RSA加密解密（無數據大小限制，php、go、java互通實現）
RSA加解密中必須考慮到的密鑰長度、明文長度和密文長度問題。明文長度須要小於密鑰長度，而密文長度則等於密鑰長度。所以當加密內容長度大於密鑰長度時，有效的RSA加解密就須要對內容進行分段。java
這是由於，RSA算法自己要求加密內容也就是明文長度m必須0<m<密鑰長度n。若是小於這個長度就須要進行padding，由於若是沒有padding，就沒法肯定解密後內容的真實長度，字符串之類的內容問題還不大，以0做爲結束符，但對二進制數據就很難，由於不肯定後面的0是內容仍是內容結束符。而只要用到padding，那麼就要佔用實際的明文長度，因而實際明文長度須要減去padding字節長度。咱們通常使用的padding標準有NoPPadding、OAEPPadding、PKCS1Padding等，其中PKCS#1建議的padding就佔用了11個字節。git
這樣，對於1024長度的密鑰。128字節（1024bits）-減去11字節正好是117字節，但對於RSA加密來說，padding也是參與加密的，因此，依然按照1024bits去理解，但實際的明文只有117字節了。github
因此若是要對任意長度的數據進行加密，就須要將數據分段後進行逐一加密，並將結果進行拼接。一樣，解碼也須要分段解碼，並將結果進行拼接。算法
Php實現
if (! function_exists('url_safe_base64_encode')) {
function url_safe_base64_encode ($data) {
return str_replace(array('+','/', '='),array('-','_', ''), base64_encode($data));
}
}
if (! function_exists('url_safe_base64_decode')) {
function url_safe_base64_decode ($data) {
$base_64 = str_replace(array('-','_'),array('+','/'), $data);
return base64_decode($base_64);
}
}
class XRsa
{
const CHAR_SET = "UTF-8";
const BASE_64_FORMAT = "UrlSafeNoPadding";
const RSA_ALGORITHM_KEY_TYPE = OPENSSL_KEYTYPE_RSA;
const RSA_ALGORITHM_SIGN = OPENSSL_ALGO_SHA256;
protected $public_key;
protected $private_key;
protected $key_len;
public function __construct($pub_key, $pri_key = null)
{
$this->public_key = $pub_key;
$this->private_key = $pri_key;
$pub_id = openssl_get_publickey($this->public_key);
$this->key_len = openssl_pkey_get_details($pub_id)['bits'];
}
/*
* 建立密鑰對
*/
public static function createKeys($key_size = 2048)
{
$config = array(
"private_key_bits" => $key_size,
"private_key_type" => self::RSA_ALGORITHM_KEY_TYPE,
);
$res = openssl_pkey_new($config);
openssl_pkey_export($res, $private_key);
$public_key_detail = openssl_pkey_get_details($res);
$public_key = $public_key_detail["key"];
return [
"public_key" => $public_key,
"private_key" => $private_key,
];
}
/*
* 公鑰加密
*/
public function publicEncrypt($data)
{
$encrypted = '';
$part_len = $this->key_len / 8 - 11;
$parts = str_split($data, $part_len);
foreach ($parts as $part) {
$encrypted_temp = '';
openssl_public_encrypt($part, $encrypted_temp, $this->public_key);
$encrypted .= $encrypted_temp;
}
return url_safe_base64_encode($encrypted);
}
/*
* 私鑰解密
*/
public function privateDecrypt($encrypted)
{
$decrypted = "";
$part_len = $this->key_len / 8;
$base64_decoded = url_safe_base64_decode($encrypted);
$parts = str_split($base64_decoded, $part_len);
foreach ($parts as $part) {
$decrypted_temp = '';
openssl_private_decrypt($part, $decrypted_temp,$this->private_key);
$decrypted .= $decrypted_temp;
}
return $decrypted;
}
/*
* 私鑰加密
*/
public function privateEncrypt($data)
{
$encrypted = '';
$part_len = $this->key_len / 8 - 11;
$parts = str_split($data, $part_len);
foreach ($parts as $part) {
$encrypted_temp = '';
openssl_private_encrypt($part, $encrypted_temp, $this->private_key);
$encrypted .= $encrypted_temp;
}
return url_safe_base64_encode($encrypted);
}
/*
* 公鑰解密
*/
public function publicDecrypt($encrypted)
{
$decrypted = "";
$part_len = $this->key_len / 8;
$base64_decoded = url_safe_base64_decode($encrypted);
$parts = str_split($base64_decoded, $part_len);
foreach ($parts as $part) {
$decrypted_temp = '';
openssl_public_decrypt($part, $decrypted_temp,$this->public_key);
$decrypted .= $decrypted_temp;
}
return $decrypted;
}
/*
* 數據加簽
*/
public function sign($data)
{
openssl_sign($data, $sign, $this->private_key, self::RSA_ALGORITHM_SIGN);
return url_safe_base64_encode($sign);
}
/*
* 數據簽名驗證
*/
public function verify($data, $sign)
{
$pub_id = openssl_get_publickey($this->public_key);
$res = openssl_verify($data, url_safe_base64_decode($sign), $pub_id, self::RSA_ALGORITHM_SIGN);
return $res;
}
}
Go實現
package xrsa
import (
"encoding/pem"
"encoding/base64"
"crypto/x509"
"crypto/rsa"
"crypto/rand"
"errors"
"crypto"
"io"
"bytes"
"encoding/asn1"
)
const (
CHAR_SET = "UTF-8"
BASE_64_FORMAT = "UrlSafeNoPadding"
RSA_ALGORITHM_KEY_TYPE = "PKCS8"
RSA_ALGORITHM_SIGN = crypto.SHA256
)
type XRsa struct {
publicKey *rsa.PublicKey
privateKey *rsa.PrivateKey
}
// 生成密鑰對
func CreateKeys(publicKeyWriter, privateKeyWriter io.Writer, keyLength int) error {
// 生成私鑰文件
privateKey, err := rsa.GenerateKey(rand.Reader, keyLength)
if err != nil {
return err
}
derStream := MarshalPKCS8PrivateKey(privateKey)
block := &pem.Block{
Type: "PRIVATE KEY",
Bytes: derStream,
}
err = pem.Encode(privateKeyWriter, block)
if err != nil {
return err
}
// 生成公鑰文件
publicKey := &privateKey.PublicKey
derPkix, err := x509.MarshalPKIXPublicKey(publicKey)
if err != nil {
return err
}
block = &pem.Block{
Type: "PUBLIC KEY",
Bytes: derPkix,
}
err = pem.Encode(publicKeyWriter, block)
if err != nil {
return err
}
return nil
}
func NewXRsa(publicKey []byte, privateKey []byte) (*XRsa, error) {
block, _ := pem.Decode(publicKey)
if block == nil {
return nil, errors.New("public key error")
}
pubInterface, err := x509.ParsePKIXPublicKey(block.Bytes)
if err != nil {
return nil, err
}
pub := pubInterface.(*rsa.PublicKey)
block, _ = pem.Decode(privateKey)
if block == nil {
return nil, errors.New("private key error!")
}
priv, err := x509.ParsePKCS8PrivateKey(block.Bytes)
if err != nil {
return nil, err
}
pri, ok := priv.(*rsa.PrivateKey)
if ok {
return &XRsa {
publicKey: pub,
privateKey: pri,
}, nil
} else {
return nil, errors.New("private key not supported")
}
}
// 公鑰加密
func (r *XRsa) PublicEncrypt(data string) (string, error) {
partLen := r.publicKey.N.BitLen() / 8 - 11
chunks := split([]byte(data), partLen)
buffer := bytes.NewBufferString("")
for _, chunk := range chunks {
bytes, err := rsa.EncryptPKCS1v15(rand.Reader, r.publicKey, chunk)
if err != nil {
return "", err
}
buffer.Write(bytes)
}
return base64.RawURLEncoding.EncodeToString(buffer.Bytes()), nil
}
// 私鑰解密
func (r *XRsa) PrivateDecrypt(encrypted string) (string, error) {
partLen := r.publicKey.N.BitLen() / 8
raw, err := base64.RawURLEncoding.DecodeString(encrypted)
chunks := split([]byte(raw), partLen)
buffer := bytes.NewBufferString("")
for _, chunk := range chunks {
decrypted, err := rsa.DecryptPKCS1v15(rand.Reader, r.privateKey, chunk)
if err != nil {
return "", err
}
buffer.Write(decrypted)
}
return buffer.String(), err
}
// 數據加簽
func (r *XRsa) Sign(data string) (string, error) {
h := RSA_ALGORITHM_SIGN.New()
h.Write([]byte(data))
hashed := h.Sum(nil)
sign, err := rsa.SignPKCS1v15(rand.Reader, r.privateKey, RSA_ALGORITHM_SIGN, hashed)
if err != nil {
return "", err
}
return base64.RawURLEncoding.EncodeToString(sign), err
}
// 數據驗籤
func (r *XRsa) Verify(data string, sign string) error {
h := RSA_ALGORITHM_SIGN.New()
h.Write([]byte(data))
hashed := h.Sum(nil)
decodedSign, err := base64.RawURLEncoding.DecodeString(sign)
if err != nil {
return err
}
return rsa.VerifyPKCS1v15(r.publicKey, RSA_ALGORITHM_SIGN, hashed, decodedSign)
}
func MarshalPKCS8PrivateKey(key *rsa.PrivateKey) []byte {
info := struct {
Version int
PrivateKeyAlgorithm []asn1.ObjectIdentifier
PrivateKey []byte
}{}
info.Version = 0
info.PrivateKeyAlgorithm = make([]asn1.ObjectIdentifier, 1)
info.PrivateKeyAlgorithm[0] = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 1}
info.PrivateKey = x509.MarshalPKCS1PrivateKey(key)
k, _ := asn1.Marshal(info)
return k
}
func split(buf []byte, lim int) [][]byte {
var chunk []byte
chunks := make([][]byte, 0, len(buf)/lim+1)
for len(buf) >= lim {
chunk, buf = buf[:lim], buf[lim:]
chunks = append(chunks, chunk)
}
if len(buf) > 0 {
chunks = append(chunks, buf[:len(buf)])
}
return chunks
}
Java實現
package com.inspii;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.io.IOUtils;
import javax.crypto.Cipher;
import java.io.ByteArrayOutputStream;
import java.security.*;
import java.security.interfaces.RSAPublicKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.HashMap;
import java.util.Map;
public class XRsa {
public static final String CHARSET = "UTF-8";
public static final String RSA_ALGORITHM = "RSA";
public static final String RSA_ALGORITHM_SIGN = "SHA256WithRSA";
private RSAPublicKey publicKey;
private RSAPrivateKey privateKey;
public XRsa(String publicKey, String privateKey)
{
try {
KeyFactory keyFactory = KeyFactory.getInstance(RSA_ALGORITHM);
//經過X509編碼的Key指令得到公鑰對象
X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(Base64.decodeBase64(publicKey));
this.publicKey = (RSAPublicKey) keyFactory.generatePublic(x509KeySpec);
//經過PKCS#8編碼的Key指令得到私鑰對象
PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(Base64.decodeBase64(privateKey));
this.privateKey = (RSAPrivateKey) keyFactory.generatePrivate(pkcs8KeySpec);
} catch (Exception e) {
throw new RuntimeException("不支持的密鑰", e);
}
}
public static Map<String, String> createKeys(int keySize){
//爲RSA算法建立一個KeyPairGenerator對象
KeyPairGenerator kpg;
try{
kpg = KeyPairGenerator.getInstance(RSA_ALGORITHM);
}catch(NoSuchAlgorithmException e){
throw new IllegalArgumentException("No such algorithm-->[" + RSA_ALGORITHM + "]");
}
//初始化KeyPairGenerator對象,不要被initialize()源碼錶面上欺騙,其實這裏聲明的size是生效的
kpg.initialize(keySize);
//生成密匙對
KeyPair keyPair = kpg.generateKeyPair();
//獲得公鑰
Key publicKey = keyPair.getPublic();
String publicKeyStr = Base64.encodeBase64URLSafeString(publicKey.getEncoded());
//獲得私鑰
Key privateKey = keyPair.getPrivate();
String privateKeyStr = Base64.encodeBase64URLSafeString(privateKey.getEncoded());
Map<String, String> keyPairMap = new HashMap<String, String>();
keyPairMap.put("publicKey", publicKeyStr);
keyPairMap.put("privateKey", privateKeyStr);
return keyPairMap;
}
public String publicEncrypt(String data){
try{
Cipher cipher = Cipher.getInstance(RSA_ALGORITHM);
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
return Base64.encodeBase64URLSafeString(rsaSplitCodec(cipher, Cipher.ENCRYPT_MODE, data.getBytes(CHARSET), publicKey.getModulus().bitLength()));
}catch(Exception e){
throw new RuntimeException("加密字符串[" + data + "]時遇到異常", e);
}
}
public String privateDecrypt(String data){
try{
Cipher cipher = Cipher.getInstance(RSA_ALGORITHM);
cipher.init(Cipher.DECRYPT_MODE, privateKey);
return new String(rsaSplitCodec(cipher, Cipher.DECRYPT_MODE, Base64.decodeBase64(data), publicKey.getModulus().bitLength()), CHARSET);
}catch(Exception e){
throw new RuntimeException("解密字符串[" + data + "]時遇到異常", e);
}
}
public String privateEncrypt(String data){
try{
Cipher cipher = Cipher.getInstance(RSA_ALGORITHM);
cipher.init(Cipher.ENCRYPT_MODE, privateKey);
return Base64.encodeBase64URLSafeString(rsaSplitCodec(cipher, Cipher.ENCRYPT_MODE, data.getBytes(CHARSET), publicKey.getModulus().bitLength()));
}catch(Exception e){
throw new RuntimeException("加密字符串[" + data + "]時遇到異常", e);
}
}
public String publicDecrypt(String data){
try{
Cipher cipher = Cipher.getInstance(RSA_ALGORITHM);
cipher.init(Cipher.DECRYPT_MODE, publicKey);
return new String(rsaSplitCodec(cipher, Cipher.DECRYPT_MODE, Base64.decodeBase64(data), publicKey.getModulus().bitLength()), CHARSET);
}catch(Exception e){
throw new RuntimeException("解密字符串[" + data + "]時遇到異常", e);
}
}
public String sign(String data){
try{
//sign
Signature signature = Signature.getInstance(RSA_ALGORITHM_SIGN);
signature.initSign(privateKey);
signature.update(data.getBytes(CHARSET));
return Base64.encodeBase64URLSafeString(signature.sign());
}catch(Exception e){
throw new RuntimeException("簽名字符串[" + data + "]時遇到異常", e);
}
}
public boolean verify(String data, String sign){
try{
Signature signature = Signature.getInstance(RSA_ALGORITHM_SIGN);
signature.initVerify(publicKey);
signature.update(data.getBytes(CHARSET));
return signature.verify(Base64.decodeBase64(sign));
}catch(Exception e){
throw new RuntimeException("驗簽字符串[" + data + "]時遇到異常", e);
}
}
private static byte[] rsaSplitCodec(Cipher cipher, int opmode, byte[] datas, int keySize){
int maxBlock = 0;
if(opmode == Cipher.DECRYPT_MODE){
maxBlock = keySize / 8;
}else{
maxBlock = keySize / 8 - 11;
}
ByteArrayOutputStream out = new ByteArrayOutputStream();
int offSet = 0;
byte[] buff;
int i = 0;
try{
while(datas.length > offSet){
if(datas.length-offSet > maxBlock){
buff = cipher.doFinal(datas, offSet, maxBlock);
}else{
buff = cipher.doFinal(datas, offSet, datas.length-offSet);
}
out.write(buff, 0, buff.length);
i++;
offSet = i * maxBlock;
}
}catch(Exception e){
throw new RuntimeException("加解密閥值爲["+maxBlock+"]的數據時發生異常", e);
}
byte[] resultDatas = out.toByteArray();
IOUtils.closeQuietly(out);
return resultDatas;
}
}
參考
github地址： https://github.com/liamylian/...apache
相關文章
- 1. Python&Java互通rsa加密解密
- 2. PHP 實現 RSA 加解密
- 3. php和java之間rsa加密互通
- 4. java使用RSA加密方式實現數據加密解密
- 5. RSA加密解密實現
- 6. 通用RSA加密 - PHP+Java+Javascript加密解密
- 7. RSA加密與解密(Java實現)
- 8. RSA 加密及php實現
- 9. rsa加解密，js加密，php解密
- 10. php-rsa 加密解密
- 更多相關文章...
- • Kotlin 數據類與密封類 - Kotlin 教程
- • SQL 通用數據類型 - SQL 教程
- • Flink 數據傳輸及反壓詳解
- • ☆基於Java Instrument的Agent實現
相關標籤/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
歡迎關注本站公眾號,獲取更多信息
相關文章