美文网首页加密和解密
RSA加密

RSA加密

作者: Andy_Livings | 来源:发表于2020-05-08 18:33 被阅读0次

在iOS中使用RSA加密解密，需要用到.der和.p12后缀格式的文件，其中.der格式的文件存放的是公钥（Public key）用于加密，.p12格式的文件存放的是私钥（Private key）用于解密。

对于比较敏感的数据，如用户信息（登陆、注册等），客户端发送使用RSA加密，服务器返回使用DES(AES)加密，使用RSA进行数字签名，可以起到防篡改的作用；客户端之所以使用RSA加密，是因为RSA解密需要知道服务器私钥，而服务器私钥一般盗取难度较大

RSA使用公钥加密、私钥解密

一、使用openssl生成所需秘钥文件

生成环境是在mac系统下，使用openssl进行生成，首先打开终端，按下面这些步骤依次来做：

1. 生成模长为1024bit的私钥文件private_key.pem
openssl genrsa -out private_key.pem 1024
2. 生成证书请求文件rsaCertReq.csr
openssl req -new -key private_key.pem -out rsaCerReq.csr

注意：这一步会提示输入国家、省份、mail等信息，可以根据实际情况填写。


8ACEDC24-6E96-47A0-9FE9-63E2923BC8CD.png
3. 生成证书rsaCert.crt，并设置有效时间为1年
openssl x509 -req -days 3650 -in rsaCerReq.csr -signkey private_key.pem -out rsaCert.crt
4. 生成供iOS使用的公钥文件public_key.der
openssl x509 -outform der -in rsaCert.crt -out public_key.der
5. 生成供iOS使用的私钥文件private_key.p12
openssl pkcs12 -export -out private_key.p12 -inkey private_key.pem -in rsaCert.crt

注意：这一步会提示给私钥文件设置密码，直接输入想要设置密码即可，然后敲回车，然后再验证刚才设置的密码，再次输入密码，然后敲回车，完毕！

在解密时，private_key.p12文件需要和这里设置的密码配合使用，因此需要牢记此密码。

6. 生成供Java使用的公钥rsa_public_key.pem
openssl rsa -in private_key.pem -out rsa_public_key.pem -pubout
7. 生成供Java使用的私钥pkcs8_private_key.pem
openssl pkcs8 -topk8 -in private_key.pem -out pkcs8_private_key.pem -nocrypt

全部执行成功后，会生成如下文件，其中public_key.der和private_key.p12就是iOS需要用到的文件，如下图：


QQ20200508-104455.png

二、将文件导入工程使用

1、新建工程, 并导入Security.framework框架, 如下图:
QQ20200508-105106.png
2、导入秘钥文件

导入.der和.p12格式的秘钥文件, 如下图:


QQ20200508-105611.png
3、新建用于加密、解密的类ASRSAEncryptionManager, 并实现相关方法。
/// 加密方法
/// @param string 需要加密的字符串
/// @param path '.der' 格式的公钥文件路径
+ (NSString*)encryptString:(NSString*)string publicKeyWithContentsOfFile:(NSString*)path;


/// 解密方法
/// @param string 需要解密的字符串
/// @param path '.p12' 格式的私钥文件路径
/// @param password 私钥文件密码
+ (NSString*)decryptString:(NSString*)string privateKeyWithContentsOfFile:(NSString*)path password:(NSString*)password;


/// 加密方法
/// @param string 需要加密的字符串
/// @param pubKey 公钥字符串
+ (NSString*)encryptString:(NSString*)string publicKey:(NSString*)pubKey;


/// 解密方法
/// @param string 需要解密的字符串
/// @param privacy 私钥字符串
+ (NSString*)decryptString:(NSString*)string privateKey:(NSString*)privacy;

#import "ASRSAEncryptionManager.h"
#import <Security/Security.h>

@interface ASRSAEncryptionManager ()

@end

@implementation ASRSAEncryptionManager

static NSString *base64_encode_data(NSData *data) {
    
    data = [data base64EncodedDataWithOptions:0];
    NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    
    return ret;
}

static NSData *base64_decode(NSString *string) {
    
    NSData *data = [[NSData alloc] initWithBase64EncodedString:string options:NSDataBase64DecodingIgnoreUnknownCharacters];
    
    return data;
}

#pragma mark - 使用'.der'公钥文件加密

+ (NSString *)encryptString:(NSString *)string publicKeyWithContentsOfFile:(NSString *)path{
    
    if (!string || !path) return nil;
    
    return [self encryptString:string publicKeyRef:[self getPublicKeyRefWithContentsOfFile:path]];
}

//获取公钥
+ (SecKeyRef)getPublicKeyRefWithContentsOfFile:(NSString *)filePath {
    
    NSData*certData = [NSData dataWithContentsOfFile:filePath];
    
    if(!certData) {
        
        return nil;
    }
    
    SecCertificateRef cert = SecCertificateCreateWithData(NULL, (CFDataRef)certData);
    SecKeyRef key = NULL;
    SecTrustRef trust = NULL;
    SecPolicyRef policy = NULL;
    if(cert != NULL) {
        
        policy = SecPolicyCreateBasicX509();
        if(policy) {
            
            if(SecTrustCreateWithCertificates((CFTypeRef)cert, policy, &trust) == noErr) {
                
                CFErrorRef error;
                if(SecTrustEvaluateWithError(trust, &error) == noErr) {

                    key = SecTrustCopyPublicKey(trust);
                }
            }
        }
    }
    
    if(policy)CFRelease(policy);
    if(trust)CFRelease(trust);
    if(cert)CFRelease(cert);
    
    return key;
}

+ (NSString*)encryptString:(NSString*)string publicKeyRef:(SecKeyRef)publicKeyRef {
    
    if(![string dataUsingEncoding:NSUTF8StringEncoding]) {return nil;}
    if(!publicKeyRef) {return nil;}
    NSData *data = [self encryptData:[string dataUsingEncoding:NSUTF8StringEncoding] withKeyRef:publicKeyRef];
    NSString *ret = base64_encode_data(data);
    
    return ret;
}


#pragma mark - 使用'.12'私钥文件解密//解密

+ (NSString*)decryptString:(NSString*)string privateKeyWithContentsOfFile:(NSString*)path password:(NSString*)password {
    
    if(!string || !path)return nil;
    if(!password) password =@"";
    
    return [self decryptString:string privateKeyRef:[self getPrivateKeyRefWithContentsOfFile:path password:password]];
}

//获取私钥
+ (SecKeyRef)getPrivateKeyRefWithContentsOfFile:(NSString*)filePath password:(NSString*)password {
    
    NSData *p12Data = [NSData dataWithContentsOfFile:filePath];
    if(!p12Data) {
        return nil;
    }
    SecKeyRef privateKeyRef = NULL;
    NSMutableDictionary * options = [[NSMutableDictionary alloc] init];
    [options setObject: password forKey:(__bridge id)kSecImportExportPassphrase];
    CFArrayRef items = CFArrayCreate(NULL,0,0,NULL);
    OSStatus securityError = SecPKCS12Import((__bridge CFDataRef) p12Data, (__bridge CFDictionaryRef)options, &items);
    
    if(securityError == noErr && CFArrayGetCount(items) >0) {
        
        CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items,0);
        SecIdentityRef identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
        securityError = SecIdentityCopyPrivateKey(identityApp, &privateKeyRef);
        
        if(securityError != noErr) {
            privateKeyRef = NULL;
        }
    }
    CFRelease(items);
    return privateKeyRef;
}

+ (NSString*)decryptString:(NSString*)string privateKeyRef:(SecKeyRef)privKeyRef {
    
    NSData *data = [[NSData alloc] initWithBase64EncodedString:string options:NSDataBase64DecodingIgnoreUnknownCharacters];
    
    if(!privKeyRef) {
        return nil;
    }
    
    data = [self decryptData:data withKeyRef:privKeyRef];
    NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    
    return ret;
}


#pragma mark - 使用公钥字符串加密

/* START: Encryption with RSA public key *///使用公钥字符串加密

+ (NSString *)encryptString:(NSString *)string publicKey:(NSString *)pubKey {
    
    NSData *data = [self encryptData:[string dataUsingEncoding:NSUTF8StringEncoding] publicKey:pubKey];
    NSString *ret = base64_encode_data(data);
    
    return ret;
}

+ (NSData *)encryptData:(NSData *)data publicKey:(NSString *)pubKey {
    
    if(!data || !pubKey) {
        return nil;
    }
    
    SecKeyRef keyRef = [self addPublicKey:pubKey];
    if(!keyRef) {
        
        return nil;
    }
    return [self encryptData:data withKeyRef:keyRef];
}

+ (SecKeyRef)addPublicKey:(NSString*)key {
    
    NSRange spos = [key rangeOfString:@"-----BEGIN PUBLIC KEY-----"];
    NSRange epos = [key rangeOfString:@"-----END PUBLIC KEY-----"];
    
    if(spos.location != NSNotFound && epos.location != NSNotFound) {
        
        NSUInteger s = spos.location + spos.length;
        NSUInteger e = epos.location;
        NSRange range = NSMakeRange(s, e-s);
        
        key = [key substringWithRange:range];
    }
    
    key = [key stringByReplacingOccurrencesOfString:@"\r"withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\n"withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\t"withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@" "withString:@""];// This will be base64 encoded, decode it.
    
    NSData *data = base64_decode(key);
    data = [self stripPublicKeyHeader:data];
    if(!data) {
        return nil;
        }
    
    //a tag to read/write keychain storage
    NSString *tag = @"RSAUtil_PubKey";
    NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];
    
    // Delete any old lingering key with the same tag
    NSMutableDictionary *publicKey = [[NSMutableDictionary alloc] init];
    [publicKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
    [publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    [publicKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
    SecItemDelete((__bridge CFDictionaryRef)publicKey);
    
    // Add persistent version of the key to system keychain
    [publicKey setObject:data forKey:(__bridge id)kSecValueData];
    [publicKey setObject:(__bridge id) kSecAttrKeyClassPublic forKey:(__bridge id) kSecAttrKeyClass];
    [publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnPersistentRef];
    CFTypeRef persistKey = nil;
    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)publicKey, &persistKey);
    if(persistKey != nil) {
        CFRelease(persistKey);
    }
    
    if((status != noErr) && (status != errSecDuplicateItem)) {
        return nil;
    }
    
    [publicKey removeObjectForKey:(__bridge id)kSecValueData];
    [publicKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
    [publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
    [publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    
    // Now fetch the SecKeyRef version of the keySecKeyRef
    SecKeyRef keyRef = nil;
    status = SecItemCopyMatching((__bridge CFDictionaryRef)publicKey, (CFTypeRef *) & keyRef);if(status != noErr) {
        return nil;
    }
    
    return keyRef;
}

+ (NSData*)stripPublicKeyHeader:(NSData *)d_key {
    
    // Skip ASN.1 public key header
    if (d_key == nil) return(nil);

    unsigned long len = [d_key length];
    if (!len) return(nil);

    unsigned char *c_key = (unsigned char *)[d_key bytes];
    unsigned int  idx     = 0;

    if (c_key[idx++] != 0x30) return(nil);

    if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
    else idx++;

    // PKCS #1 rsaEncryption szOID_RSA_RSA
    static unsigned char seqiod[] =
    { 0x30,   0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
        0x01, 0x05, 0x00 };
    if (memcmp(&c_key[idx], seqiod, 15)) return(nil);

    idx += 15;

    if (c_key[idx++] != 0x03) return(nil);

    if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
    else idx++;

    if (c_key[idx++] != '\0') return(nil);

    // Now make a new NSData from this buffer
    return ([NSData dataWithBytes:&c_key[idx] length:len - idx]);
}

+ (NSData *)encryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef {
    
    const uint8_t *srcbuf = (const uint8_t *)[data bytes];
    size_t srclen = (size_t)data.length;

    size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
    void *outbuf = malloc(block_size);
    size_t src_block_size = block_size - 11;

    NSMutableData *ret = [[NSMutableData alloc] init];
    for(int idx=0; idx<srclen; idx+=src_block_size){
        //NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
        size_t data_len = srclen - idx;
        if(data_len > src_block_size){
            data_len = src_block_size;
        }

        size_t outlen = block_size;
        OSStatus status = noErr;
        status = SecKeyEncrypt(keyRef,
                               kSecPaddingPKCS1,
                               srcbuf + idx,
                               data_len,
                               outbuf,
                               &outlen
                               );
        if (status != 0) {
            NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
            ret = nil;
            break;
        }else{
            [ret appendBytes:outbuf length:outlen];
        }
    }

    free(outbuf);
    CFRelease(keyRef);
    return ret;
}



/* END: Encryption with RSA public key */

#pragma mark - 使用私钥字符串解密

/* START: Decryption with RSA private key *///使用私钥字符串解密

+ (NSString *)decryptString:(NSString *)string privateKey:(NSString*)privacy {
    
    if(!string) return nil;
    NSData *data = [[NSData alloc] initWithBase64EncodedString:string options:NSDataBase64DecodingIgnoreUnknownCharacters];
    data = [self decryptData:data privateKey:privacy];
    NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    
    return ret;
}

+ (NSData *)decryptData:(NSData *)data privateKey:(NSString *)privacy {
    
    if(!data || !privacy) { return nil;}
    SecKeyRef keyRef = [self addPrivateKey:privacy];
    if(!keyRef) { return nil;}
    
    return [self decryptData:data withKeyRef:keyRef];
}

+ (SecKeyRef)addPrivateKey:(NSString *)key {
    
    NSRange spos = [key rangeOfString:@"-----BEGIN RSA PRIVATE KEY-----"];
    NSRange epos = [key rangeOfString:@"-----END RSA PRIVATE KEY-----"];
    if(spos.location != NSNotFound && epos.location != NSNotFound) { NSUInteger s = spos.location + spos.length;
        NSUInteger e = epos.location;
        NSRange range = NSMakeRange(s, e-s);
        key = [key substringWithRange:range];
    }
    
    key = [key stringByReplacingOccurrencesOfString:@"\r"withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\n"withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\t"withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@" "withString:@""];
    
    // This will be base64 encoded, decode it.
    NSData *data = base64_decode(key);
    data = [self stripPrivateKeyHeader:data];
    if(!data) {
        return nil;
    }
    
    //a tag to read/write keychain storage
    NSString *tag = @"RSAUtil_PrivKey";
    NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];
    
    // Delete any old lingering key with the same tag
    NSMutableDictionary *privateKey = [[NSMutableDictionary alloc] init];
    [privateKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
    [privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    [privateKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
    SecItemDelete((__bridge CFDictionaryRef)privateKey);
    
    // Add persistent version of the key to system keychain
    [privateKey setObject:data forKey:(__bridge id)kSecValueData];
    [privateKey setObject:(__bridge id) kSecAttrKeyClassPrivate forKey:(__bridge id)  kSecAttrKeyClass];
    [privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id) kSecReturnPersistentRef];
    CFTypeRef persistKey = nil;
    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)privateKey, &persistKey);
    if(persistKey != nil) { CFRelease(persistKey); }
    if((status != noErr) && (status != errSecDuplicateItem)) {return nil;}
    [privateKey removeObjectForKey:(__bridge id)kSecValueData];
    [privateKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
    [privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
    [privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    
    // Now fetch the SecKeyRef version of the keySecKeyRef
    SecKeyRef keyRef = nil;
    status = SecItemCopyMatching((__bridge CFDictionaryRef)privateKey, (CFTypeRef*)&keyRef);
    if(status != noErr) {return nil;}
    
    return keyRef;
}

+ (NSData *)stripPrivateKeyHeader:(NSData *)d_key {
    
    // Skip ASN.1 private key header
    if (d_key == nil) return(nil);

    unsigned long len = [d_key length];
    if (!len) return(nil);

    unsigned char *c_key = (unsigned char *)[d_key bytes];
    unsigned int  idx = 22; //magic byte at offset 22

    if (0x04 != c_key[idx++]) return nil;

    //calculate length of the key
    unsigned int c_len = c_key[idx++];
    int det = c_len & 0x80;
    if (!det) {
        c_len = c_len & 0x7f;
    } else {
        int byteCount = c_len & 0x7f;
        if (byteCount + idx > len) {
            //rsa length field longer than buffer
            return nil;
        }
        unsigned int accum = 0;
        unsigned char *ptr = &c_key[idx];
        idx += byteCount;
        while (byteCount) {
            accum = (accum << 8) + *ptr;
            ptr++;
            byteCount--;
        }
        c_len = accum;
    }

    // Now make a new NSData from this buffer
    return [d_key subdataWithRange:NSMakeRange(idx, c_len)];
}

+ (NSData *)decryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef {
    
    const uint8_t *srcbuf = (const uint8_t *)[data bytes];
    size_t srclen = (size_t)data.length;

    size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
    UInt8 *outbuf = malloc(block_size);
    size_t src_block_size = block_size;

    NSMutableData *ret = [[NSMutableData alloc] init];
    for(int idx=0; idx<srclen; idx+=src_block_size){
        //NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
        size_t data_len = srclen - idx;
        if(data_len > src_block_size){
            data_len = src_block_size;
        }

        size_t outlen = block_size;
        OSStatus status = noErr;
        status = SecKeyDecrypt(keyRef,
                               kSecPaddingNone,
                               srcbuf + idx,
                               data_len,
                               outbuf,
                               &outlen
                               );
        if (status != 0) {
            NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
            ret = nil;
            break;
        }else{
            //the actual decrypted data is in the middle, locate it!
            int idxFirstZero = -1;
            int idxNextZero = (int)outlen;
            for ( int i = 0; i < outlen; i++ ) {
                if ( outbuf[i] == 0 ) {
                    if ( idxFirstZero < 0 ) {
                        idxFirstZero = i;
                    } else {
                        idxNextZero = i;
                        break;
                    }
                }
            }

            [ret appendBytes:&outbuf[idxFirstZero+1] length:idxNextZero-idxFirstZero-1];
        }
    }

    free(outbuf);
    CFRelease(keyRef);
    return ret;
}
4、测试加密是否成功
- (void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event {
    
    // 原始数据

    NSString *originalString = @"这是一段将要使用'.der'文件加密的字符串!";

    // 使用.der和.p12中的公钥私钥加密解密

    NSString *public_key_path = [[NSBundle mainBundle] pathForResource:@"public_key.der"ofType:nil];

    NSString *private_key_path = [[NSBundle mainBundle] pathForResource:@"private_key.p12"ofType:nil];

    NSString *encryptStr = [ASRSAEncryptionManager encryptString:originalString publicKeyWithContentsOfFile:public_key_path];
    NSLog(@"加密前:%@", originalString);

    NSLog(@"加密后:%@", encryptStr);

    NSLog(@"解密后:%@", [ASRSAEncryptionManager decryptString:encryptStr privateKeyWithContentsOfFile:private_key_path password:@"acad123"]);

}

demo下载地址

相关文章

  • RSA加密方式

    RSA加密方式 获取RSA密钥 加密 解密 js库

  • C# RSA加解密和MD5加密

    1.RSA加密 2.RSA解密 3.RSA签名 RSA签名验签 4.MD5加密

  • RSA签名认证

    RSA可汗学院第一章 RSA加密 RSA加密原理第一章 RSA加密原理第二章 如何生成RSA公钥私钥 生成类似支付...

  • kotlin版本RSA非对称加密解密与分段加密解密

    基于kotlin语言的RSA非对称加密解密与分段加密解密 RSA非对称加密 RSA非对称加密的具体算法与来源我就不...

  • # RSA 公钥加密算法

    # RSA 公钥加密算法 # RSA 公钥加密算法

  • 命令

    文件编译 加密解密 1. 对称加密 DES AES Base64 2. 非对称加密 RSA RSA加密：公钥加密，...

  • Java加密

    MD5加密： RSA加密： CBC加密：

  • RSA加密算法详解

    什么是RSA算法？ RSA加密算法是一种非对称加密算法。在公开密钥加密和电子商业中RSA被广泛使用。RSA是197...

  • 项目加密 RSA+DES3加密方式

    rsa加密参考网址 rsa加密参考网址 des3加密支持中文加密 des加密参考网址 加密的方式为 先将数据进行D...

  • 常用的加密

    加密 RSA MD5 SHA-1 DES 3DES RSA RSA是一种非对称加密算法（公钥加密，私钥解密）。对极...

网友评论

    本文标题：RSA加密

    本文链接：https://www.haomeiwen.com/subject/rdmxnhtx.html

    延伸阅读

    深度阅读

    • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

    栏目导航

    热点阅读

    加密和解密

    关于我们|服务条款|联系我们|RSA加密|投稿指南|网站地图|RSS订阅|排版工具|手机版

    提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

    Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

    备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

    本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

    所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！