java - PKCS#7 加密

Question

使用java加密、签名、解密、验证签名需要遵循哪些步骤？ 使用 PKCS#7 算法， java keystore 有什么用？关于 PKCS#7。

Answer 1

第 1 步 使用 keytool 实用程序生成 key 。 here你会找到很好的教程

第 2 步加载 keystore

import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.security.GeneralSecurityException;
import java.security.KeyStore;

import org.apache.commons.io.IOUtils;
import org.apache.commons.lang.SystemUtils;

public class MyKeystoreProvider {
  public KeyStore getKeystore(char[] password) throws GeneralSecurityException, IOException {
    KeyStore keystore = KeyStore.getInstance("jks");
    InputStream input = new FileInputStream(SystemUtils.USER_HOME + File.separator + ".keystore");
    try {
      keystore.load(input, password);
    } catch (IOException e) {
    } finally {
      IOUtils.closeQuietly(input);
    }
    return keystore;
  }
}

第 3 步接下来，假设您想要一些代码来对某些内容进行签名。假设您的内容是一堆 ASCII 文本，您可以将其表示为字节数组。因此您将使用一些 Bouncy CaSTLe 类来生成“CMS 签名数据”:

  public byte[] sign(byte[] data) throws 
           GeneralSecurityException, CMSException, IOException {
      Security.addProvider(new BouncyCastleProvider());
      CMSSignedDataGenerator generator = new CMSSignedDataGenerator();
      generator.addSigner(getPrivateKey(), (X509Certificate) getCertificate(),
          CMSSignedDataGenerator.DIGEST_SHA1);
      generator.addCertificatesAndCRLs(getCertStore());
      CMSProcessable content = new CMSProcessableByteArray(data);

      CMSSignedData signedData = generator.generate(content, true, "BC");
      return signedData.getEncoded();
    }

private CertStore getCertStore() throws GeneralSecurityException {
  ArrayList<Certificate> list = new ArrayList<Certificate>();
  Certificate[] certificates = getKeystore().getCertificateChain(this.alias);
  for (int i = 0, length = certificates == null ? 0 : certificates.length; i < length; i++) {
    list.add(certificates[i]);
  }
  return CertStore.getInstance("Collection", new CollectionCertStoreParameters(list), "BC");
}

private PrivateKey getPrivateKey() throws GeneralSecurityException {
  if (this.privateKey == null) {
     this.privateKey = initalizePrivateKey();
  }
  return this.privateKey;
}

private PrivateKey initalizePrivateKey() throws GeneralSecurityException {
   KeyStore keystore = new MyKeystoreProvider().getKeystore();
   return (PrivateKey) keystore.getKey(this.alias, getPasswordAsCharArray());
}

现在终于可以得到原始内容了。

CMSSignedData s = new CMSSignedData(signedBytes);
CertStore certs = s.getCertificatesAndCRLs("Collection", "BC");
SignerInformationStore signers = s.getSignerInfos();
boolean verified = false;

    for (Iterator i = signers.getSigners().iterator(); i.hasNext(); ) {
      SignerInformation signer = (SignerInformation) i.next();
      Collection<? extends Certificate> certCollection = certs.getCertificates(signer.getSID());
      if (!certCollection.isEmpty()) {
        X509Certificate cert = (X509Certificate) certCollection.iterator().next();
        if (signer.verify(cert.getPublicKey(), "BC")) {
          verified = true;
        }
      }
    }
    CMSProcessable signedContent = s.getSignedContent() ;
    byte[] originalContent  = (byte[]) signedContent.getContent();