java 数字签名

梦里梦外; 2022-06-15 04:21 185阅读 0赞

> 慕课网学习笔记  
> 参考：[java加密算法][java]

--------------------

*   *   *  RSA
         *  DSA算法
         *  ECDSA

--------------------

数字签名是带有密钥（公钥、私钥）的消息摘要算法。主要作用是验证数据的完整性、认证数据来源、抗否认。在数字签名的实现中我们使用私钥签名、公钥验证。常用的数字签名算法包括RSA、DSA、ECDSA。

### RSA ###

该算法是数字签名的经典算法。主要包括MD和SHA两类。

![这里写图片描述][301409149825928.jpg]

Java实现RSA数字签名如下：

package rsa2;
    
    import java.security.KeyFactory;
    import java.security.KeyPair;
    import java.security.KeyPairGenerator;
    import java.security.PrivateKey;
    import java.security.PublicKey;
    import java.security.Signature;
    import java.security.interfaces.RSAPrivateKey;
    import java.security.interfaces.RSAPublicKey;
    import java.security.spec.PKCS8EncodedKeySpec;
    import java.security.spec.X509EncodedKeySpec;
    
    import org.apache.commons.codec.binary.Hex;
    
    public class JavaRSA {
    
        private static String src = "What can I do for you?";
    
        public static void main(String[] args) throws Exception {
            jdkRSA();
        }
    
        public static void jdkRSA() throws Exception{
    
            //1.初始化密钥
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
            keyPairGenerator.initialize(512);
            KeyPair keyPair = keyPairGenerator.generateKeyPair();
            RSAPublicKey rsaPublicKey = (RSAPublicKey) keyPair.getPublic();
            RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) keyPair.getPrivate();
    
            //2.执行数字签名【私钥签名】
            PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(rsaPrivateKey.getEncoded());
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);
            Signature signature = Signature.getInstance("MD5WithRSA");
            signature.initSign(privateKey);
            signature.update(src.getBytes());
            byte[] result = signature.sign();
            System.out.println("JDK RSA签名：" + Hex.encodeHexString(result));
    
            //3.验证签名【公钥验证】
            X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(rsaPublicKey.getEncoded());
            keyFactory = KeyFactory.getInstance("RSA");
            PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);
            signature = Signature.getInstance("MD5WithRSA");
            signature.initVerify(publicKey);
            signature.update(src.getBytes());
            boolean bool = signature.verify(result);
            System.out.println("数字签名是否有效？" + bool);
        }
    }

运行结果：  
![这里写图片描述][301431348736138.jpg]

![这里写图片描述][301431468896677.jpg]

### DSA算法 ###

DSS（Digital Signature Standard），数字签名标准，通过这个标准逐步形成了DSA（Digital Signature Algorithm），数字签名算算法。DSA仅仅包括数字签名，不能进行加解密。实现方式如下：

![这里写图片描述][301439239514145.jpg]

该算法到的实现和RSA数字签名的实现大同小异（只是在细节参数方面存在很少的差别）。见如下：

package dsa;
    
    import java.security.KeyFactory;
    import java.security.KeyPair;
    import java.security.KeyPairGenerator;
    import java.security.PrivateKey;
    import java.security.PublicKey;
    import java.security.Signature;
    import java.security.interfaces.DSAPrivateKey;
    import java.security.interfaces.DSAPublicKey;
    import java.security.spec.PKCS8EncodedKeySpec;
    import java.security.spec.X509EncodedKeySpec;
    
    import org.apache.commons.codec.binary.Hex;
    
    public class JavaDSA {
    
        private static String src = "Can I help you?";
    
        public static void main(String[] args) throws Exception {
            jdkDSA();
        }
    
        public static void jdkDSA() throws Exception{
    
            //1.初始化密钥
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("DSA");
            keyPairGenerator.initialize(512);
            KeyPair keyPair = keyPairGenerator.generateKeyPair();
            DSAPublicKey dsaPublicKey = (DSAPublicKey) keyPair.getPublic();
            DSAPrivateKey dsaPrivateKey = (DSAPrivateKey) keyPair.getPrivate();
    
            //2.执行签名【私钥签名】
            PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(dsaPrivateKey.getEncoded());
            KeyFactory keyFactory = KeyFactory.getInstance("DSA");
            PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);
            Signature signature = Signature.getInstance("SHA1WithDSA");
            signature.initSign(privateKey);
            signature.update(src.getBytes());
            byte[] result = signature.sign();
            System.out.println("JDK实现DSA数字签名：" + Hex.encodeHexString(result));
    
            //3.验证签名【公钥验证】
            X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(dsaPublicKey.getEncoded());
            keyFactory = KeyFactory.getInstance("DSA");
            PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);
            signature = Signature.getInstance("SHA1WithDSA");
            signature.initVerify(publicKey);
            signature.update(src.getBytes());
            boolean bool = signature.verify(result);
            System.out.println("数字签名有效？" + bool);
        }
    }

程序运行结果：  
![这里写图片描述][301457337796527.jpg]

### ECDSA ###

微软的Office、Windows操作系统的验证就是ECDSA算法——椭圆曲线数字签名算法（Elliptic Curve Digital Signature Algorithm），在2000年的时候称为了ANSI和IEEE的标准。特点是：速度快、签名短、强度高。在JDK1.7update4之后提供了对ECDSA的支持。该签名的算法也和RSA的数字签名算法也是大同小异。  
![这里写图片描述][301518397019239.jpg]

package ecdsa;
    
    import java.security.KeyFactory;
    import java.security.KeyPair;
    import java.security.KeyPairGenerator;
    import java.security.PrivateKey;
    import java.security.PublicKey;
    import java.security.Signature;
    import java.security.interfaces.ECPrivateKey;
    import java.security.interfaces.ECPublicKey;
    import java.security.spec.PKCS8EncodedKeySpec;
    import java.security.spec.X509EncodedKeySpec;
    
    import org.apache.commons.codec.binary.Hex;
    
    public class JavaECDSA {
    
        private static String src = "Hello,Objective C!";
    
        public static void main(String[] args) throws Exception {
            jdkECDSA();
        }
    
        public static void jdkECDSA() throws Exception{
    
            //1.初始化密钥
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");//参数是EC
            keyPairGenerator.initialize(256);
            KeyPair keyPair = keyPairGenerator.generateKeyPair();
            ECPublicKey ecPublicKey = (ECPublicKey) keyPair.getPublic();
            ECPrivateKey ecPrivateKey = (ECPrivateKey) keyPair.getPrivate();
    
            //2.执行签名【私钥签名】
            PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(ecPrivateKey.getEncoded());
            KeyFactory keyFactory = KeyFactory.getInstance("EC");
            PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);
            Signature signature = Signature.getInstance("SHA1WithECDSA");
            signature.initSign(privateKey);
            signature.update(src.getBytes());//需要签名的字符串
            byte[] result = signature.sign();
            System.out.println("ECDSA签名：" + Hex.encodeHexString(result));
    
            //3.验证签名【公钥验证】
            X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(ecPublicKey.getEncoded());
            keyFactory = KeyFactory.getInstance("EC");
            PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);
            signature = Signature.getInstance("SHA1WithECDSA");
            signature.initVerify(publicKey);
            signature.update(src.getBytes());
            boolean bool = signature.verify(result);
            System.out.println("签名的验证结果：" + bool);
        }
    
    }

运行结果：  
![这里写图片描述][301518249351430.jpg]

最后附上一系列Java加密的项目地址（包括Base64、对称加密、非对称加密、消息摘要和数字签名）。本文所需的jar文件在项目的lib目录中，jdk无政策访问限制文件在项目的ext目录下。

[https://git.oschina.net/gaopengfei/Java\_Security.git][https_git.oschina.net_gaopengfei_Java_Security.git]

[java]: http://www.cnblogs.com/happyfans/p/4374919.html
[301409149825928.jpg]: /images/20220615/c0145fa9573949a8b57d3653dd90660e.png
[301431348736138.jpg]: /images/20220615/99e126a55a124051b27b77bc0ae46c3c.png
[301431468896677.jpg]: /images/20220615/34fba7d7840d4b369b704e7a36123b46.png
[301439239514145.jpg]: /images/20220615/489217fc43b747459daa7eac68332f3a.png
[301457337796527.jpg]: /images/20220615/feb3841dd05a46788157a652f2e9da72.png
[301518397019239.jpg]: /images/20220615/fed4798bae6c490f88847a3e068f7a65.png
[301518249351430.jpg]: /images/20220615/a6e1dfd59c5b4c4ebafcfec4604918c5.png
[https_git.oschina.net_gaopengfei_Java_Security.git]: https://git.oschina.net/gaopengfei/Java_Security.git