN_TYPE_RSA = "RSA";
    private final static String SIGN_ALGORITHMS = "SHA1WithRSA";
    private final static String CHARSETTING = "UTF-8";

    /**
     * 获取私钥PKCS8格式（需base64）
     * @param algorithm
     * @param priKey
     * @return PrivateKey
     * @throws Exception
     */
    public static PrivateKey getPrivateKeyFromPKCS8(String algorithm, String priKey) throws Exception {
        if (algorithm == null || "".equals(algorithm) || priKey == null || "".equals(priKey))
            return null;

        KeyFactory keyFactory = KeyFactory.getInstance(algorithm);

        byte[] encodedKey = StreamUtil.readText(new ByteArrayInputStream(priKey.getBytes())).getBytes();
        encodedKey = Base64.decodeBase64(priKey.getBytes());

        return keyFactory.generatePrivate(new PKCS8EncodedKeySpec(encodedKey));
    }

    /**
     * 通过证书获取公钥（需BASE64，X509为通用证书标准）
     * @param algorithm
     * @param pubKey
     * @return PublicKey
     * @throws Exception
     */
    public static PublicKey getPublicKeyFromX509(String algorithm, String pubKey) throws Exception {

        if (algorithm == null || "".equals(algorithm) || pubKey == null || "".equals(pubKey))
            return null;

        KeyFactory keyFactory = KeyFactory.getInstance(algorithm);
        StringWriter writer = new StringWriter();
        StreamUtil.io(new InputStreamReader(new ByteArrayInputStream(pubKey.getBytes())), writer);

        byte[] encodeByte = writer.toString().getBytes();
        encodeByte = Base64.decodeBase64(pubKey.getBytes());

        return keyFactory.generatePublic(new X509EncodedKeySpec(encodeByte));
    }

    /**
     * 使用私钥对字符进行签名
     * @param plain  内容体
     * @param prikey  私钥
     * @return String
     * @throws Exception
     */
    public static String sign(String plain, String prikey) throws Exception {
        if (plain == null || "".equals(plain) || prikey == null || "".equals(prikey))
            return null;

        PrivateKey privatekey = getPrivateKeyFromPKCS8(SIGN_TYPE_RSA, prikey);
        Signature signature = Signature.getInstance(SIGN_ALGORITHMS);
        signature.initSign(privatekey);
        signature.update(plain.getBytes(CHARSETTING));
        byte[] signed = signature.sign();

        return new String(Base64.encodeBase64(signed));
    }

    /**
     * 将内容体、签名信息、及对方公钥进行验签
     * @param plain  内容体
     * @param sign   签名信息
     * @param pubkey  对方公钥
     * @return boolean
     * @throws Exception
     */
    public static boolean virefy(String plain, String sign, String pubkey) throws Exception {
        if (plain == null || "".equals(plain) || sign == null || "".equals(sign) || pubkey == null || "".equals(pubkey))
            return false;

        PublicKey publicKey = getPublicKeyFromX509(SIGN_TYPE_RSA, pubkey);
        Signature signature = Signature.getInstance(SIGN_ALGORITHMS);
        signature.initVerify(publicKey);
        signature.update(plain.getBytes(CHARSETTING));

        return signature.verify(Base64.decodeBase64(sign.getBytes()));
    }

    /**
     * 测试
     * @param args
     * @throws Exception
     */
    @Test
    public static void main(String[] args) throws Exception {
        //**  私钥密钥此处简单演示，应做成可配置    **/
        String privateKey = "MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAMwJf6SDuNirQKl6/pgC3WQDV10mP2Mwwivqzcb0BH4jE8wIeaOGQ5eBw8ncuz1xAFLA6RE0U7I/RxBehIGCKSMYFYfv1Mzd0y3UIXqkJUCyNgrJTu3vlEvydG3PVOeVn0jb6F55TJj1cO/Es14nwVhskjPk/Ft7ftrqoEBmgoidAgMBAAECgYAg1taIb/rsRIPfwz/+z1c6pZ8GCwXgvRRDZUNBZjzi4FprWGHbg9yVIfmVH8WzGeDncM0SS828vpp9c/j3ry9XgRDh70e2LKovEy9rXNenLyNjdQGCaH9WEcNaMrAwW/p2+a1DOZjtRc01yuLW/jNIlI4Sy8LmZ5bRqcp3bcjDsQJBAOgkUqBc+/rFoSxPs9+HoOU0NDpuKAQyUgTJEvlyYpzQ/ZixOy9gOygm0iCAddKgnzJMi4W9o0YlT5o3lX7aKUsCQQDhAbxxHWYv1aM98RJKOMHnvSO6Jvnn2HLdCL8qrMKdGADMexJsrJy9mXCkeYlEFWUQLAtZYQiHvbNL18trroy3AkBZC83SC7jweayYZb5WqRzzrrG2FBkveunxQfwQSWtAQf50+s78Hkqy3SlPJFeNwuUuEySV2aduudMuEdI7hY2/AkArE80DDvDYaZtWKYgp45HkDwb/BaVEqODcxmbrAaZEsyq7+zf8zFM5zV2Ob6JDAaGWpggKNZSPgFcKRycv13wjAkEAxO1AqU/hwfyZ8hSaROhqtnRrM05zQpDSPhSvHB1nv+qMw5pvJEK/YGDxm3zeEzef/vQhti8IFSo86cF9WMxWxw==";
        String publicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMCX+kg7jYq0Cpev6YAt1kA1ddJj9jMMIr6s3G9AR+IxPMCHmjhkOXgcPJ3Ls9cQBSwOkRNFOyP0cQXoSBgikjGBWH79TM3dMt1CF6pCVAsjYKyU7t75RL8nRtz1TnlZ9I2+heeUyY9XDvxLNeJ8FYbJIz5Pxbe37a6qBAZoKInQIDAQAB";
        String plain = "plain：\"PLAIN\":{\"BODY\":{\"returnCode\":\"AAAAAAA\",\"status\":\"00\",\"returnMsg\":\"交易成功\",\"mobileNo\":\"15555524587\"},\"HEAD\":{\"spdbJnlNo\":\"997907074816\",\"timeStamp\":\"1435152316796\",\"transId\":\"MiguRepay\",\"jnlNo\":\"Y000Y021120140605\",\"version\":\"1.0\"}}";
        System.out.println(plain);
        String sign = sign(plain, privateKey);
        //签名信息
        System.out.println(sign);

        //签名信息
        //String sign = "BYyaHBgXhAZcjW0VUW1Cx7IpACMCkdmLkF5WkkgVEJboNtDzbQ0hRJ6v6xYDCrHKwTTigq9VpVKnyWAdvYkXlQyTs5vK0wx9aPlLaPFj6e8PZfd3+GM+Azwt15vgoaLs6GxcAZJ7FQMVkRqZWRv1MNorMh0rPLNwbdZgVF3m1+g=";

        //验签结果（接收方使用对方公钥验签）
        System.out.println(virefy(plain, sign, publicKey));

        //组装报文BODY内的内容
        Map<String, String> dataMap = new TreeMap();
        dataMap.put("param1", "value1");
        dataMap.put("param2", "value2");
        dataMap.put("param3", "value3");
        //生成最终报文（Json）
        String body = JsonHelper.preparePostData("1", "1", "subOrgId", dataMap);
        System.out.println(body);
    }

}

备注：有人需要故补充 StreamUtil类

package com.test.sample.util;

import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.io.Reader;
import java.io.StringWriter;
import java.io.Writer;

public class StreamUtil {
    private static final int DEFAULT_BUFFER_SIZE = 8192;

    public static void io(InputStream in, OutputStream out) throws IOException {
        io(in, out, -1);
    }

    public static void io(InputStream in, OutputStream out, int bufferSize) throws IOException {
        if (bufferSize == -1) {
            bufferSize = DEFAULT_BUFFER_SIZE;
        }

        byte[] buffer = new byte[bufferSize];
        int amount;

        while ((amount = in.read(buffer)) >= 0) {
            out.write(buffer, 0, amount);
        }
    }

    public static void io(Reader in, Writer out) throws IOException {
        io(in, out, -1);
    }

    public static void io(Reader in, Writer out, int bufferSize) throws IOException {
        if (bufferSize == -1) {
            bufferSize = DEFAULT_BUFFER_SIZE >> 1;
        }

        char[] buffer = new char[bufferSize];
        int amount;

        while ((amount = in.read(buffer)) >= 0) {
            out.write(buffer, 0, amount);
        }
    }

    public static String readText(InputStream in) throws IOException {
        return readText(in, null, -1);
    }

    public static String readText(InputStream in, String encoding) throws IOException {
        return readText(in, encoding, -1);
    }

    public static String readText(InputStream in, String encoding, int bufferSize)
                                                                                  throws IOException {
        Reader reader = (encoding == null) ? new InputStreamReader(in) : new InputStreamReader(in,
            encoding);

        return readText(reader, bufferSize);
    }

    public static String readText(Reader reader) throws IOException {
        return readText(reader, -1);
    }

    public static String readText(Reader reader, int bufferSize) throws IOException {
        StringWriter writer = new StringWriter();

        io(reader, writer, bufferSize);
        return writer.toString();
    }
}

部分代码就不全贴上来啦！！

签名算法:SHA1withRSA

SHA1withRSA简介

相关文章

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读