如何在Java中将私钥写入受密码保护的DER格式? [英] How to write private key to password protected DER format in Java?

查看：326 发布时间：2020/6/11 19:06:24 java cryptography rsa pem der

本文介绍了如何在Java中将私钥写入受密码保护的DER格式?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我有一个用Java生成的RSA密钥对，我需要以编程方式将私钥写入与运行此命令时openssl相同的格式(并为提示输入适当的数据，即密码短语，以保护私钥):

I have an RSA key pair that I generated in Java and I need to programmatically write the private key to the same format that openssl does when I run this command (and enter the appropriate data for the prompts, namely a passphrase to protect the private key):

openssl req -out request.csr -newkey rsa:2048 -keyout privkeyfile

用于生成密钥对的Java代码非常标准:

The Java code to generate the key pair is pretty standard:

KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
keyGen.initialize(2048);
KeyPair keyPair = keyGen.genKeyPair();

openssl命令的运行示例输出(在我的Windows计算机上)为:

A sample output of running that openssl command (on my Windows machine) is:

编辑更改了来自openssl的示例输出

EDIT Changed the sample output from openssl

编辑，我尝试使用以下代码通过Java阅读openssl生成的私钥文件，以尝试获取一些参数，但最终出现以下异常:

EDIT I tried to read the openssl generated private key file with Java using the code below to try and get some of the parameters but I ended up getting the following exception:

Exception in thread "main" java.io.IOException: ObjectIdentifier() -- data isn't an object ID (tag = 48)
    at sun.security.util.ObjectIdentifier.<init>(Unknown Source)
    at sun.security.util.DerInputStream.getOID(Unknown Source)
    at com.sun.crypto.provider.PBES2Parameters.engineInit(PBES2Parameters.java:267)
    at java.security.AlgorithmParameters.init(Unknown Source)
    at sun.security.x509.AlgorithmId.decodeParams(Unknown Source)
    at sun.security.x509.AlgorithmId.<init>(Unknown Source)
    at sun.security.x509.AlgorithmId.parse(Unknown Source)
    at javax.crypto.EncryptedPrivateKeyInfo.<init>(EncryptedPrivateKeyInfo.java:95)
    at crypto.ReadOpensslKey.main(ReadOpensslKey.java:35)

读取文件的Java代码:

Java code to read file:

package crypto;

import org.bouncycastle.util.encoders.Base64;
import javax.crypto.EncryptedPrivateKeyInfo;  
import javax.crypto.SecretKeyFactory;  
import javax.crypto.spec.PBEKeySpec;  
import java.io.IOException;  
import java.nio.file.Files;  
import java.nio.file.Paths;  
import java.security.InvalidKeyException;  
import java.security.KeyFactory;  
import java.security.NoSuchAlgorithmException;  
import java.security.PrivateKey;  
import java.security.spec.InvalidKeySpecException;  
import java.security.spec.PKCS8EncodedKeySpec; 

public class ReadOpensslKey {

    public static void main(String[] args) throws Exception {

        String encrypted = new String(Files.readAllBytes(Paths.get("<insert path to openssl generated privkeyfile>")));  

        //Create object from encrypted private key  
        encrypted = encrypted.replace("-----BEGIN ENCRYPTED PRIVATE KEY-----", "");  
        encrypted = encrypted.replace("-----END ENCRYPTED PRIVATE KEY-----", "");  
        EncryptedPrivateKeyInfo pkInfo = new EncryptedPrivateKeyInfo(Base64.decode(encrypted));  // exception is thrown here
        System.out.println(pkInfo.getAlgName());
        PBEKeySpec keySpec = new PBEKeySpec("abcde".toCharArray()); // password  
        SecretKeyFactory pbeKeyFactory = SecretKeyFactory.getInstance(pkInfo.getAlgName());  
        PKCS8EncodedKeySpec encodedKeySpec = pkInfo.getKeySpec(pbeKeyFactory.generateSecret(keySpec));  
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");  
        PrivateKey encryptedPrivateKey = keyFactory.generatePrivate(encodedKeySpec);  
    }

}

推荐答案

我最终使用以下代码使它开始工作:

I ended up getting it to work using the following code:

import java.io.FileOutputStream;
import java.io.StringWriter;
import java.nio.charset.StandardCharsets;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.SecureRandom;
import java.security.Security;

import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openssl.PKCS8Generator;
import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
import org.bouncycastle.openssl.jcajce.JcaPKCS8Generator;
import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8EncryptorBuilder;
import org.bouncycastle.operator.OutputEncryptor;
import org.bouncycastle.util.io.pem.PemObject; 

public class WriteOpensslKey {

    public static void main(String[] args) throws Exception {

        // provider is needed for the encryptor builder
        Security.addProvider(new BouncyCastleProvider());

        // generate key pair
        KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA");  
        kpGen.initialize(2048, new SecureRandom());  
        KeyPair keyPair = kpGen.generateKeyPair();  

        // construct encryptor builder to encrypt the private key
        JceOpenSSLPKCS8EncryptorBuilder encryptorBuilder = new JceOpenSSLPKCS8EncryptorBuilder(PKCS8Generator.AES_256_CBC);  
        encryptorBuilder.setRandom(new SecureRandom());  
        encryptorBuilder.setPasssword("password".toCharArray());
        OutputEncryptor encryptor = encryptorBuilder.build();  

        // construct object to create the PKCS8 object from the private key and encryptor
        JcaPKCS8Generator pkcsGenerator = new JcaPKCS8Generator(keyPair.getPrivate(), encryptor);  
        PemObject pemObj = pkcsGenerator.generate();  
        StringWriter stringWriter = new StringWriter();  
        try (JcaPEMWriter pemWriter = new JcaPEMWriter(stringWriter)) {  
            pemWriter.writeObject(pemObj);  
        }  

        // write PKCS8 to file
        String pkcs8Key = stringWriter.toString();  
        FileOutputStream fos = new FileOutputStream("<path to output file>");  
        fos.write(pkcs8Key.getBytes(StandardCharsets.UTF_8));  
        fos.flush();  
        fos.close();  

    }

}

然后我可以将此私钥与openssl一起使用，以对文件进行签名，以对其进行快速测试.

I was then able to use this private key with openssl to sign a file as a quick test that it works.

非常感谢@ dave_thompson_085向我指出了正确的方向！

Huge thanks to @dave_thompson_085 for pointing me in the right direction!

这篇关于如何在Java中将私钥写入受密码保护的DER格式?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！

查看全文

如何在Java中将私钥写入受密码保护的DER格式? [英] How to write private key to password protected DER format in Java?

问题描述

推荐答案

相关文章

Java开发最新文章

热门教程

热门工具

登录关闭

如何在Java中将私钥写入受密码保护的DER格式? [英] How to write private key to password protected DER format in Java?

问题描述

推荐答案

相关文章

Java开发最新文章

热门教程

热门工具

登录 关闭

登录关闭