Java&keytool生成RSA密钥

青旅半醒 2022-04-11 09:08 241阅读 0赞

工作中需要使用非对称加密RSA来进行消息摘要生产和验证，但无法通过keytool工具来提取私钥。

那怎么获得私钥、公钥？

以Java为例：通过KeyStore类getEntry() 或者getKey()来提取私钥；通过Certificate类getPublicKey()获取公钥。

**一.Keytool生成KeyStore文件**

--  生成密码仓库test.store
    keytool -genkey -v -alias test -dname "CN=test,OU=HE,O=CUI,L=SHENGZHEN,ST=GUANGDONG,C=CN" -keyalg RSA -keysize 2048 -keypass 5201314 -keystore test.store -storepass 5201314 -validity 10000 -storetype JCEKS
     --  导出证书test.crt
    keytool -exportcert -alias test -file test.crt -keystore test.store -storepass 5201314 -rfc -storetype JCEKS

运行后在F盘的Key目录下将产生如下两个文件。  
![983319d6-0f46-3a3a-8d3e-6a1cf20af3d3.png][]

**二.生成私钥、公钥**

KeyStoreHelper.java

package com.bijian.keystore;
    
    import java.io.FileInputStream;
    import java.io.FileNotFoundException;
    import java.io.FileOutputStream;
    import java.io.InputStream;
    import java.io.ObjectOutputStream;
    import java.security.KeyStore;
    import java.security.PrivateKey;
    import java.security.PublicKey;
    import java.security.cert.Certificate;
    import java.security.cert.CertificateException;
    import java.security.cert.CertificateFactory;
    
    import sun.misc.BASE64Encoder;
    
    public class KeyStoreHelper {
        
        public static void main(String[] args) throws Exception {
            
            String privatePath = "F:/Key/testPri.key"; // 准备导出的私钥
            String publicPath = "F:/Key/testPub.key"; // 准备导出的公钥
            PrivateKey privateKey = getPrivateKeyFromStore();
            createKeyFile(privateKey, privatePath);
            PublicKey publicKey = getPublicKeyFromCrt();
            createKeyFile(publicKey, publicPath);
            
            byte[] publicKeyBytes = publicKey.getEncoded();
            byte[] privateKeyBytes = privateKey.getEncoded();
    
            String publicKeyBase64 = new BASE64Encoder().encode(publicKeyBytes);
            String privateKeyBase64 = new BASE64Encoder().encode(privateKeyBytes);
    
            System.out.println("publicKeyBase64.length():" + publicKeyBase64.length());
            System.out.println("publicKeyBase64:" + publicKeyBase64);
    
            System.out.println("privateKeyBase64.length():" + privateKeyBase64.length());
            System.out.println("privateKeyBase64:" + privateKeyBase64);
        }
    
        private static PrivateKey getPrivateKeyFromStore() throws Exception {
            String alias = "test"; // KeyTool中生成KeyStore时设置的alias
            String storeType = "JCEKS"; // KeyTool中生成KeyStore时设置的storetype
            char[] pw = "5201314".toCharArray(); // KeyTool中生成KeyStore时设置的storepass
            String storePath = "F:/Key/test.store"; // KeyTool中已生成的KeyStore文件
            storeType = null == storeType ? KeyStore.getDefaultType() : storeType;
            KeyStore keyStore = KeyStore.getInstance(storeType);
            InputStream is = new FileInputStream(storePath);
            keyStore.load(is, pw);
            // 由密钥库获取密钥的两种方式
            // KeyStore.PrivateKeyEntry pkEntry = (KeyStore.PrivateKeyEntry) keyStore.getEntry(alias, new KeyStore.PasswordProtection(pw));
            // return pkEntry.getPrivateKey();
            return (PrivateKey) keyStore.getKey(alias, pw);
        }
    
        private static PublicKey getPublicKeyFromCrt() throws CertificateException, FileNotFoundException {
            String crtPath = "F:/Key/test.crt"; // KeyTool中已生成的证书文件
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            FileInputStream in = new FileInputStream(crtPath);
            Certificate crt = cf.generateCertificate(in);
            PublicKey publicKey = crt.getPublicKey();
            return publicKey;
        }
    
        private static void createKeyFile(Object key, String filePath) throws Exception {
            FileOutputStream fos = new FileOutputStream(filePath);
            ObjectOutputStream oos = new ObjectOutputStream(fos);
            oos.writeObject(key);
            oos.flush();
            oos.close();
        }
    }

运行上面的代码后，将在F盘的Key目录下新产生testPub.key、testPri.key公私钥文件。

![b038898c-4cc3-3d4e-bb94-1a6ad1199f67.png][]  
        并在控制台输出如下内容：

![a8d7d70c-834a-3167-8baa-dfe3176d814f.png][]  
        到此为止，公私钥已生成。

**三.验证上面生成的公私钥**

**1.私钥加签公钥验签，进行验证**

DigestUtil.java

package com.bijian.keystore;
    
    public class DigestUtil {
    
        /**
         * 字节转为十六进制字符串
         * @param字节
         * @return 十六进制字符串
         */
        public static String byte2hex(byte[] b) {
            String hs = "";
            String stmp = "";
            for (int n = 0; b != null && n < b.length; n++) {
                stmp = (java.lang.Integer.toHexString(b[n] & 0XFF));
                if (stmp.length() == 1)
                    hs = hs + "0" + stmp;
                else
                    hs = hs + stmp;
            }
            return hs;
        }
    
        /**
         * 十六进制字符转为字节
         * @param 十六进制字符
         * @return  字节
         */
        public static byte[] hex2byte(byte[] b) {
            if ((b.length % 2) != 0)
                throw new IllegalArgumentException("byte length is not correct");
            byte[] b2 = new byte[b.length / 2];
            for (int n = 0; n < b.length; n += 2) {
                String item = new String(b, n, 2);
                b2[n / 2] = (byte) Integer.parseInt(item, 16);
            }
            return b2;
        }
    
        /**
         * 字符串转换成十六进制值
         * @param bin String 我们看到的要转换成十六进制的字符串
         * @return
        */
        public static String bin2hex(String bin) {
            char[] digital = "0123456789ABCDEF".toCharArray();
            StringBuffer sb = new StringBuffer("");
            byte[] bs = bin.getBytes();
            int bit;
            for (int i = 0; i < bs.length; i++) {
                bit = (bs[i] & 0x0f0) >> 4;
                sb.append(digital[bit]);
                bit = bs[i] & 0x0f;
                sb.append(digital[bit]);
            }
            return sb.toString();
        }
    }

SignUtil.java

package com.bijian.keystore;
    
    import java.security.KeyFactory;
    import java.security.PrivateKey;
    import java.security.spec.PKCS8EncodedKeySpec;
    
    import org.apache.commons.codec.binary.Base64;
    
    public class SignUtil {
        
        //#priKeyText
        private final static String priKeyText = "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQChXmxaPt6Qg+XTiqaCG1cZEKwGPbKy/Qs5xGNx4HotngGUM2n/5FdZtSHZofJWsNUUKpZa+BynhNg0E0Qn4Xrp0WSi+Z5LgDewT7DeA0b5Cky386MEWwc11Asa+SuMiR5XFUjXdWrMQX5E7wVRcbuoq7A8QBfm3i8F4PdMokhlMviwhLngKOrWVKobE8cyA25Jv2FZgxv1NzVZ7zyGaO60a49X/NaA2poe5OB9zXBfsa8kfHl0b+sMQMd38uVrtCIqs2KABW6EGTToezk55i+hHg7nqMLum7Xtw8z/T1fpEtKgsnKANph7eqRHVHmjUDpHidx3BiTAArw07MVIq1LhAgMBAAECggEADJPDdjU4O6NMInTIDZP78eQuxD3C09iNK293IMUSQMPz840eUeeGN2O6w6+vp7oYoX3AQk7cTOI5x7VItqMIZXkAkwNJpzDTJlbPvj4bJgX7fMrshcZihXuFchDBqC53wunRx5lLPahNIypOC88FhVv8XHXSZxgiKh8ip0JuyhRS38TDVCcrIzKclsSY9CT3kYhVdPkfWEEGSb0qj7J4VxK7evE6yQD0/UJqB9j54Ts418DsEHNOZPDf6PFgNgl585AQZ3KpEUrfsx3rygLhUG+GQD+bkkDExA7vJlw5v1CF7Kr1T/XK9gjqRbRBjtzLy0MUe11ips3OM5LYkNv/EQKBgQDuWD+i64alAdXeReJAHWU8sQjZgmZYhlMhxfq8rsalJ490br3joZ2+KHXD7yDmvTUj0IFre99BcB7hi9Sx0joOjyS8+Rz7Bw02bdnwJbva5SYg3XojqdEoKGl5nFN67rL762jGsDG2Y5/hVEe/vxmH9sWB/OvQZ10If3p5OJ/jcwKBgQCtUnl1IWn57xHzqDqQEIMlCskGRXElMYdU/jtADLTt27DgSjzbgW5GgGMectvDDxYADYb93VUuTvz4EvHXAwo3CepDUjs4JtkGZeaAnMCER6doIyXPfRsxHMXRN4NgG70yEA5u7IfYFA1DuGLDwjddg4rU122ftqUM2UcwaaBjWwKBgQC9R9wRuFXPiOudf4Y0QKP7VOSgSAybVOGEOsPrQCmFUyt73c5zjg/Fyj/sAGXymGQxMw70mwUr5KzBldit9zQgB9G3OWaofGsjxI2FR5IuPjjPdNPgqqXt7FoHN/yb7iC6K7Ojxp1UKT35JoNsZYkTDwi/OGrVsKCTdRmAV1WyvQKBgBZD6Qxt/XI5DwJREyzcoixJBWgD1bQkd7Eoc64Xs8p2lXNKtiSwrNzrs0//C1I0huv80OGd5EptpTutG1o2rsJBSNHbJ3ZgLzMONh1Bhc24cr4C/eF4vdyCSLtGuV7IUXaz71a6lfzhHo8bibyCH6CovFX5UsDYsr1C0E1c1FjPAoGAXQ4hZ7/APQ/V1wmkZnplGchbXefqixvhDZWUvIAy6sAmypaRe3fRjd3SFLGXhOg48CQ59A0P3dQjKja8U7eQA6c6qw9Ci4F/cceHcdgnH6fOkqiHMdN6Sr0/SinbVP0kqU25y+AbRdJjwYZGTmWeqMdFUra+MVK9befn+hA3zAk=";
        
        //#pubKeyText
        private final static String pubKeyText = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoV5sWj7ekIPl04qmghtXGRCsBj2ysv0LOcRjceB6LZ4BlDNp/+RXWbUh2aHyVrDVFCqWWvgcp4TYNBNEJ+F66dFkovmeS4A3sE+w3gNG+QpMt/OjBFsHNdQLGvkrjIkeVxVI13VqzEF+RO8FUXG7qKuwPEAX5t4vBeD3TKJIZTL4sIS54Cjq1lSqGxPHMgNuSb9hWYMb9Tc1We88hmjutGuPV/zWgNqaHuTgfc1wX7GvJHx5dG/rDEDHd/Lla7QiKrNigAVuhBk06Hs5OeYvoR4O56jC7pu17cPM/09X6RLSoLJygDaYe3qkR1R5o1A6R4ncdwYkwAK8NOzFSKtS4QIDAQAB";
        
        private final static String CHARACTER_ENCODING_UTF_8 = "UTF-8";
        
        public static void main(String[] args) {
            
            String signString = "bijian 您好!";
            try {
                // 加签
                String localSignature = SignUtil.sign(priKeyText.getBytes(CHARACTER_ENCODING_UTF_8), signString);
                System.out.println(localSignature);
                //验签
                boolean verifyResult = SignUtil.verify(pubKeyText.getBytes(CHARACTER_ENCODING_UTF_8), signString, localSignature);
                System.out.println("verifyResult:" + verifyResult);
            } catch (Exception e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        }
        
        /**
         * RSA私钥加签
         * @param priKeyText经过base64处理后的私钥
         * @param plainText明文内容
         * @return 十六进制的签名字符串
         * @throws Exception 
         */
        public static String sign(byte[] priKeyText, String plainText) throws Exception {
            try {
                PKCS8EncodedKeySpec priPKCS8 = new PKCS8EncodedKeySpec(Base64.decodeBase64(priKeyText));
                KeyFactory keyf = KeyFactory.getInstance("RSA");
                PrivateKey prikey = keyf.generatePrivate(priPKCS8);
    
                // 用私钥对信息生成数字签名
                java.security.Signature signet = java.security.Signature.getInstance("SHA256withRSA");
                signet.initSign(prikey);
                signet.update(plainText.getBytes("UTF-8"));
                return DigestUtil.byte2hex(signet.sign());
            } catch (Exception e) {
                throw e; 
            }
        }
        
        /**
         * 公钥验签
         * @param pubKeyText经过base64处理后的公钥
         * @param plainText明文内容
         * @param signText十六进制的签名字符串
         * @return 验签结果 true验证一致 false验证不一致
         */
        public static boolean verify(byte[] pubKeyText, String plainText, String signText) {
            try {
                // 解密由base64编码的公钥,并构造X509EncodedKeySpec对象
                java.security.spec.X509EncodedKeySpec bobPubKeySpec = new java.security.spec.X509EncodedKeySpec(
                        Base64.decodeBase64(pubKeyText));
                // RSA算法
                java.security.KeyFactory keyFactory = java.security.KeyFactory.getInstance("RSA");
                // 取公钥匙对象
                java.security.PublicKey pubKey = keyFactory.generatePublic(bobPubKeySpec);
                // 十六进制数字签名转为字节
                byte[] signed = DigestUtil.hex2byte(signText.getBytes("UTF-8"));
                java.security.Signature signatureChecker = java.security.Signature.getInstance("SHA256withRSA");
                signatureChecker.initVerify(pubKey);
                signatureChecker.update(plainText.getBytes("UTF-8"));
                // 验证签名是否正常
                return signatureChecker.verify(signed);
            } catch (Throwable e) {
                return false;
            }
        }
    }

运行结果如下，验签通过。

![7018aa8e-e0e2-3edc-b403-5b69fff5182f.png][]

**2.将F:\\Key下生成公私钥验证加解密**

将F:\\Key下的testPub.key、testPri.key拷贝至工程中

![e99d676e-1694-3fbd-a4e0-9dc2b2d1f977.png][]

运行如下代码

package com.bijian.keystore;
    
    import java.io.FileInputStream;
    import java.io.IOException;
    import java.io.ObjectInputStream;
    import java.security.Key;
    
    import javax.crypto.Cipher;
    
    import sun.misc.BASE64Decoder;
    import sun.misc.BASE64Encoder;
    
    public class RSAUtil2 {
        
        /** 指定加密算法为RSA */
        private static final String ALGORITHM = "RSA";
        /** 指定公钥存放文件 */
        private static String PUBLIC_KEY_FILE = "testPub.key";
        /** 指定私钥存放文件 */
        private static String PRIVATE_KEY_FILE = "testPri.key";
    
        public static void main(String[] args) throws Exception {
            
            String source = "深圳，你好！";// 要加密的字符串
            System.out.println("准备用公钥加密的字符串为：" + source);
            
            String cryptograph = encrypt(source);// 生成的密文
            System.out.print("用公钥加密后的结果为:" + cryptograph);
            System.out.println();
           
            String target = decrypt(cryptograph);// 解密密文
            System.out.println("用私钥解密后的字符串为：" + target);
            System.out.println();   
        }
        
        /**
         * 加密方法
         * @param source 源数据
         * @return
         * @throws Exception
         */
        public static String encrypt(String source) throws Exception {
            
            Key publicKey = getKey(PUBLIC_KEY_FILE);
    
            /** 得到Cipher对象来实现对源数据的RSA加密 */
            Cipher cipher = Cipher.getInstance(ALGORITHM);
            cipher.init(Cipher.ENCRYPT_MODE, publicKey);
            byte[] b = source.getBytes();
            /** 执行加密操作 */
            byte[] b1 = cipher.doFinal(b);
            BASE64Encoder encoder = new BASE64Encoder();
            return encoder.encode(b1);
        }
    
        /**
         * 解密算法
         * @param cryptograph    密文
         * @return
         * @throws Exception
         */
        public static String decrypt(String cryptograph) throws Exception {
            
            Key privateKey = getKey(PRIVATE_KEY_FILE);
    
            /** 得到Cipher对象对已用公钥加密的数据进行RSA解密 */
            Cipher cipher = Cipher.getInstance(ALGORITHM);
            cipher.init(Cipher.DECRYPT_MODE, privateKey);
            BASE64Decoder decoder = new BASE64Decoder();
            byte[] b1 = decoder.decodeBuffer(cryptograph);
    
            /** 执行解密操作 */
            byte[] b = cipher.doFinal(b1);
            return new String(b);
        }
        
        private static Key getKey(String fileName) throws Exception, IOException {
            Key key;
            ObjectInputStream ois = null;
            try {
                /** 将文件中的私钥对象读出 */
                ois = new ObjectInputStream(new FileInputStream(fileName));
                key = (Key) ois.readObject();
            } catch (Exception e) {
                throw e;
            } finally {
                ois.close();
            }
            return key;
        }
    }

运行结果：

![f0f05636-fa79-3aeb-9f6b-8e5f5a7ef138.png][]

**附：sun.misc.BASE64Encoder找不到jar包的解决方法**

在MyEclipse中编写Java代码时，用到了BASE64Decoder，import sun.misc.BASE64Decoder；可是Eclipse提示：

Access restriction: The type BASE64Decoder is not accessible due to restriction on required library C:\\Program

files\\java\\jre6\\lib\\rt.jar

Access restriction : The constructor BASE64Decoder() is not accessible due to restriction on required library C:\\Program files\\java\\jre6\\lib\\rt.jar

![2c77c532-b8d7-34eb-afc6-0a9ade8b35e8.png][]  
解决方案1（推荐）：

只需要在project build path中先移除JRE System Library，再添加库JRE System Library，重新编译后就一切正常了。

解决方案2：

右键项目->属性->Java bulid path->jre System Library->access rules->resolution选择accessible，下面填上\*\*，点击确定即可！！！

参考文章：[http://jingyan.baidu.com/article/f3e34a12ad7acff5ea653569.html][http_jingyan.baidu.com_article_f3e34a12ad7acff5ea653569.html]

附阿里生成公私钥的链接：[https://docs.open.alipay.com/291/105971][https_docs.open.alipay.com_291_105971]

[983319d6-0f46-3a3a-8d3e-6a1cf20af3d3.png]: /images/20220411/66cc3a36747c48db9fcdbe9827b90963.png
[b038898c-4cc3-3d4e-bb94-1a6ad1199f67.png]: /images/20220411/9fa505f3c1464be6941199a5cf959d76.png
[a8d7d70c-834a-3167-8baa-dfe3176d814f.png]: /images/20220411/040382c9a2cc4b4583c6de652cd0ba26.png
[7018aa8e-e0e2-3edc-b403-5b69fff5182f.png]: /images/20220411/866f5b96f8cb486c9252b3e4f8583ca7.png
[e99d676e-1694-3fbd-a4e0-9dc2b2d1f977.png]: /images/20220411/915c7022adda484da6f35f20f1528d2d.png
[f0f05636-fa79-3aeb-9f6b-8e5f5a7ef138.png]: /images/20220411/8866fd889d4d4d27ac61802218bb01ec.png
[2c77c532-b8d7-34eb-afc6-0a9ade8b35e8.png]: /images/20220411/e29812ff427b42339b4dd5d49c29bf05.png
[http_jingyan.baidu.com_article_f3e34a12ad7acff5ea653569.html]: http://jingyan.baidu.com/article/f3e34a12ad7acff5ea653569.html
[https_docs.open.alipay.com_291_105971]: https://docs.open.alipay.com/291/105971