在 Java 中为 OpenSSL 格式化 RSA 密钥 [英] Formatting RSA keys for OpenSSL in Java

问题描述

使用命令在 Linux 上使用 OpenSSL 生成 RSA 密钥，

RSA key generation with OpenSSL on Linux using the command,

openssl genrsa -out mykey.pem 1024

创建了以下内容:

"-----BEGIN RSA PRIVATE KEY-----
 MIICXQIBAAKBgQChs9Fepy5FgeL0gNJ8GHcKRHsYnM2Kkw19zwydDQNyh2hrHWV2
 B11wpLFp8d0imcl2Wjb0oV/AxOhb3unQgNzs66LVuXJwS8icp3oIJZtExs6tkxzE
 s5mnU68wMeCYtJqHIZOmNblVWvpJMLNAwAVi3oLfnzDDbzjnDapm8M21nQIDAQAB
 AoGAZ11P1+acUHgvwMXcRtFIvvp5iYkqZouL00EYOghIjNx75gTbh7A7jbbpZeTi
 y6xsuMgAWy4QzGPSeG+tHMhS7+dYQNPuKSv5KtK3V7ubXz/I3ZN1etRVecA56QNw
 7HKv6b7srolt08kogGIwpbbfl/mhfJHnv4Jeqd5lNMnK4e0CQQDWFZo4h22OlSaH
 ZGd3i4rwLrA0Ux5bkdh7YH0uEeE/nGzpVs1DPhsN8UCyq9LAiKYLlXeeCvwurKwo
 OgKlUCkzAkEAwVy2KignoRInFTAaYH8PQRfD835q+oC0Iu21BF68ne06U6wu+wWk
 bWiYxTOOb+TGZfA1vA6OAvGVGoXs1bHF7wJBAItGiop0MKYuCl7Sxy1SrxUKir+/
 w2Q3QesiHs41+6Byl7hGLEuuv9MWPM0AU5/GRqAKoUNESkPjOi0BcG8z81kCQGGn
 OvCreugjzM0skAWv5bpQEExGyixdF5yURFlCpytzBYQAb3Gi9dmze4QMd6EW/wO4
 fsrM5vehnlXY0TVTJM0CQQCMPVhub8LSo7T/lCzypvb/cgxJfyITRKcM2asrXud5
 r27kbzsXqYum4huHqyFkb3pZammsYA/z89HchylfrD4U
 -----END RSA PRIVATE KEY-----"

Java 6下的以下代码，

The following code under Java 6,

KeyPairGenerator keyGen = null;
try {
  keyGen = KeyPairGenerator.getInstance("RSA");
} catch (NoSuchAlgorithmException e) {
  throw new RuntimeException(e);
}
KeyPair pair = keyGen.generateKeyPair();
privateKey = new Base64Encoder().encode(pair.getPrivate().getEncoded());
publicKey = new Base64Encoder().encode(pair.getPublic().getEncoded());`

输出如下:

"MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAIsJlqFOP+jPyYvrGwh+dff30a3p
 uHysMfHYi1MyNSFCsT/2QbOc/k9U/X28WRCMeFwEEnReLULXA9Ywox8GycI/ApMX+DjKBrrLDbpr
 ATLiu9+NMK4VSytKFI87P07HAni3RkiO4rFNEINVQ7t38ZmHavuXHjMkLEAK4dyLQO9NAgMBAAEC
 gYBN/jv0EmwBUgYSKflJI39TcT263B+0N/fwXXOSYNiy5rF9WstyUP/LSrbEAJLJmLKvk00y391t
 4CVz0ma+sdUdAPlS7Nmx9f3BThGOGcDmpjVo1y4e1afWtyu66ba/XDeuf7q5Y/h/pr20/gXl9Gz2
 yefQrzU9xXGKZhE/lxJ2IQJBAMELpeAal+Fa+u0InGrowVmV+lge8RZqKRfCDzPPna465E5Qcekb
 J0ShsarP5lnUfrNH5g8GLaDGQwYE/UoIpPkCQQC4YRfck5uMlI1K3F9YC3XvmFAJnf9YexoPfNSu
 dznOD4rxlwzW/5daPOR0jjlyIRDH/QuUoPIIEn1mt3dnz7X1AkBZciozgl7pPhySA7FmH96mwcUz
 W3LdrebIaVRd707iUctDNibxmXFCbaFCwf27laf3LdM9FuHBYtvfSCSMTyERAkEAlNAQsUAVmKZB
 T72D2o0Nd/7oAosaD7DzvLJU+idSaWUUEJ+IhnKuFu/0t7oe1WWopLEwypoIHsnFmsTTQ99ajQJA
 Scwh3P3RTN4F6Jz1SxRSe6L729xI8xkbco5EsMq5v5BZeoGynqdPUUZdAPcaO2k5UagaSejvzgna
 8xIqR7elVQ=="

"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCLCZahTj/oz8mL6xsIfnX399Gt6bh8rDHx2ItT
 MjUhQrE/9kGznP5PVP19vFkQjHhcBBJ0Xi1C1wPWMKMfBsnCPwKTF/g4yga6yw26awEy4rvfjTCu
 FUsrShSPOz9OxwJ4t0ZIjuKxTRCDVUO7d/GZh2r7lx4zJCxACuHci0DvTQIDAQAB"

问题

1. 如何为通过 Java 代码创建的私钥和公钥添加盔甲"?

1. How do I put "armor" around the private and public keys created through Java code?

为什么 Java 代码生成的每一行密钥都比 OpenSSL 输出的要长?

Why is each line of the keys generated through Java code longer than those output by OpenSSL?

这有什么区别吗?其他团队正在使用的工具之一在使用上述 Java 代码生成的私钥签署消息时失败.但是，该工具使用 OpenSSL 生成的私钥可以正常工作.

Does it make any difference? One of the tools, that other team is using, fails while signing a message using private key generated by Java code mentioned above. However, it works just fine that tool uses the private key generated by OpenSSL.

有没有办法导出与 Java 兼容的密钥?

Is there a way I can export a compatible key with Java?

推荐答案

OpenSSL 私钥采用非标准格式，而 Java 代码正在创建标准的、PKCS-#8–编码的私钥.

The OpenSSL private key is in a non-standard format, while the Java code is creating a standard, PKCS-#8–encoded private key.

OpenSSL 可以将标准密钥格式转换为非标准格式.您可以编写 Java 代码来执行相同的操作，但这需要一些第三方库，并且对 ASN.1 有很好的了解也有帮助.

OpenSSL can convert the standard key format to the non-standard form. You can write Java code to do the same, but it requires some third-party libraries and a good knowledge of ASN.1 helps too.

要将 PKCS #8 密钥转换为 OpenSSL 格式，请使用 OpenSSL 的 pkcs8 实用程序.

To convert a PKCS #8 key to OpenSSL format, use OpenSSL's pkcs8 utility.

openssl pkcs8 -nocrypt -inform der < pvt.der > pvt.pem

要将存储为 DER 编码的 SubjectPublicKeyInfo 的 RSA 密钥转换为 PEM 格式，请使用 OpenSSL 的 rsa 实用程序.

To convert an RSA key stored as a DER-encoded SubjectPublicKeyInfo to PEM format, use OpenSSL's rsa utility.

openssl rsa -pubin -inform der < pub.der > pub.pem

这假设私钥以二进制"(DER)格式存储，而不是 Base-64 编码.像这样创建和存储密钥的 Java 代码如下所示:

This assumes that the private key is stored in "binary" (DER) format, not Base-64 encoded. The Java code to create and store keys like this would look something like:

KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");
KeyPair pair = gen.generateKeyPair();
FileOutputStream ospvt = new FileOutputStream("pvt.der");
try {
  ospvt.write(pair.getPrivate().getEncoded());
  ospvt.flush();
} finally {
  ospvt.close();
}
FileOutputStream ospub = new FileOutputStream("pub.der");
try {
  ospub.write(pair.getPublic().getEncoded());
  ospub.flush();
} finally {
  ospub.close();
}

这篇关于在 Java 中为 OpenSSL 格式化 RSA 密钥的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！