java - 非法 key 大小

Question

我已经安装了 jce 以允许更大的 key ，但是 KeytoolUIU 和 Portecle 都给出了类似 java.IO.Exception: Error initialising store of key store: java.security.InvalidKeyException: Illegal Key Size 的错误. key 只有 1024，所以我不知道它为什么会提示。

这是我当前用于加载 key 文件和访问安全网站的代码。

package com.g4apps.secure.android.sslclient;

import java.io.InputStream;
import java.security.KeyStore;
import java.security.Security;

import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.ssl.AllowAllHostnameVerifier;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.util.EntityUtils;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

import android.content.Context;

/**
 * This example demonstrates how to create secure connections with a custom SSL
 * context.
 */
public class SSLclient {


    public final static String authenticate(Context context) throws Exception {
        DefaultHttpClient httpclient = new DefaultHttpClient();
        String output=null;

        Security.addProvider(new BouncyCastleProvider());
        try {
            KeyStore trustStore  = KeyStore.getInstance("BKS");
            InputStream instream = context.getResources().getAssets().open("my.truststore");
            try {
                trustStore.load(instream, "dysan100".toCharArray());
            } finally {
                try { instream.close(); } catch (Exception ignore) {}
            }
            KeyStore keystore = KeyStore.getInstance("BKS");
            InputStream keystream = context.getResources().getAssets().open("my.keystore.bks");
            try {
                keystore.load(keystream, "dysan100".toCharArray());
            } finally {
                try { keystream.close(); } catch (Exception ignore) {}
            }

            SSLSocketFactory socketFactory = new SSLSocketFactory(keystore,"dysan100",trustStore);
            socketFactory.setHostnameVerifier(new AllowAllHostnameVerifier());
            Scheme sch = new Scheme("https", socketFactory, 443);
            httpclient.getConnectionManager().getSchemeRegistry().register(sch);

            HttpGet httpget = new HttpGet("https://192.168.1.123/test.php");

            System.out.println("executing request" + httpget.getRequestLine());

            HttpResponse response = httpclient.execute(httpget);
            HttpEntity entity = response.getEntity();

            System.out.println("----------------------------------------");
            System.out.println(response.getStatusLine());
            if (entity != null) {
                System.out.println("Response content length: " + entity.getContentLength());
                output=EntityUtils.toString(entity);
                System.out.println(output);
                return output;

            }


        } finally {
            // When HttpClient instance is no longer needed,
            // shut down the connection manager to ensure
            // immediate deallocation of all system resources
            httpclient.getConnectionManager().shutdown();
        }

        return null;
    }

}

目前 keystore 是这样组成的

my.truststore.bks 有我的 CA 证书
my.keystore.bks 应该有我的服务器证书、客户端证书和客户端的私钥。

这与我在我的程序的 pc 版本中设置它的方式相同(不过使用 JKS 商店)。

既然它不允许我像这样设置我的商店，是否有另一种方法可能对我有用？

Answer 1

我不确定为什么我无法创建 bks keystore ，但我能够让它与 PKCS12 keystore 一起使用。所以我有一个替代方案。

        KeyStore keystore = KeyStore.getInstance("PKCS12");
        InputStream keystream = context.getResources().getAssets().open("client.p12");
        try {
            keystore.load(keystream, "dysan100".toCharArray());
        } finally {
            try { keystream.close(); } catch (Exception ignore) {}
        }