java - 尝试使用 Java 使用 KeyChainStore 签署数据

Question

我实际上正在开发一个允许用户使用智能卡进行签名的应用程序。在 Windows 操作系统上，我有这个:

ArrayList<String> lstErrors = new ArrayList<String>();
String AliasToUse = "test";
String strToSign = "My Clean String";

String strSigned = AccessController.doPrivileged(new PrivilegedAction<String>()
        {
            public String run()
            {
                KeyStore ks = null;
                ks = KeyStore.getInstance("Windows-MY");
                ks.load(null, null);

                try
                {
                    Enumeration<String> en = ks.aliases();

                    if (en.hasMoreElements() == false)
                    {
                        lstErrors.add("No Certificate found");
                        return null;
                    }

                    ArrayList<String> lstAlias = Collections.list(en);

                    lstErrors.add(lstAlias.size() + " elements found");

                    for (String aliasKey : lstAlias)
                    {

                        if(!aliasKey.equalsIgnoreCase(AliasToUse))
                        {
                            continue;
                        }

                        Provider p = ks.getProvider();

                        Signature sig = Signature.getInstance("SHA256withRSA", p);

                        PrivateKey key = (PrivateKey) ks.getKey(aliasKey, "1234".toCharArray());

                        if (key == null)
                        {
                            lstErrors.add("The Private Key could not be instanciated");
                            continue;
                        } 

                        sig.initSign(key);
                        String strBase64Decoded = Base64Coder.decodeString(strToSign);
                        byte[] btToSign = strBase64Decoded.getBytes(Charset.forName("UTF-8"));
                        sig.update(btToSign);
                        byte[] res = sig.sign();

                        return Base64Coder.encodeBase64String(res);
                    }

                } catch (Exception e)
                {
                    lstErrors.add("Error signing : " + e.getMessage());
                    return null;
                }

                return null;
            }
        }

这段代码工作正常，没有问题。当我尝试对 Apple 做同样的事情时，我正在尝试这样做:

ks = KeyStore.getInstance("KeyChainStore");

这允许我获得所有证书，但是当我尝试签署我的数据时，我收到以下错误:

no such algorithm: SHA256WithRSA for provider Apple

它发生在以下行:

Signature sig = Signature.getInstance("SHA256withRSA", p);

我尝试了“SHA-256”甚至“SHA-1”，但错误仍然存​​在。

如何使用 KeyChainStore 进行签名，就像在 Windows 证书存储中一样？

提前致谢。

附录

我尝试了另一种方法来收集有关 KeyChainStore 上每个别名的更多信息，并了解该条目是否包含证书和/或私钥:

public void GetInformationsFromKeyChainStore() {

        AccessController.doPrivileged(new PrivilegedAction<Boolean>() {
            public Boolean run() {

                try {
                    KeyStore keyStore = KeyStore.getInstance("KeychainStore",
                            "Apple");
                    keyStore.load(null, null);

                    System.out
                            .println("List of the aliases present in the keystore ("
                                    + keyStore.getType() + ")");
                    Enumeration<String> aliases = keyStore.aliases();

                    ArrayList<String> lstAlias = Collections.list(aliases);

                    for (String alias : lstAlias) {

                        System.out.println(" - Alias: " + alias);
                        System.out.println("     isKeyEntry? "
                                + keyStore.isKeyEntry(alias));
                        System.out.println("     isCertificateEntry?"
                                + keyStore.isCertificateEntry(alias));
                        if (keyStore.isKeyEntry(alias)) {
                            try {
                                PrivateKey key = (PrivateKey) keyStore.getKey(
                                        alias, "-".toCharArray());
                                System.out
                                        .println("    Key loaded successfully. Type: "
                                                + key.getFormat());
                            } catch (RuntimeException e) {
                                System.out.println("    Key failed to load ("
                                        + e.getMessage() + ")");
                            }
                            Certificate certificate = keyStore
                                    .getCertificate(alias);
                            String subject = "";
                            if ((certificate != null)
                                    && (certificate instanceof X509Certificate)) {
                                subject = ((X509Certificate) certificate)
                                        .getSubjectX500Principal().getName();
                            }
                            System.out.println("  Does getCertificate work on this key entry? "
                                    + ((keyStore.getCertificate(alias) != null) ? "Yes "
                                            + subject
                                            : "No"));
                        }
                        if (keyStore.isCertificateEntry(alias)) {
                            Certificate certificate = keyStore
                                    .getCertificate(alias);

                            if (certificate instanceof X509Certificate) {
                                X509Certificate x509certificate = (X509Certificate) certificate;
                                System.out.println("    Subject DN: "
                                        + x509certificate
                                                .getSubjectX500Principal()
                                                .getName());
                            } else {
                                System.out
                                        .println("    Unknown format certificate.");
                            }
                            System.out
                                    .println("  Does getKey work on this certificate entry as well? "
                                            + (keyStore.getKey(alias,
                                                    "-".toCharArray()) != null));

                        }
                    }

                } catch (Exception e) {
                    // TODO Auto-generated catch block
                    e.printStackTrace();
                    return false;
                }
                return true;

            }
        });

    }

但即使调用此方法，我的所有条目似乎都是证书并且不包含任何私钥。

问题是，对于某些证书，有一个私钥(我也可以从我的 KeyChainStore 查看它)。

Answer 1

尝试通过默认提供程序而不是“Apple”提供程序获取 Signature 对象。

换句话说，从方法调用中删除“, p”，然后执行以下操作:

Signature sig = Signature.getInstance("SHA256withRSA");