java - 如何使用 BouncyCaSTLe 读取密码为空的 PKCS8 文件

Question

我可以使用 OpenSSL 生成一个密码为空的 PKCS#8 加密文件:

~ $ openssl pkcs8 -topk8 -in ca_private.pem 
Enter pass phrase for ca_private.pem:
Enter Encryption Password: <ENTER>
Verifying - Enter Encryption Password: <ENTER>
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIBvTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIsWq90VBNFMwCAggA
MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBCFtKOCdDUeRohccAqQZaDIBIIB
YG+ohLBKQ766BTCXXZ7wyAP1l0grcQPgnzI2XmEj33rBIMogS6l3oAN3Faos2I6n
PcUY+aNLQtDSbvPzF4ozd0oWYBTa60iYGboQQ2RolhRRTzNW6K2tWBWUB35v2rLV
VYu7xJMX+dr/PxzhEgaQ4Nerb7v7/EAn4fLv3zcW9f/tPbljKUAiKc/YYP+GjRjA
GyJThdVpyeK6Jflobc3V8gqL8Gk0MgeHmXuUR1+SthA6ia5havH7D/FMLvXxZtRK
CpWOQ8mJp7g7dbUf+qWTLX+dMPQFPZDEofdkCY2/J4dSkgNnPgp+1oxSVpEAAR9v
gWsRezU2KfFUEMIljYOT+s4ZhkeAGtA8qa8qnr0yv9uz1OkzFtrleNf0WV8wRqI7
azo/7ff9TbecseYlTRgR40nd2l3Z9RLMVhsS09vPffYDw3jt+Zqf3m7iEri6eSug
5bMcZTszaQsVT0HOfCcpQ1Q=
-----END ENCRYPTED PRIVATE KEY-----

当使用 PEMParser 读取它时，它返回一个 PKCS8EncryptedPrivateKeyInfo 的实例(如预期的那样)。

尝试使用 JceOpenSSLPKCS8DecryptorProviderBuilder 解密，但是失败了

org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: password empty

创建解密 key 时，有一个空密码硬编码检查。有没有解决的办法？ OpenSSL 确实可以很好地读取 PKCS#8 返回...

示例代码:

import com.excelfore.api.lib.util.ApiCrypto;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder;
import org.bouncycastle.operator.InputDecryptorProvider;
import org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo;

import java.io.FileReader;

class Scratch {
    public static void main(String[] args) throws Exception {

        try (FileReader fr = new FileReader(args[0])) {

            Object whatIsIt = new PEMParser(fr).readObject();
            if (whatIsIt instanceof PKCS8EncryptedPrivateKeyInfo) {
                PKCS8EncryptedPrivateKeyInfo pInfo = (PKCS8EncryptedPrivateKeyInfo) whatIsIt;
                InputDecryptorProvider provider =
                        new JceOpenSSLPKCS8DecryptorProviderBuilder().setProvider(ApiCrypto.bouncyCastleProvider).build(args[1].toCharArray());
                pInfo.decryptPrivateKeyInfo(provider);
                System.out.println("ok");
            } else {
                System.out.println("I don't want "+whatIsIt.getClass().getName());
            }
        }
    }
}

Answer 1

不确定是否有你所期望的(不要用空密码进行测试)

    public static KeyPair parseKeyPair(Path pemFile, String passPhrase) {
        try(PEMParser pemParser = new PEMParser(Files.newBufferedReader(pemFile))) {
            Object object = pemParser.readObject();
            JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider(BouncyCastleProviderHolder.BC_PROVIDER);
            if(object instanceof PEMEncryptedKeyPair) {
                if(passPhrase == null)
                    throw new IllegalArgumentException("Pass phrase required for parsing RSA private key");

                PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(passPhrase.toCharArray());
                return converter.getKeyPair(((PEMEncryptedKeyPair) object).decryptKeyPair(decProv));
            }
            if(object instanceof PEMKeyPair) {
                return converter.getKeyPair((PEMKeyPair) object);
            }
        } catch(Exception e) {
            throw new PicApplicationException("Couldn't parse pem to keypair", e);
        }

        throw new PicApplicationException("Couldn't parse pem to keypair");
    }

您可以将空密码传递给此行:

PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build("".toCharArray());