java - 如何以最快的方式使用 Java 对 XML 进行签名

Question

需要一些有关(优化)以及如何以尽可能最快的方式使用证书签署 XML 的提示/建议。在某些数据库(Oracle)上，需要 30 毫秒来签署文件。但在另一个数据库上，则需要 1.2 秒。该函数/方法在循环中被调用。它对一些 XML 数据进行签名并以字符串形式返回经过签名的 XML。 (Java 方法作为 PL/SQL 函数公开)。

public static String signXML(String vhodniXml) throws Exception {
    DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
    dbFactory.setNamespaceAware(true);
    Document doc =  dbFactory.newDocumentBuilder().parse(new ByteArrayInputStream(vhodniXml.getBytes()));

    NodeList nl = doc.getElementsByTagName("fu:BusinessPremiseRequest");
    Node node = nl.item(0);
    ((Element) node).setIdAttribute("Id", true);

    Enumeration e = p12.aliases();
    String alias = (String) e.nextElement();

    Key privateKey = p12.getKey(alias, geslo.toCharArray());

    KeyStore.PrivateKeyEntry keyEntry
            = (KeyStore.PrivateKeyEntry) p12.getEntry(alias, new KeyStore.PasswordProtection(geslo.toCharArray()));

    X509Certificate cert = (X509Certificate) keyEntry.getCertificate();

    PublicKey publicKey = cert.getPublicKey();
    final XMLSignatureFactory sigFactory = XMLSignatureFactory.getInstance("DOM");
    // Create a Reference to the enveloped document
    Reference ref = sigFactory.newReference("#data",
            sigFactory.newDigestMethod(DigestMethod.SHA256, null),
            Collections.singletonList(sigFactory.newTransform(Transform.ENVELOPED, (TransformParameterSpec) null)),
            null,
            null);

    SignedInfo si = sigFactory.newSignedInfo(sigFactory.newCanonicalizationMethod(CanonicalizationMethod.INCLUSIVE, (C14NMethodParameterSpec) null), sigFactory.newSignatureMethod("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", null), Collections.singletonList(ref));

    // Create a KeyValue containing the RSA PublicKey
    KeyInfoFactory keyInfoFactory = sigFactory.getKeyInfoFactory();
    X509IssuerSerial x509IssuerSerial = keyInfoFactory.newX509IssuerSerial(cert.getSubjectX500Principal().getName(), cert.getSerialNumber());

    List x509Content = new ArrayList();

    x509Content.add(cert.getSubjectX500Principal().getName());
    x509Content.add(x509IssuerSerial);

    KeyValue keyValue = keyInfoFactory.newKeyValue(publicKey);
    X509Data xd = keyInfoFactory.newX509Data(x509Content);

    // Create a KeyInfo and add the KeyValue to it
    KeyInfo keyInfo = keyInfoFactory.newKeyInfo(Collections.singletonList(xd));

    // Create a DOMSignContext and specify the RSA PrivateKey and
    // location of the resulting XMLSignature's parent element
    DOMSignContext dsc = new DOMSignContext(
            privateKey,
            node
    );

    // Create the XMLSignature (but don't sign it yet)
    XMLSignature signature = sigFactory.newXMLSignature(si, keyInfo);

    // Marshal, generate (and sign) the enveloped signature
    signature.sign(dsc);

    ByteArrayOutputStream os = new ByteArrayOutputStream();
    Transformer trans = TransformerFactory.newInstance()
            .newTransformer();
    trans.transform(new DOMSource(doc), new StreamResult(os));

    return new String(os.toByteArray());
}

Answer 1

首先要做的就是通过将与 key 相关的对象存储在字段中来删除一些 IO 操作，因为读取 KeyStore 来获取 key 需要时间。