数字签名算法DSA

一、概述

1、DSA是以RSA为基础形成的

2、java6提供了DSA的实现，但是java6只提供了SHA1withDSA的实现

3、bouncycastle扩展提供了其他的DSA实现方式

4、遵循“私钥签名，公钥验证”的原则

二、模型分析

这个和RSA一样，只是换了一个算法而已

 

三、代码分析

package com.ca.test;import java.security.Key;import java.security.KeyFactory;import java.security.KeyPair;import java.security.KeyPairGenerator;import java.security.PrivateKey;import java.security.PublicKey;import java.security.SecureRandom;import java.security.Signature;import java.security.interfaces.DSAPrivateKey;import java.security.interfaces.DSAPublicKey;import java.security.spec.PKCS8EncodedKeySpec;import java.security.spec.X509EncodedKeySpec;import java.util.HashMap;import java.util.Map;import org.apache.commons.codec.binary.Base64;/** * 常用数字签名算法DSA * 数字签名 * @author kongqz * */public class DSACoder {//数字签名，密钥算法public static final String KEY_ALGORITHM="DSA";/** * 数字签名 * 签名/验证算法 * */public static final String SIGNATURE_ALGORITHM="SHA1withDSA";/** * DSA密钥长度，RSA算法的默认密钥长度是1024 * 密钥长度必须是64的倍数，在512到1024位之间 * */private static final int KEY_SIZE=1024;//公钥private static final String PUBLIC_KEY="DSAPublicKey";//私钥private static final String PRIVATE_KEY="DSAPrivateKey";/** * 初始化密钥对 * @return Map 甲方密钥的Map * */public static Map<String,Object> initKey() throws Exception{//实例化密钥生成器KeyPairGenerator keyPairGenerator=KeyPairGenerator.getInstance(KEY_ALGORITHM);//初始化密钥生成器keyPairGenerator.initialize(KEY_SIZE,new SecureRandom());//生成密钥对KeyPair keyPair=keyPairGenerator.generateKeyPair();//甲方公钥DSAPublicKey publicKey=(DSAPublicKey) keyPair.getPublic();//甲方私钥DSAPrivateKey privateKey=(DSAPrivateKey) keyPair.getPrivate();//将密钥存储在map中Map<String,Object> keyMap=new HashMap<String,Object>();keyMap.put(PUBLIC_KEY, publicKey);keyMap.put(PRIVATE_KEY, privateKey);return keyMap;}/** * 签名 * @param data待签名数据 * @param privateKey 密钥 * @return byte[] 数字签名 * */public static byte[] sign(byte[] data,byte[] privateKey) throws Exception{//取得私钥PKCS8EncodedKeySpec pkcs8KeySpec=new PKCS8EncodedKeySpec(privateKey);KeyFactory keyFactory=KeyFactory.getInstance(KEY_ALGORITHM);//生成私钥PrivateKey priKey=keyFactory.generatePrivate(pkcs8KeySpec);//实例化SignatureSignature signature = Signature.getInstance(SIGNATURE_ALGORITHM);//初始化Signaturesignature.initSign(priKey);//更新signature.update(data);return signature.sign();}/** * 校验数字签名 * @param data 待校验数据 * @param publicKey 公钥 * @param sign 数字签名 * @return boolean 校验成功返回true，失败返回false * */public static boolean verify(byte[] data,byte[] publicKey,byte[] sign) throws Exception{//转换公钥材料//实例化密钥工厂KeyFactory keyFactory=KeyFactory.getInstance(KEY_ALGORITHM);//初始化公钥//密钥材料转换X509EncodedKeySpec x509KeySpec=new X509EncodedKeySpec(publicKey);//产生公钥PublicKey pubKey=keyFactory.generatePublic(x509KeySpec);//实例化SignatureSignature signature = Signature.getInstance(SIGNATURE_ALGORITHM);//初始化Signaturesignature.initVerify(pubKey);//更新signature.update(data);//验证return signature.verify(sign);}/** * 取得私钥 * @param keyMap 密钥map * @return byte[] 私钥 * */public static byte[] getPrivateKey(Map<String,Object> keyMap){Key key=(Key)keyMap.get(PRIVATE_KEY);return key.getEncoded();}/** * 取得公钥 * @param keyMap 密钥map * @return byte[] 公钥 * */public static byte[] getPublicKey(Map<String,Object> keyMap) throws Exception{Key key=(Key) keyMap.get(PUBLIC_KEY);return key.getEncoded();}/** * @param args * @throws Exception */public static void main(String[] args) throws Exception {//初始化密钥//生成密钥对Map<String,Object> keyMap=DSACoder.initKey();//公钥byte[] publicKey=DSACoder.getPublicKey(keyMap);//私钥byte[] privateKey=DSACoder.getPrivateKey(keyMap);System.out.println("公钥：/n"+Base64.encodeBase64String(publicKey));System.out.println("私钥：/n"+Base64.encodeBase64String(privateKey));System.out.println("================密钥对构造完毕,甲方将公钥公布给乙方，开始进行加密数据的传输=============");String str="DSA数字签名算法";System.out.println("原文:"+str);//甲方进行数据的加密byte[] sign=DSACoder.sign(str.getBytes(), privateKey);System.out.println("产生签名："+Base64.encodeBase64String(sign));//验证签名boolean status=DSACoder.verify(str.getBytes(), publicKey, sign);System.out.println("状态："+status+"/n/n");}}控制台输出：公钥：MIIBtzCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoDgYQAAoGAdLUOPbXqOQi4MFUm5tgBs2zQO20P7P1iPCC9pslWvixp13NX9dTwdddkwqQtwKAfm/Ao2Gqe7VGq48kTIPr0wz01LKlCLbbw6VLikuFcgVNN+sVxmwVTm54aFpiOaenS575Qtyek3zjVV+eMtRNKn91rMMWpsP6pucqku6xO5uY=私钥：MIIBSwIBADCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoEFgIUQhtJHLosUo0sxPKmCxC8NFVjD9c=================密钥对构造完毕,甲方将公钥公布给乙方，开始进行加密数据的传输=============原文:DSA数字签名算法产生签名：MCwCFAsJPC7xUfrvGYXtsxiWcS6GHAe1AhRnZLZ1CJe8I41vaScvJ7UZ8yk0oA==状态：true

四、总结

1、DSA的公钥长度略长于私钥，这个和RSA有较大差别。可以通过两个算法的控制台输出公钥私钥长度比对

2、DSA算法的签名长度与密钥长度无关。可能和待签名数据有联系...