AES加密解密及证书密钥的获取

    最近几天一直在做单点登录加密串的解密，碰到了一些问题，将这些问题分享下。
    首先加密解密需要用到jce_policy-1_5_0.zip，下载地址：http://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/VerifyItem-Start/jce_policy-1_5_0.zip?BundledLineItemUUID=PdKJ_hCvc84AAAEq2HgdNaQ9&OrderID=UVSJ_hCvhXQAAAEqyXgdNaQ9&ProductID=NVXACUFBETQAAAEY68A5AXuH&FileName=/jce_policy-1_5_0.zip 然后将jce_policy-1_5_0.zip 中的 jar 包替换 %JAVA_HOME%/jre/lib/security 目录下的相关文件
    相关代码private byte[] _iV = { 85, 60, 12, 116, 99, (byte) 189, (byte) 173, 19,(byte) 138, (byte) 183, (byte) 232, (byte) 248, 82, (byte) 232,(byte) 200, (byte) 242 };private byte[] _key = { (byte) 175, (byte) 206, (byte) 222, 40, 61,(byte) 149, (byte) 157, (byte) 166, (byte) 164, (byte) 179, 15, 16,(byte) 219, (byte) 221, 96, 10, (byte) 242, (byte) 207, (byte) 137,(byte) 104, 98, (byte) 138, (byte) 246, 89, (byte) 252, (byte) 153,50, 13, (byte) 173, 75, (byte) 183, 18 };private byte[] compute(int mode, byte[] rawBytes) {try {Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");SecretKeySpec keySpec = new SecretKeySpec(_key, "AES");IvParameterSpec ivSpec = new IvParameterSpec(_iV);cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec);return cipher.doFinal(rawBytes);} catch (Exception ex) {ex.printStackTrace();}return null;} 
    从网上找到了好多RSA-SHA1读取证书密钥签名的代码，大部分都是相同的，都不是很好用。 读取 PKCS12证书（.pfx）所需要的第三方包bcprov-jdk15-145.jar 地址 ：http://www.bouncycastle.org/download/bcprov-jdk15-145.jar ，将jar包放到%JAVA_HOME%/jre/lib/ext下，在java.security添加下列文字:
security.provider.7=org.bouncycastle.jce.provider.BouncyCastleProvider
这样就可以读取证书文件，获取私钥签名了。

    私钥签名相关代码/** * RSA-SHA1私钥签名 * @param src * @return * @throws Exception */private static byte[] sign(byte[] src) throws Exception { FileInputStream fis = null;try {// Open an input stream on the keystore fileString pfxFileName = "ssip.pfx";String pfxPassword = "fetion";fis = new FileInputStream(pfxFileName);// Create a keystore objectKeyStore keyStore = null;try {// Need BC provider for PKCS #12, BKS and UBERif (Security.getProvider("BC") == null) {throw new Exception(" 不能Load入BouncyCastle! ");}keyStore = KeyStore.getInstance("PKCS12", "BC");} catch (KeyStoreException ex) {throw new Exception(" 不能正确解释pfx文件! ");} try {// Load the file into the keystorekeyStore.load(fis, pfxPassword.toCharArray());//Certificate[] certs = keyStore.getCertificateChain("5871a33a9a9e83899cf0a48eb59cde6b_17354fbb-09e1-458e-8d6e-398c04372270");//X509Certificate t1 = (X509Certificate)certs[0];PrivateKey prikey = (PrivateKey) keyStore.getKey("5871a33a9a9e83899cf0a48eb59cde6b_17354fbb-09e1-458e-8d6e-398c04372270",null);// 使用私鈅签名Signature sig = Signature.getInstance("SHA1WithRSA");sig.initSign(prikey);sig.update(src);byte[] signature = sig.sign();return signature;} catch (CertificateException ex) {throw new Exception(" 证书格式问题! ");} catch (NoSuchAlgorithmException ex) {throw new Exception(" 算法不支持! ");} catch (FileNotFoundException ex) {throw new Exception(" pfx文件没找到 ");} catch (IOException ex) {throw new Exception(" 读取pfx有误! ");}} catch (Exception e) {e.printStackTrace();} finally {if(fis != null ) {try {fis.close();} catch (IOException e) {System.out.println(e);}}}return null;}

    在keyStore.getKey获取PricateKey对象是要知道证书的别名，获取别名可以参考下面链接

    http://snowolf.javaeye.com/blog/735294

    公钥签名验证代码/** * RSA-SHA1 公钥签名校验 * @param decData * @throws Exception */private static void signVerify(byte[] decData) throws Exception {FileInputStream fis = null;try {byte[] signSrc = new byte[14];byte[] signed = new byte[decData.length - 18];System.arraycopy(decData, 4, signSrc, 0, 14);System.arraycopy(decData, 18, signed, 0, decData.length - 18);if (signed.length != 256) {throw new Exception("signed must 256 byte!");}fis = new FileInputStream("123.cer");CertificateFactory cf = CertificateFactory.getInstance("X.509");X509Certificate x509 = (X509Certificate) cf.generateCertificate(fis);PublicKey pk = x509.getPublicKey();Signature signatureChecker = Signature.getInstance("SHA1WithRSA");signatureChecker.initVerify(pk);signatureChecker.update(signSrc);if (!signatureChecker.verify(signed)) {throw new Exception("signed is invalid!");}} finally {if(fis != null ) {try {fis.close();} catch (IOException e) {System.out.println(e);}}}}

    注意：如果证书是2048bit，那么签名获取的256位的byte数组，1024bit对应的128位byte数组