Java –数字签名示例

向右看齐 2023-02-15 05:12 14阅读 0赞

在[非对称密码示例中，][Link 1]我们讨论了密码中公钥对的使用。 公钥基础结构的另一个重要用途是在数字签名中。 数字签名是手写签名的数字等效形式，但有一个重要区别。 它们不是唯一的，而是作为信息的产物而来的。

> 有效的数字签名使收件人有理由相信该邮件是由已知的发件人创建的（ **身份验证** ），发件人不能否认已发送了该邮件（ **不可否认** ），并且该邮件在传输过程中未发生更改（ **完整性** ） 。 （来源： [维基百科][Link 2] ）

## 1.生成公私钥对 ##

生成公私钥对的代码与[非对称密码示例中][Link 1]使用的代码相同，请参考步骤1或在文章末尾下载源代码，其中包括所有源– `GenerateKeys.java`

![java-digital-signatures-1][]![java-digital-signatures-1][java-digital-signatures-1 1]

## 2.签署消息 ##

接下来，我们必须编写我们的消息，然后对其进行签名。 消息和签名可以是单独的文件，但是在我们的示例中，我们将它们添加到`byte[]`的`List` ，并将它们作为`Object`写入文件。

Message.java

package com.mkyong.sender;
    
    import java.io.File;
    import java.io.FileNotFoundException;
    import java.io.FileOutputStream;
    import java.io.IOException;
    import java.io.ObjectOutputStream;
    import java.nio.file.Files;
    import java.security.InvalidKeyException;
    import java.security.KeyFactory;
    import java.security.PrivateKey;
    import java.security.Signature;
    import java.security.spec.PKCS8EncodedKeySpec;
    import java.util.ArrayList;
    import java.util.List;
    
    import javax.swing.JOptionPane;
    
    public class Message {
    	private List<byte[]> list;
    	
    	//The constructor of Message class builds the list that will be written to the file. 
    	//The list consists of the message and the signature.
    	public Message(String data, String keyFile) throws InvalidKeyException, Exception {
    		list = new ArrayList<byte[]>();
    		list.add(data.getBytes());
    		list.add(sign(data, keyFile));
    	}
    	
    	//The method that signs the data using the private key that is stored in keyFile path
    	public byte[] sign(String data, String keyFile) throws InvalidKeyException, Exception{
    		Signature rsa = Signature.getInstance("SHA1withRSA"); 
    		rsa.initSign(getPrivate(keyFile));
    		rsa.update(data.getBytes());
    		return rsa.sign();
    	}
    	
    	//Method to retrieve the Private Key from a file
    	public PrivateKey getPrivate(String filename) throws Exception {
    		byte[] keyBytes = Files.readAllBytes(new File(filename).toPath());
    		PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);
    		KeyFactory kf = KeyFactory.getInstance("RSA");
    		return kf.generatePrivate(spec);
    	}
    	
    	//Method to write the List of byte[] to a file
    	private void writeToFile(String filename) throws FileNotFoundException, IOException {
    		File f = new File(filename);
    		f.getParentFile().mkdirs();
    		ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream(filename));
    	    out.writeObject(list);
    		out.close();
    		System.out.println("Your file is ready.");
    	}
    	
    	public static void main(String[] args) throws InvalidKeyException, IOException, Exception{
    		String data = JOptionPane.showInputDialog("Type your message here");
    		
    		new Message(data, "MyKeys/privateKey").writeToFile("MyData/SignedData.txt");
    	}
    }

输出：

![java-digital-signatures-2][]![java-digital-signatures-2][java-digital-signatures-2 1]

Your file is ready.

![java-digital-signatures-3][]![java-digital-signatures-3][java-digital-signatures-3 1]

## 3.验证签名 ##

接收者拥有文件*（他知道这是2 `byte arrays`的`List` ；消息和签名），*并想要验证消息是否来自具有预共享公共密钥的预期来源。

VerifyMessage.java

package com.mkyong.receiver;
    
    import java.io.File;
    import java.io.FileInputStream;
    import java.io.ObjectInputStream;
    import java.nio.file.Files;
    import java.security.KeyFactory;
    import java.security.PublicKey;
    import java.security.Signature;
    import java.security.spec.X509EncodedKeySpec;
    import java.util.List;
    
    public class VerifyMessage {
    	private List<byte[]> list;
    
    	@SuppressWarnings("unchecked")
    	//The constructor of VerifyMessage class retrieves the byte arrays from the File 
    	//and prints the message only if the signature is verified.
    	public VerifyMessage(String filename, String keyFile) throws Exception {
    		ObjectInputStream in = new ObjectInputStream(new FileInputStream(filename));
    	    this.list = (List<byte[]>) in.readObject();
    	    in.close();
    	    
    	    System.out.println(verifySignature(list.get(0), list.get(1), keyFile) ? "VERIFIED MESSAGE" + 
    	      "\n----------------\n" + new String(list.get(0)) : "Could not verify the signature.");	    
    	}
    	
    	//Method for signature verification that initializes with the Public Key, 
    	//updates the data to be verified and then verifies them using the signature
    	private boolean verifySignature(byte[] data, byte[] signature, String keyFile) throws Exception {
    		Signature sig = Signature.getInstance("SHA1withRSA");
    		sig.initVerify(getPublic(keyFile));
    		sig.update(data);
    		
    		return sig.verify(signature);
    	}
    	
    	//Method to retrieve the Public Key from a file
    	public PublicKey getPublic(String filename) throws Exception {
    		byte[] keyBytes = Files.readAllBytes(new File(filename).toPath());
    		X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
    		KeyFactory kf = KeyFactory.getInstance("RSA");
    		return kf.generatePublic(spec);
    	}
    	
    	public static void main(String[] args) throws Exception{
    		new VerifyMessage("MyData/SignedData.txt", "MyKeys/publicKey");
    	}
    }

输出：

VERIFIED MESSAGE
    ----------------
    Hello from mkyong.com!!

## 下载源代码 ##

> 下载– [digitalsignatures.zip][] （6 KB）

## 参考文献 ##

1.  [电子签名][Link 2]
2.  [生成和验证签名][Link 3]
3.  [Java –非对称密码示例][Link 1]

标记： [密码学][Link 4] [数字签名][Link 5] [Java安全性][Java] [公钥][Link 6]

> 翻译自: [https://mkyong.com/java/java-digital-signatures-example/][https_mkyong.com_java_java-digital-signatures-example]

[Link 1]: http://www.mkyong.com/java/java-asymmetric-cryptography-example/
[Link 2]: https://en.wikipedia.org/wiki/Digital_signature
[java-digital-signatures-1]: http://imgconvert.csdnimg.cn/aHR0cDovL3d3dy5ta3lvbmcuY29tL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDE3LzAxL2phdmEtZGlnaXRhbC1zaWduYXR1cmVzLTEucG5n?x-oss-process=image/format,png
[java-digital-signatures-1 1]: http://imgconvert.csdnimg.cn/aHR0cHM6Ly93d3cubWt5b25nLmNvbS93cC1jb250ZW50L3VwbG9hZHMvMjAxNy8wMS9qYXZhLWRpZ2l0YWwtc2lnbmF0dXJlcy0xLnBuZw?x-oss-process=image/format,png
[java-digital-signatures-2]: http://imgconvert.csdnimg.cn/aHR0cDovL3d3dy5ta3lvbmcuY29tL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDE3LzAxL2phdmEtZGlnaXRhbC1zaWduYXR1cmVzLTIucG5n?x-oss-process=image/format,png
[java-digital-signatures-2 1]: http://imgconvert.csdnimg.cn/aHR0cHM6Ly93d3cubWt5b25nLmNvbS93cC1jb250ZW50L3VwbG9hZHMvMjAxNy8wMS9qYXZhLWRpZ2l0YWwtc2lnbmF0dXJlcy0yLnBuZw?x-oss-process=image/format,png
[java-digital-signatures-3]: http://imgconvert.csdnimg.cn/aHR0cDovL3d3dy5ta3lvbmcuY29tL3dwLWNvbnRlbnQvdXBsb2Fkcy8yMDE3LzAxL2phdmEtZGlnaXRhbC1zaWduYXR1cmVzLTMucG5n?x-oss-process=image/format,png
[java-digital-signatures-3 1]: http://imgconvert.csdnimg.cn/aHR0cHM6Ly93d3cubWt5b25nLmNvbS93cC1jb250ZW50L3VwbG9hZHMvMjAxNy8wMS9qYXZhLWRpZ2l0YWwtc2lnbmF0dXJlcy0zLnBuZw?x-oss-process=image/format,png
[digitalsignatures.zip]: http://www.mkyong.com/wp-content/uploads/2017/01/DigitalSignatures.zip
[Link 3]: https://docs.oracle.com/javase/tutorial/security/apisign/
[Link 4]: https://mkyong.com/tag/cryptography/
[Link 5]: https://mkyong.com/tag/digital-signature/
[Java]: https://mkyong.com/tag/java-security/
[Link 6]: https://mkyong.com/tag/public-key/
[https_mkyong.com_java_java-digital-signatures-example]: https://mkyong.com/java/java-digital-signatures-example/