DH
Diffie-Hellman算法(D-H算法),密鑰一致協議。是由公開密鑰密碼體制的奠基人Diffie和Hellman所提出的一種思想。簡單的說就是允許兩名用戶在公開媒體上交換信息以生成"一致"的、可以共享的密鑰。換句話說,就是由甲方產出一對密鑰(公鑰、私鑰),乙方依照甲方公鑰產生乙方密鑰對(公鑰、私鑰)。以此爲基線,作爲數據傳輸保密基礎,同時雙方使用同一種對稱加密算法構建本地密鑰(SecretKey)對數據加密。這樣,在互通了本地密鑰(SecretKey)算法後,甲乙雙方公開自己的公鑰,使用對方的公鑰和剛纔產生的私鑰加密數據,同時可以使用對方的公鑰和自己的私鑰對數據解密。不單單是甲乙雙方兩方,可以擴展爲多方共享數據通訊,這樣就完成了網絡交互數據的安全通訊!該算法源於中國的同餘定理——中國餘數定理。
流程分析:
1.甲方構建密鑰對兒,將公鑰公佈給乙方,將私鑰保留;雙方約定數據加密算法;乙方通過甲方公鑰構建密鑰對兒,將公鑰公佈給甲方,將私鑰保留。
2.甲方使用私鑰、乙方公鑰、約定數據加密算法構建本地密鑰,然後通過本地密鑰加密數據,發送給乙方加密後的數據;乙方使用私鑰、甲方公鑰、約定數據加密算法構建本地密鑰,然後通過本地密鑰對數據解密。
3.乙方使用私鑰、甲方公鑰、約定數據加密算法構建本地密鑰,然後通過本地密鑰加密數據,發送給甲方加密後的數據;甲方使用私鑰、乙方公鑰、約定數據加密算法構建本地密鑰,然後通過本地密鑰對數據解密。
通過java代碼實現如下:Coder類見 Java加密技術(一)
- import java.security.Key;
- import java.security.KeyFactory;
- import java.security.KeyPair;
- import java.security.KeyPairGenerator;
- import java.security.PublicKey;
- import java.security.spec.PKCS8EncodedKeySpec;
- import java.security.spec.X509EncodedKeySpec;
- import java.util.HashMap;
- import java.util.Map;
- import javax.crypto.Cipher;
- import javax.crypto.KeyAgreement;
- import javax.crypto.SecretKey;
- import javax.crypto.interfaces.DHPrivateKey;
- import javax.crypto.interfaces.DHPublicKey;
- import javax.crypto.spec.DHParameterSpec;
- /**
- * DH安全編碼組件
- *
- * @author 樑棟
- * @version 1.0
- * @since 1.0
- */
- public abstract class DHCoder extends Coder {
- public static final String ALGORITHM = "DH";
- /**
- * 默認密鑰字節數
- *
- * <pre>
- * DH
- * Default Keysize 1024
- * Keysize must be a multiple of 64, ranging from 512 to 1024 (inclusive).
- * </pre>
- */
- private static final int KEY_SIZE = 1024;
- /**
- * DH加密下需要一種對稱加密算法對數據加密,這裏我們使用DES,也可以使用其他對稱加密算法。
- */
- public static final String SECRET_ALGORITHM = "DES";
- private static final String PUBLIC_KEY = "DHPublicKey";
- private static final String PRIVATE_KEY = "DHPrivateKey";
- /**
- * 初始化甲方密鑰
- *
- * @return
- * @throws Exception
- */
- public static Map<String, Object> initKey() throws Exception {
- KeyPairGenerator keyPairGenerator = KeyPairGenerator
- .getInstance(ALGORITHM);
- keyPairGenerator.initialize(KEY_SIZE);
- KeyPair keyPair = keyPairGenerator.generateKeyPair();
- // 甲方公鑰
- DHPublicKey publicKey = (DHPublicKey) keyPair.getPublic();
- // 甲方私鑰
- DHPrivateKey privateKey = (DHPrivateKey) keyPair.getPrivate();
- Map<String, Object> keyMap = new HashMap<String, Object>(2);
- keyMap.put(PUBLIC_KEY, publicKey);
- keyMap.put(PRIVATE_KEY, privateKey);
- return keyMap;
- }
- /**
- * 初始化乙方密鑰
- *
- * @param key
- * 甲方公鑰
- * @return
- * @throws Exception
- */
- public static Map<String, Object> initKey(String key) throws Exception {
- // 解析甲方公鑰
- byte[] keyBytes = decryptBASE64(key);
- X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(keyBytes);
- KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);
- PublicKey pubKey = keyFactory.generatePublic(x509KeySpec);
- // 由甲方公鑰構建乙方密鑰
- DHParameterSpec dhParamSpec = ((DHPublicKey) pubKey).getParams();
- KeyPairGenerator keyPairGenerator = KeyPairGenerator
- .getInstance(keyFactory.getAlgorithm());
- keyPairGenerator.initialize(dhParamSpec);
- KeyPair keyPair = keyPairGenerator.generateKeyPair();
- // 乙方公鑰
- DHPublicKey publicKey = (DHPublicKey) keyPair.getPublic();
- // 乙方私鑰
- DHPrivateKey privateKey = (DHPrivateKey) keyPair.getPrivate();
- Map<String, Object> keyMap = new HashMap<String, Object>(2);
- keyMap.put(PUBLIC_KEY, publicKey);
- keyMap.put(PRIVATE_KEY, privateKey);
- return keyMap;
- }
- /**
- * 加密<br>
- *
- * @param data
- * 待加密數據
- * @param publicKey
- * 甲方公鑰
- * @param privateKey
- * 乙方私鑰
- * @return
- * @throws Exception
- */
- public static byte[] encrypt(byte[] data, String publicKey,
- String privateKey) throws Exception {
- // 生成本地密鑰
- SecretKey secretKey = getSecretKey(publicKey, privateKey);
- // 數據加密
- Cipher cipher = Cipher.getInstance(secretKey.getAlgorithm());
- cipher.init(Cipher.ENCRYPT_MODE, secretKey);
- return cipher.doFinal(data);
- }
- /**
- * 解密<br>
- *
- * @param data
- * 待解密數據
- * @param publicKey
- * 乙方公鑰
- * @param privateKey
- * 乙方私鑰
- * @return
- * @throws Exception
- */
- public static byte[] decrypt(byte[] data, String publicKey,
- String privateKey) throws Exception {
- // 生成本地密鑰
- SecretKey secretKey = getSecretKey(publicKey, privateKey);
- // 數據解密
- Cipher cipher = Cipher.getInstance(secretKey.getAlgorithm());
- cipher.init(Cipher.DECRYPT_MODE, secretKey);
- return cipher.doFinal(data);
- }
- /**
- * 構建密鑰
- *
- * @param publicKey
- * 公鑰
- * @param privateKey
- * 私鑰
- * @return
- * @throws Exception
- */
- private static SecretKey getSecretKey(String publicKey, String privateKey)
- throws Exception {
- // 初始化公鑰
- byte[] pubKeyBytes = decryptBASE64(publicKey);
- KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);
- X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(pubKeyBytes);
- PublicKey pubKey = keyFactory.generatePublic(x509KeySpec);
- // 初始化私鑰
- byte[] priKeyBytes = decryptBASE64(privateKey);
- PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(priKeyBytes);
- Key priKey = keyFactory.generatePrivate(pkcs8KeySpec);
- KeyAgreement keyAgree = KeyAgreement.getInstance(keyFactory
- .getAlgorithm());
- keyAgree.init(priKey);
- keyAgree.doPhase(pubKey, true);
- // 生成本地密鑰
- SecretKey secretKey = keyAgree.generateSecret(SECRET_ALGORITHM);
- return secretKey;
- }
- /**
- * 取得私鑰
- *
- * @param keyMap
- * @return
- * @throws Exception
- */
- public static String getPrivateKey(Map<String, Object> keyMap)
- throws Exception {
- Key key = (Key) keyMap.get(PRIVATE_KEY);
- return encryptBASE64(key.getEncoded());
- }
- /**
- * 取得公鑰
- *
- * @param keyMap
- * @return
- * @throws Exception
- */
- public static String getPublicKey(Map<String, Object> keyMap)
- throws Exception {
- Key key = (Key) keyMap.get(PUBLIC_KEY);
- return encryptBASE64(key.getEncoded());
- }
- }
再給出一個測試類:
- import static org.junit.Assert.*;
- import java.util.Map;
- import org.junit.Test;
- /**
- *
- * @author 樑棟
- * @version 1.0
- * @since 1.0
- */
- public class DHCoderTest {
- @Test
- public void test() throws Exception {
- // 生成甲方密鑰對兒
- Map<String, Object> aKeyMap = DHCoder.initKey();
- String aPublicKey = DHCoder.getPublicKey(aKeyMap);
- String aPrivateKey = DHCoder.getPrivateKey(aKeyMap);
- System.err.println("甲方公鑰:\r" + aPublicKey);
- System.err.println("甲方私鑰:\r" + aPrivateKey);
- // 由甲方公鑰產生本地密鑰對兒
- Map<String, Object> bKeyMap = DHCoder.initKey(aPublicKey);
- String bPublicKey = DHCoder.getPublicKey(bKeyMap);
- String bPrivateKey = DHCoder.getPrivateKey(bKeyMap);
- System.err.println("乙方公鑰:\r" + bPublicKey);
- System.err.println("乙方私鑰:\r" + bPrivateKey);
- String aInput = "abc ";
- System.err.println("原文: " + aInput);
- // 由甲方公鑰,乙方私鑰構建密文
- byte[] aCode = DHCoder.encrypt(aInput.getBytes(), aPublicKey,
- bPrivateKey);
- // 由乙方公鑰,甲方私鑰解密
- byte[] aDecode = DHCoder.decrypt(aCode, bPublicKey, aPrivateKey);
- String aOutput = (new String(aDecode));
- System.err.println("解密: " + aOutput);
- assertEquals(aInput, aOutput);
- System.err.println(" ===============反過來加密解密================== ");
- String bInput = "def ";
- System.err.println("原文: " + bInput);
- // 由乙方公鑰,甲方私鑰構建密文
- byte[] bCode = DHCoder.encrypt(bInput.getBytes(), bPublicKey,
- aPrivateKey);
- // 由甲方公鑰,乙方私鑰解密
- byte[] bDecode = DHCoder.decrypt(bCode, aPublicKey, bPrivateKey);
- String bOutput = (new String(bDecode));
- System.err.println("解密: " + bOutput);
- assertEquals(bInput, bOutput);
- }
- }
控制檯輸出:
- 甲方公鑰:
- MIHfMIGXBgkqhkiG9w0BAwEwgYkCQQD8poLOjhLKuibvzPcRDlJtsHiwXt7LzR60ogjzrhYXrgHz
- W5Gkfm32NBPF4S7QiZvNEyrNUNmRUb3EPuc3WS4XAkBnhHGyepz0TukaScUUfbGpqvJE8FpDTWSG
- kx0tFCcbnjUDC3H9c9oXkGmzLik1Yw4cIGI1TQ2iCmxBblC+eUykAgIBgANDAAJAdAWBVmIzqcko
- Ej6qFjLDL2+Y3FPq1iRbnOyOpDj71yKaK1K+FhTv04B0zy4DKcvAASV7/Gv0W+bgqdmffRkqrQ==
- 甲方私鑰:
- MIHRAgEAMIGXBgkqhkiG9w0BAwEwgYkCQQD8poLOjhLKuibvzPcRDlJtsHiwXt7LzR60ogjzrhYX
- rgHzW5Gkfm32NBPF4S7QiZvNEyrNUNmRUb3EPuc3WS4XAkBnhHGyepz0TukaScUUfbGpqvJE8FpD
- TWSGkx0tFCcbnjUDC3H9c9oXkGmzLik1Yw4cIGI1TQ2iCmxBblC+eUykAgIBgAQyAjACJRfy1LyR
- eHyD+4Hfb+xR0uoIGR1oL9i9Nk6g2AAuaDPgEVWHn+QXID13yL/uDos=
- 乙方公鑰:
- MIHfMIGXBgkqhkiG9w0BAwEwgYkCQQD8poLOjhLKuibvzPcRDlJtsHiwXt7LzR60ogjzrhYXrgHz
- W5Gkfm32NBPF4S7QiZvNEyrNUNmRUb3EPuc3WS4XAkBnhHGyepz0TukaScUUfbGpqvJE8FpDTWSG
- kx0tFCcbnjUDC3H9c9oXkGmzLik1Yw4cIGI1TQ2iCmxBblC+eUykAgIBgANDAAJAVEYSfBA+I9nr
- dWw3OBv475C+eBrWBBYqt0m6/eu4ptuDQHwV4MmUtKAC2wc2nNrdb1wmBhY1X8RnWkJ1XmdDbQ==
- 乙方私鑰:
- MIHSAgEAMIGXBgkqhkiG9w0BAwEwgYkCQQD8poLOjhLKuibvzPcRDlJtsHiwXt7LzR60ogjzrhYX
- rgHzW5Gkfm32NBPF4S7QiZvNEyrNUNmRUb3EPuc3WS4XAkBnhHGyepz0TukaScUUfbGpqvJE8FpD
- TWSGkx0tFCcbnjUDC3H9c9oXkGmzLik1Yw4cIGI1TQ2iCmxBblC+eUykAgIBgAQzAjEAqaZiCdXp
- 2iNpdBlHRaO9ir70wo2n32xNlIzIX19VLSPCDdeUWkgRv4CEj/8k+/yd
- 原文: abc
- 解密: abc
- ===============反過來加密解密==================
- 原文: def
- 解密: def
如我所言,甲乙雙方在獲得對方公鑰後可以對發送給對方的數據加密,同時也能對接收到的數據解密,達到了數據安全通信的目的!
轉載自:http://snowolf.iteye.com/blog/382422