android簽名

轉載時請註明出處和作者聯繫方式
文章出處：http://www.limodev.cn/blog
作者聯繫方式：李先靜 <xianjimli at hotmail dot com>

昨天看了一下Android中的簽名機制，這裏介紹一下Android中籤名用的Key的產生方法和簽名的原理。

產生Key

o 產生RSA私鑰(private key)
openssl genrsa -3 -out testkey.pem 2048

-3 是算法的參數（public exponent）。
2048 是私鑰長度。
testkey.pem 是輸出的文件。

o 產生PKCS#10格式的認證請求。所謂認證請求就是發給認證機構認證的一個請求，它主要包括一個公鑰和一些相關信息(如組織名稱和聯繫人郵件地址)。
openssl req -new -x509 -key testkey.pem -out testkey.x509.pem -days 10000 /
-subj ‘/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]’

如果不提供最後兩個參數，openssl會提示你輸入相關信息，這裏的信息可以根據你自己的實際情況填寫。如：

openssl req -new -x509 -key testkey.pem -out testkey.x509.pem -days 10000

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:GuangDong
Locality Name (eg, city) [Newbury]:ShenZhen
Organization Name (eg, company) [My Company Ltd]:Topwise
Organizational Unit Name (eg, section) []:Broncho
Common Name (eg, your name or your server’s hostname) []:broncho.cn
Email Address []:[email protected]

o 把私鑰的格式轉換成PKCS #8（Private-Key Information Syntax Standard.）

openssl pkcs8 -in testkey.pem -topk8 -outform DER -out testkey.pk8 -nocrypt

私鑰是不能讓別人知道的，否則就起不到保密的作用了。私鑰通常是要加密保存的，但這裏指定了-nocryp，表示不加密。

Android提供了一個腳本mkkey.sh用來簡化上面的步驟：

if ["$1" == ""]; then
   echo "Create a test certificate key."
   echo "Usage: $0 NAME"
   echo "Will generate NAME.pk8 and NAME.x509.pem"
   echo "  /C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]"
   return
fi

openssl genrsa -3 -out $1.pem 2048

openssl req -new -x509 -key $1.pem -out $1.x509.pem -days 10000 /
   -subj '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]'

openssl pkcs8 -in $1.pem -topk8 -outform DER -out $1.pk8 -nocrypt