AES加密解密及证书密钥的获取

    最近几天一直在做单点登录加密串的解密，碰到了一些问题，将这些问题分享下。
    首先加密解密需要用到jce_policy-1_5_0.zip，下载地址：http://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/VerifyItem-Start/jce_policy-1_5_0.zip?BundledLineItemUUID=PdKJ_hCvc84AAAEq2HgdNaQ9&OrderID=UVSJ_hCvhXQAAAEqyXgdNaQ9&ProductID=NVXACUFBETQAAAEY68A5AXuH&FileName=/jce_policy-1_5_0.zip 然后将jce_policy-1_5_0.zip 中的 jar 包替换 %JAVA_HOME%/jre/lib/security 目录下的相关文件
    相关代码 private byte[] _iV = { 85, 60, 12, 116, 99, (byte) 189, (byte) 173, 19, (byte) 138, (byte) 183, (byte) 232, (byte) 248, 82, (byte) 232, (byte) 200, (byte) 242 }; private byte[] _key = { (byte) 175, (byte) 206, (byte) 222, 40, 61, (byte) 149, (byte) 157, (byte) 166, (byte) 164, (byte) 179, 15, 16, (byte) 219, (byte) 221, 96, 10, (byte) 242, (byte) 207, (byte) 137, (byte) 104, 98, (byte) 138, (byte) 246, 89, (byte) 252, (byte) 153, 50, 13, (byte) 173, 75, (byte) 183, 18 }; private byte[] compute(int mode, byte[] rawBytes) { try { Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); SecretKeySpec keySpec = new SecretKeySpec(_key, "AES"); IvParameterSpec ivSpec = new IvParameterSpec(_iV); cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec); return cipher.doFinal(rawBytes); } catch (Exception ex) { ex.printStackTrace(); } return null; } 
    从网上找到了好多RSA-SHA1读取证书密钥签名的代码，大部分都是相同的，都不是很好用。 读取 PKCS12证书（.pfx）所需要的第三方包bcprov-jdk15-145.jar 地址 ：http://www.bouncycastle.org/download/bcprov-jdk15-145.jar ，将jar包放到%JAVA_HOME%/jre/lib/ext下，在java.security添加下列文字:
security.provider.7=org.bouncycastle.jce.provider.BouncyCastleProvider
这样就可以读取证书文件，获取私钥签名了。

    私钥签名相关代码 /** * RSA-SHA1私钥签名 * @param src * @return * @throws Exception */ private static byte[] sign(byte[] src) throws Exception { FileInputStream fis = null; try { // Open an input stream on the keystore file String pfxFileName = "ssip.pfx"; String pfxPassword = "fetion"; fis = new FileInputStream(pfxFileName); // Create a keystore object KeyStore keyStore = null; try { // Need BC provider for PKCS #12, BKS and UBER if (Security.getProvider("BC") == null) { throw new Exception(" 不能Load入BouncyCastle! "); } keyStore = KeyStore.getInstance("PKCS12", "BC"); } catch (KeyStoreException ex) { throw new Exception(" 不能正确解释pfx文件! "); } try { // Load the file into the keystore keyStore.load(fis, pfxPassword.toCharArray()); //Certificate[] certs = keyStore.getCertificateChain("5871a33a9a9e83899cf0a48eb59cde6b_17354fbb-09e1-458e-8d6e-398c04372270"); //X509Certificate t1 = (X509Certificate)certs[0]; PrivateKey prikey = (PrivateKey) keyStore.getKey("5871a33a9a9e83899cf0a48eb59cde6b_17354fbb-09e1-458e-8d6e-398c04372270",null); // 使用私鈅签名 Signature sig = Signature.getInstance("SHA1WithRSA"); sig.initSign(prikey); sig.update(src); byte[] signature = sig.sign(); return signature; } catch (CertificateException ex) { throw new Exception(" 证书格式问题! "); } catch (NoSuchAlgorithmException ex) { throw new Exception(" 算法不支持! "); } catch (FileNotFoundException ex) { throw new Exception(" pfx文件没找到 "); } catch (IOException ex) { throw new Exception(" 读取pfx有误! "); } } catch (Exception e) { e.printStackTrace(); } finally { if(fis != null ) { try { fis.close(); } catch (IOException e) { System.out.println(e); } } } return null; }

    在keyStore.getKey获取PricateKey对象是要知道证书的别名，获取别名可以参考下面链接

    http://snowolf.javaeye.com/blog/735294

    公钥签名验证代码 /** * RSA-SHA1 公钥签名校验 * @param decData * @throws Exception */ private static void signVerify(byte[] decData) throws Exception { FileInputStream fis = null; try { byte[] signSrc = new byte[14]; byte[] signed = new byte[decData.length - 18]; System.arraycopy(decData, 4, signSrc, 0, 14); System.arraycopy(decData, 18, signed, 0, decData.length - 18); if (signed.length != 256) { throw new Exception("signed must 256 byte!"); } fis = new FileInputStream("123.cer"); CertificateFactory cf = CertificateFactory.getInstance("X.509"); X509Certificate x509 = (X509Certificate) cf.generateCertificate(fis); PublicKey pk = x509.getPublicKey(); Signature signatureChecker = Signature.getInstance("SHA1WithRSA"); signatureChecker.initVerify(pk); signatureChecker.update(signSrc); if (!signatureChecker.verify(signed)) { throw new Exception("signed is invalid!"); } } finally { if(fis != null ) { try { fis.close(); } catch (IOException e) { System.out.println(e); } } } }

    注意：如果证书是2048bit，那么签名获取的256位的byte数组，1024bit对应的128位byte数组