安全系列之——RAS的公钥私钥有多少人能分的清楚？RAS的签名验签与加密解密如何使用公私钥？

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在对接很多的互联网公司的开发平台时，这些互联网公司未来自身平台的安全，都会需要调用方签名确认调用方的身份是合法的，同时未来信息网络传输的安全可能还需要加密解密。比如对接支付宝、微信开放平台时，需要配置公钥并下载平台的公钥，后续调用方就需要对请求的报文进行签名，支付宝、微信收到请求后需要验签，只有身份验证通过才能执行相关的业务流程。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在实际的开发过程中，有很多人分不清什么是公钥什么是私钥，如何进行签名验签及加密解密，以及签名验签与加密解密有什么关系。这一期我们就来详细说说这个问题。关于RSA的算法请参考我的文章《安全系列之——RAS的前世今生》，加密解密可以参考我的文章《安全系列之——手写JAVA加密、解密》。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"一、公钥私钥"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在之前的文章《安全系列之——手写JAVA加密、解密》中，介绍了对称加密和非对称加密。其中非对称加密使用的是RAS算法，所谓的非对称，指的是，加密时使用的秘钥和解密时使用的秘钥是不一样的。也就是说RSA有一对秘钥，其中一个是公钥，另一个是私钥，一个用于加密，一个用于解密。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"RAS算法的两个应用是签名验签、加密解密。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/11/115a59286a4ba71e7f96df6ca5c3a821.png","alt":"公钥交换前","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在网络通讯过程中，通讯之前，调用方和被调用方都需要生成一对公私钥；然后调用方和被调用方之间交互公钥；这样调用方和被调用方都拥有自己的私钥和对方的公钥，这是双方通讯为了通讯安全就可以做签名验签和加密解密了。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/bb/bb862b0c0ecc9f934783f07c96047005.png","alt":"公钥交换后","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私钥只能自己拥有，不能暴露给任何人，只要私钥不暴露，通讯就是安全的。私钥可以等同于身份。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公钥可以被任何人获取。获取到对方的公钥，就可以通过公钥验证对方的签名；同时使用对方的公钥加密，也只能被对方的私钥解密。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"因为公钥是公开的，也为通讯双方的公钥交互提供了便利，不用在考虑交互时是否泄漏了。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"二、签名验签与加密解密的关系"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"首先强调一点，"},{"type":"text","marks":[{"type":"strong"}],"text":"签名验签与加密解密"},{"type":"text","text":"之间没有关系。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"签名验签与加密解密都是为了系统安全而做的必要措施，但是是为了防范不同的安全风险。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"签名验签"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"签名验签：是为了验证用户身份是否是合法。比如微信支付，任何合法的商户都可以调用微信支付接口。那么什么是合法商户呢？满足微信的很多要求，比如商户注册微信商户平台获得商户id、签约相关的支付产品获得appid、给开通的支付产品配置商户的公钥并下载微信的公钥，这样的商户对微信来说才是合法的。然后商户使用自己的"},{"type":"text","marks":[{"type":"strong"}],"text":"商户私钥"},{"type":"text","text":"对相关的请求参数进行签名后调用微信的支付接口；微信收到请求后通过商户配置在平台的"},{"type":"text","marks":[{"type":"strong"}],"text":"商户公钥"},{"type":"text","text":"对这个请求进行验签，验签通过说明这个次请求时一个合法的平台商户发起的，验签通过后就可以做具体的支付业务了。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/87/872403f59b3b76a5fc52f139c1cf63d7.png","alt":"签名验签","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"签名为什么用调用方的私钥？签名通常是"},{"type":"text","marks":[{"type":"strong"}],"text":"被调用方"},{"type":"text","text":"（平台）考虑到自身安全要求调用方做签名，从而验证调用方是否合法。考虑的是被调用方的安全。因为合法的商户已经将自己的公钥配置到微信后台了，当一个调用者将加签名的参数传到微信平台，而微信平台恰好能用这个商户配置的公钥验签通过，说明发请求的人就是持有这个私钥的合法商户，因为只有持这个私钥的商户才能做出这个签名，私钥是保密的，不是每个人都有。如果签名使用的是公钥，公钥人人都可以从网上获取，一个非法的调用者也可以获得这个公钥并签名向微信发请求，即使微信平台验签通过也不知道这个调用者是否合法。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"加密解密"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"加密解密：是为了防止数据在网络传输中被人劫持。假如商户调用微信的支付接口时，请求报文中的有很多敏感字段比如银行卡号、密码等（实际不需要这些字段），当报文在网络上传输时，被人恶意监听，就会导致商户的银行卡号和密码泄露，所以商户在调用时就需要使用"},{"type":"text","marks":[{"type":"strong"}],"text":"微信公钥"},{"type":"text","text":"对整个报文进行加密；微信收到请求后，就可以使用"},{"type":"text","marks":[{"type":"strong"}],"text":"微信私钥"},{"type":"text","text":"进行解密，这样就可以防止敏感信息泄露了。当然https已经在传输的时候加密了。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/74/74092ad9a78ec00e450c0618e7b91e20.png","alt":"加密解密","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"加密为什么用对方的公钥？加密通常是"},{"type":"text","marks":[{"type":"strong"}],"text":"调用方"},{"type":"text","text":"（商户）考虑自身安全，保证调用方的敏感信息不被泄露而做的，保证只有真正的被调用方才能解密。如何保证呢？也就是即使信息在网络传输中被劫持了，也不能解密。要想解密，必须持有秘钥，要想唯一持有秘钥，那就必须是私钥，因为私钥是不对外公开的。能解密，说明这个信息就是发生给他的。所以，信息发给谁，就只能用谁的私钥才能解密，这就必须要求发送方使用他的公钥加密了。信息要发给微信平台，就必须用微信平台的公钥加密。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"这里签名验签与加密解密使用的是不同的公私钥。签名时，站在被调用方（微信平台）的角度看，微信要求谁调用微信平台，谁使用自己的私钥做签名；解密时，站在调用方（商户）的角度看，商户把信息发给谁，谁才能使用自己的私钥解密。因为私钥只有自己持有，私钥可以和合法用户划等号。而公钥是全网公开的，谁都能获取。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"总结："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"签名：A调用B时，B要验证A是否合法（是否能调用接口），A必须使用自己的私钥签名；"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"解密：A调用B时，A要验证B是否合法（是否能解密），B必须使用自己的私钥解密；"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"三、测试"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"这里模拟A给B发消息的过程，测试前，A生成一对公私钥，B生成一对公私钥，然后A和B交互公钥，A拥有 privateKey"},{"type":"text","marks":[{"type":"italic"}],"text":"A 和publicKey"},{"type":"text","text":"B，B拥有privateKey"},{"type":"text","marks":[{"type":"italic"}],"text":"B和publicKey"},{"type":"text","text":"A。这里只模拟单向（A请求B）的签名验签和加密解密，有兴趣的可以自己模拟双向的（A请求B，以及B响应A）签名验签和加密解密。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"关于公私钥的生成可以参考之前的文章《安全系列之——手写JAVA加密、解密》。关注公众号，输入关键字“"},{"type":"text","marks":[{"type":"strong"}],"text":"java-summary"},{"type":"text","text":"”，即可获得源码。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":"java"},"content":[{"type":"text","text":"\n/**\n * Description:\n *\n * @author 诸葛小猿\n * @date 2020-08-21\n */\n@Slf4j\npublic class SignAndEncryptTest {\n\n public static final String SIGN_ALGORITHMS = \"SHA1WithRSA\";\n public static final String CHATSET = \"utf-8\";\n\n public static String publicKey_A = \"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsnen01CdQc2zh/HihCNNYI6u7AFXf/NrZ/9auPvFsJcK1cWj5EFBU3lrts2OTvrmYVurhABg2g/Ya7glzUt6DwUojHOWtpwFxSH1v7FUJMvxDsbd4GXKRdWqMkqkcCMQYDpGpshbL3IAWYIw6pgnBcKksbzkDrZCZMAyHa1bB3zh5uEm9mcrRlBUGirbPNVt++3ztIfdc4Vp5hbw++daNMFr/VGDohMVg3Dlk4ZktDgHc5nakXkE8hSr6UDTw45JpfZZ0dP9XTi/CSVQdoYD+dsJIZ8uletlbrErRfZEJNx/k0w88P4kfGteNBGhlzzVo45tMkHT33O8QB6JxI4xVQIDAQAB\";\n public static String privateKey_A = \"MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCyd6fTUJ1BzbOH8eKEI01gjq7sAVd/82tn/1q4+8WwlwrVxaPkQUFTeWu2zY5O+uZhW6uEAGDaD9hruCXNS3oPBSiMc5a2nAXFIfW/sVQky/EOxt3gZcpF1aoySqRwIxBgOkamyFsvcgBZgjDqmCcFwqSxvOQOtkJkwDIdrVsHfOHm4Sb2ZytGUFQaKts81W377fO0h91zhWnmFvD751o0wWv9UYOiExWDcOWThmS0OAdzmdqReQTyFKvpQNPDjkml9lnR0/1dOL8JJVB2hgP52wkhny6V62VusStF9kQk3H+TTDzw/iR8a140EaGXPNWjjm0yQdPfc7xAHonEjjFVAgMBAAECggEAec/qIPXZIF0CuTuEXKSr38gD5NpVmuPO38EPb0uJ96pgnuCzqMxRhmRN/Qv4ojfmn3UucH7BnJVMJtoeEy39NdtTfeo3aJS963vufNTQlf0NoARk1RElKt1XudPwwQlt2ABu0M/YTV4GlxGhyb3ohKoCN76x+si0MIhurIryovyabZCtlhGD2fg3V1t8RBlCEuz68FtB9fSh4zk7u6RhAL5LCOGNbVAiY4hx/NhrDiBfvQBhJZmPG+3gWjjZFgZEH5B0tGByuG2M+dj2qT5LFepkhGyI/upJwOhJrjiRrvR7LmSYCz0lI8/2fVCF8jN/TJav/1xVR82d/165Movm0QKBgQDZv/H1bhPoCoeh8z3ww8Um5FjFb1MMjmh4oB1d2+0QlYTbSVx6mOxBoh0yk+jKztotJyWs61nnHekOhdHFx9Ij1L8oMxybBK+heTuzl2WIs9/2CRBV4XfKMwNiYxJYkaXxUgeHx/2IVXTuFMKMrWhf7kxk2iFrK+Gv63oY0dmvhwKBgQDR0TWXRXC2qEqH/NV/6d24UHl4i/+UP1aKE9jA8xArJYBlKtTWCgM7g3/wxr0IRB6RocVupop/kZJ9RUFjprfaykDOj+A0oC+IDwUmGIjGbR4P921qjWEVQGIFSJvnIwHwGfEAPxvw0uW2tqz9C2GUZ9OB17lecfIdeJQX2Hb3QwKBgA9bWCclAkZlJ7emPgIS7H6XsCMMfODv0jJfqHKMJiX7RYlpnRoQWukuE70TbWGQQRbaIfAWERsZouwhR/AY7ZsVT/33zNap9/D9adZ6oPCJLwxdC0fjRN1/x4dS0WJpszhXvqw20Iyi6kI4OJhPSoMpfT3HnH/AcoRDqTLC6gVVAoGBAI3f9GfseZHZbERV75wF7HoEWI7tw41f4smNMAUQln9GZXKDKtXsgVEN00ZhbFMZlL4O8GyoyoAGVFLGsLeMdUfJeVbzrLyJEHrlBStEbcAW6rwLJ/5jySDQnzdJaLo7TsUnFXKAOgl24gPRtFmLB5mNN1TWJS86x2esMB+LrK33AoGADEDHIUtulc4zclLH9MJj7JcZPkgVz5llJ1jQj3fOu4iPc9TNvV2gV2kWU446gyMmRrQ2We1awnrjaeSzeFnf0OhL+yTzNUmRLMYWZhja/KMhr7b9vVRCCrysZJod+MWodEH+HIJlu9RGIxv7fNNy1S4yRU92OQU43XQ1S93eaEE=\";\n\n public static String publicKey_B = \"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv8GjRufWGPI7Xe6caZ5h5PbnRIQVzD4P1gDjKZaibcxcApGEaqFkT3Am2U6iKv6paELuwxy+dUL1Jvbs09QljuHgDB9SV0VxSM5LscpCmWJ5P1V6Y/QiholCQHCFR6ok6oE2HWGRw/bPQWr/gHfa2zNPu+CB64cbOxLHIQYIRji47tyywAL5ABhF1msZY2vW8xaFKHGq74sxNpf8s0NUnRnVRANjHtuDa/zvrHim45gqBWg+3gPVSQyPU3ydMoj0AiORJQmqprHaZDB7BufpTEZA6I2WElsKJcsGMdwfSd1s0B1iCzrkMmT30n/XXxyw8qQGsvJvQ2V90QiAV9bV+wIDAQAB\";\n public static String privateKey_B = \"MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC/waNG59YY8jtd7pxpnmHk9udEhBXMPg/WAOMplqJtzFwCkYRqoWRPcCbZTqIq/qloQu7DHL51QvUm9uzT1CWO4eAMH1JXRXFIzkuxykKZYnk/VXpj9CKGiUJAcIVHqiTqgTYdYZHD9s9Bav+Ad9rbM0+74IHrhxs7EschBghGOLju3LLAAvkAGEXWaxlja9bzFoUocarvizE2l/yzQ1SdGdVEA2Me24Nr/O+seKbjmCoFaD7eA9VJDI9TfJ0yiPQCI5ElCaqmsdpkMHsG5+lMRkDojZYSWwolywYx3B9J3WzQHWILOuQyZPfSf9dfHLDypAay8m9DZX3RCIBX1tX7AgMBAAECggEBAIkRYyMGCTYfwGvuagPdYOCH1NxXBjXOjwdL7xUFRenyUDrNxbdq0gcuhbaDzMuq6XFLltwFKecsC4zkqHjqhkZSExLXOMaFLur5+4WErIJzr3OkKC5Wjm9YofDp/XsyldzCq+nomodXXuLGFwi/o8NYNEB5xKSVGNPrIkfqxfNazdR63738zq0ZPQmMjxEb/AK5uc+fdF9qosDrNI0SqQng00mhfpilvwHZbOYPfKNfh26lpqTEAGk0gaFGfr/QnhUDAnxfaoLhr9zELr4utrkwpaCzX958MrRB5naeScocYSl1h4Bi6htjjpdLWDKkk/vQ8Keno6GtF9Iha8MdvnECgYEA9p5UzaP3qYek4pe96milqmPiYkQeqSAUWSp1TpC5ppIoyPGMYl7Ia8SOsIYBw+9WL9iIR6jqZOpd/E68j8YsW5PyJuFYQTVjXZrVD76D435mskl4gsKz1izEWz5jzU/oE4mGfuaobfaOuw5ixun7dd8FrXknIVHbne0zyEZ+FY0CgYEAxw0Jq3aJbrJHX8ahPsZAodbWKYH8Ojkt2GkXKdrB9HJ6EGKockjPj7R/+ForXw2XWoGdoL4QPalhKuJX+3bsSQIgt7mDRiDEPK7XkbKd5mS/HTXWXsTIkGaDhYlq6yOkbmRsR3QgCfnhLYaaYkZ6kIKDsGgUJF8oIqxKrlDWo6cCgYBUyulzbu3nLwklE3Er2GElbYRXrv4vviTg53U/1wjN2bEGLe7Ln7UfQIyi6uBOgsrKVpO8t7onimFYL6YrdMKplfuLHK2gdf+9HlAlQqbMIBilMheqNdFpUSkOCix8Wf38QauplBrS/BPlArQ5mhdoVo74LxCiJyfwa68DLCGLvQKBgEGg4tdNtfJxhWbmrrNr2lOB6gq1eNwZjiwUOjbqkZhvRh+w56kGqKjQ8oCH+lTUvlpw8e/VurUZ65egGTIn+6/2q6Ln34h3tTvsydaX9cfI39pZrdyBNT+nDSYyMLZmggiDw8+rUgT4Bm5kOvK8Gh0bax/2sO1tEmacN+NRc/NxAoGALzEnmKI9B46NVNOWi0VLtTdiloSI6bxgli0Rm8T+6wD6y9JNnWsibYydGx9pDn6w2qihuP1QcKruHUiZ7V8aahhD4o4e/a+IgRzNYcQh4CngUzL+XymlqQVbDSaiEiVi/qSNv+i9mgeF/mSYbYcZjhFPjzdOy3hvtO3GtjDSMQw=\";\n\n // 封装发送的消息\n public static Map communicationParams = null;\n\n public static void main(String[] args) {\n\n // A给B发消息\n ASendMsgToB();\n\n // B接收来自A的消息\n BReceiveFromA();\n }\n\n\n /**\n * A给B发消息，首先A-B交换公钥，A拥有 privateKey_A 和 publicKey_B\n *\n * A使用publicKey_B加密消息，再使用privateKey_A对密文签名，然后将密文和签名发给B\n */\n public static void ASendMsgToB(){\n\n // 消息明文\n String msg = \"你好\";\n\n // 加密\n String encryptMsg = encryptByPublicKey(msg,publicKey_B);\n\n // 签名\n String sign = signByPrivateKey(encryptMsg,privateKey_A);\n\n // 发送消息\n communicationParams = new HashMap();\n communicationParams.put(\"encryptMsg\",encryptMsg);\n communicationParams.put(\"sign\",sign);\n log.info(\"A发送给B的消息:{}\", JSON.toJSONString(communicationParams));\n\n log.info(\"-------------------------------------------------\");\n }\n\n /**\n * B接收A的消息，首先A-B交换公钥，B拥有 privateKey_B 和 publicKey_A\n *\n * B收到消息后，先使用publicKey_A验签，再使用privateKey_B解密\n */\n public static void BReceiveFromA(){\n // 接收消息\n Map receiveMsg = communicationParams;\n log.info(\"B接收到A的消息:{}\", JSON.toJSONString(receiveMsg));\n String sign = receiveMsg.get(\"sign\");\n String encryptMsg = receiveMsg.get(\"encryptMsg\");\n\n // 验签\n Boolean tf = verifySignPublicKey(encryptMsg,publicKey_A,sign);\n if(tf){\n log.info(\"验签通过，说明这个信息是B认可的用户发来的\");\n }\n\n // 解密\n String msg = decryptByPrivateKey(encryptMsg,privateKey_B);\n log.info(\"解密成功，说明这个信息就是发给B的\");\n\n\n log.info(\"B收到的消息:{}\", msg);\n }\n\n\n /**\n * RSA签名\n * @param content 待签名数据\n * @param privateKey 商户私钥\n * @return 签名值\n */\n public static String signByPrivateKey(String content, String privateKey)\n {\n try{\n PKCS8EncodedKeySpec priPKCS8 = new PKCS8EncodedKeySpec( Base64.decode(privateKey) );\n KeyFactory keyf = KeyFactory.getInstance(\"RSA\");\n PrivateKey priKey = keyf.generatePrivate(priPKCS8);\n\n Signature signature = Signature.getInstance(SIGN_ALGORITHMS);\n\n signature.initSign(priKey);\n signature.update( content.getBytes(CHATSET) );\n\n byte[] signed = signature.sign();\n\n return Base64.encode(signed);\n\n }catch (Exception e){\n log.error(e.getMessage(), e);\n }\n\n return null;\n }\n\n /**\n * RSA验签名检查\n * @param content 待签名数据\n * @param sign 签名值\n * @param publicKey 公钥\n * @return 布尔值\n */\n public static boolean verifySignPublicKey(String content, String publicKey, String sign)\n {\n try{\n KeyFactory keyFactory = KeyFactory.getInstance(\"RSA\");\n byte[] encodedKey = Base64.decode(publicKey);\n PublicKey pubKey = keyFactory.generatePublic(new X509EncodedKeySpec(encodedKey));\n\n Signature signature = Signature.getInstance(SIGN_ALGORITHMS);\n\n signature.initVerify(pubKey);\n signature.update( content.getBytes(CHATSET) );\n\n boolean bverify = signature.verify( Base64.decode(sign) );\n return bverify;\n\n }catch (Exception e){\n log.error(e.getMessage(), e);\n }\n\n return false;\n }\n\n /**\n * RSA公钥加密\n * @param str 加密字符串\n * @param publicKey 公钥\n * @return 密文\n */\n public static String encryptByPublicKey( String str, String publicKey ) {\n\n try{\n\n //base64编码的公钥\n byte[] decoded = org.apache.commons.codec.binary.Base64.decodeBase64(publicKey);\n RSAPublicKey pubKey = (RSAPublicKey) KeyFactory.getInstance(\"RSA\").generatePublic(new X509EncodedKeySpec(decoded));\n\n //RSA加密\n Cipher cipher = Cipher.getInstance(\"RSA\");\n cipher.init(Cipher.ENCRYPT_MODE, pubKey);\n String outStr = org.apache.commons.codec.binary.Base64.encodeBase64String(cipher.doFinal(str.getBytes(CHATSET)));\n return outStr;\n\n }catch (Exception e) {\n log.error(e.getMessage(), e);\n }\n\n return null;\n }\n\n /**\n * RSA私钥解密\n * @param str 加密字符串\n * @param privateKey 私钥\n * @return 明文\n */\n public static String decryptByPrivateKey(String str, String privateKey){\n\n try{\n\n //64位解码加密后的字符串\n byte[] inputByte = org.apache.commons.codec.binary.Base64.decodeBase64(str.getBytes(CHATSET));\n //base64编码的私钥\n byte[] decoded = org.apache.commons.codec.binary.Base64.decodeBase64(privateKey);\n RSAPrivateKey priKey = (RSAPrivateKey) KeyFactory.getInstance(\"RSA\").generatePrivate(new PKCS8EncodedKeySpec(decoded));\n\n //RSA解密\n Cipher cipher = Cipher.getInstance(\"RSA\");\n cipher.init(Cipher.DECRYPT_MODE, priKey);\n String outStr = new String(cipher.doFinal(inputByte));\n return outStr;\n\n }catch (Exception e) {\n log.error(e.getMessage(), e);\n }\n\n return null;\n }\n\n}\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"运行结果："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":"java"},"content":[{"type":"text","text":"00:09:01.375 [main] INFO com.wuxiaolong.EncrypteDecrypt.SignAndEncryptTest - A发送给B的消息:{\"sign\":\"X13XFI2khSarCOTDjENC/ZTtKfUKAPXuO3b7vossIvC6Aj9WMnKd9w/w64/EqTg+42SGvJXjVpvdglRMmWVrbFSWfmrEfjejaNcq35+aor6j4tMMq0ZVxRO4BxTe+qKDx/e0037dHACvAY2ecojVcbAQaECEc3TrZJguQnte/Nv0DZYPSv/9evPnuKL3DuTl/wy+JaTEhVrvsu/4jXpQ6HRbrhrC4dnzs6AZEqtBXvgfRSkq62jbAvUguDhhZ6yexA2/5S+oOqO8mgRVnooQxkAI5QZd9z0voDIrCDp4emKuznj7vMUjmOXgdD0C3l7LuBqQ469JmAD0U2fRLWMIiQ==\",\"encryptMsg\":\"lFrlwDA4RjXaxrFPkd8DrbiWQ15o7nNzvLwdWUmTgkDyV5DGMXXsbcEP8aBWqmCje49ymAdzQl3MdO+U2t51QtTvzJOS55EBOZgonN8XJHKNiW7XikWbgf54vUx/mNdHH7fqpBM8AM1qcyH2N3OISFK4NP6eCKgMXRRb3hxw4oko3cGTa98Hnl8jlR9yR2Goy1euT7lpL04VqWcJtP0aEW5gurPkTEDRmOn1UC6x8qZX+K3dxrQfOQhJVRoIOb2hbu/HhzBsknJw1QZTS5IN/n0GlRiJQUwJllQUT4XRF6zmc2y4ewnLwlMY99WqwCaB4XFaBNQO9/5fa7A/XZTr7g==\"}\n00:09:01.378 [main] INFO com.wuxiaolong.EncrypteDecrypt.SignAndEncryptTest - -------------------------------------------------\n00:09:01.378 [main] INFO com.wuxiaolong.EncrypteDecrypt.SignAndEncryptTest - B接收到A的消息:{\"sign\":\"X13XFI2khSarCOTDjENC/ZTtKfUKAPXuO3b7vossIvC6Aj9WMnKd9w/w64/EqTg+42SGvJXjVpvdglRMmWVrbFSWfmrEfjejaNcq35+aor6j4tMMq0ZVxRO4BxTe+qKDx/e0037dHACvAY2ecojVcbAQaECEc3TrZJguQnte/Nv0DZYPSv/9evPnuKL3DuTl/wy+JaTEhVrvsu/4jXpQ6HRbrhrC4dnzs6AZEqtBXvgfRSkq62jbAvUguDhhZ6yexA2/5S+oOqO8mgRVnooQxkAI5QZd9z0voDIrCDp4emKuznj7vMUjmOXgdD0C3l7LuBqQ469JmAD0U2fRLWMIiQ==\",\"encryptMsg\":\"lFrlwDA4RjXaxrFPkd8DrbiWQ15o7nNzvLwdWUmTgkDyV5DGMXXsbcEP8aBWqmCje49ymAdzQl3MdO+U2t51QtTvzJOS55EBOZgonN8XJHKNiW7XikWbgf54vUx/mNdHH7fqpBM8AM1qcyH2N3OISFK4NP6eCKgMXRRb3hxw4oko3cGTa98Hnl8jlR9yR2Goy1euT7lpL04VqWcJtP0aEW5gurPkTEDRmOn1UC6x8qZX+K3dxrQfOQhJVRoIOb2hbu/HhzBsknJw1QZTS5IN/n0GlRiJQUwJllQUT4XRF6zmc2y4ewnLwlMY99WqwCaB4XFaBNQO9/5fa7A/XZTr7g==\"}\n00:09:01.379 [main] INFO com.wuxiaolong.EncrypteDecrypt.SignAndEncryptTest - 验签通过，说明这个信息是B认可的用户发来的\n00:09:01.386 [main] INFO com.wuxiaolong.EncrypteDecrypt.SignAndEncryptTest - 解密成功，说明这个信息就是发给B的\n00:09:01.386 [main] INFO com.wuxiaolong.EncrypteDecrypt.SignAndEncryptTest - B收到的消息:你好"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"关注公众号，输入关键字“"},{"type":"text","marks":[{"type":"strong"}],"text":"java-summary"},{"type":"text","text":"”，即可获得源码。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"完成，收工！"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/18/18f641710708a2731191d64425d92b6c.gif","alt":null,"title":"","style":[{"key":"width","value":"50%"},{"key":"bordertype","value":"none"}],"href":"","fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"【"},{"type":"text","marks":[{"type":"strong"}],"text":"传播知识，共享价值"},{"type":"text","text":"】，感谢小伙伴们的关注和支持，我是【"},{"type":"text","marks":[{"type":"strong"}],"text":"诸葛小猿"},{"type":"text","text":"】，一个彷徨中奋斗的互联网民工！！！"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/6a/6acafea3f4c9b96373b3f566ec7078e2.png","alt":null,"title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}}]}