- 数字签名 - 带有密钥（公钥、私钥）的消息摘要算法
- 验证数据的完整性、认证数据来源、抗否认
- OSI参考模型
- 私钥签名、公钥验证
- RSA、DSA、ECDSA
数字签名算法 - RSA
- 经典算法
- MD、SHA两类
| 密钥长度 | 默认 | 工作模式 | 填充方式 | 实现方 |
|---|---|---|---|---|
| MD2withRSA | 512~65536（64的整数倍） | 1024 | 与密钥长度相同 | JDK |
| MD5withRSA | JDK | |||
| SHA1withRSA | JDK | |||
| SHA224withRSA | 2048 | BC | ||
| SHA256withRSA | BC | |||
| SHA384withRSA | BC | |||
| SHA512withRSA | BC | |||
| RIPEMD128withRSA | BC | |||
| RIPEMD160withRSA | BC |
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Signature;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import org.apache.commons.codec.binary.Hex;
import com.sun.xml.internal.fastinfoset.algorithm.HexadecimalEncodingAlgorithm;
public class RSATest{
public static final String src = "RSA security is security";
public static void main(String[] args) {
jdkRSA();
}
/**
* @author timliu
* 说明： 用java的jdk里面相关方法实现rsa的签名及签名验证
*/
public static void jdkRSA(){
try {
// 1.初始化密钥
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
keyPairGenerator.initialize(512);
KeyPair keyPair = keyPairGenerator.generateKeyPair();
RSAPublicKey rsaPublicKey = (RSAPublicKey)keyPair.getPublic();
RSAPrivateKey rsaPrivateKey = (RSAPrivateKey)keyPair.getPrivate();
// 2.进行签名
PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(rsaPrivateKey.getEncoded());
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);
Signature signature = Signature.getInstance("MD5withRSA");
signature.initSign(privateKey);
signature.update(src.getBytes());
byte[] result = signature.sign();
System.out.println("jdk rsa sign:" + Hex.encodeHexString(result) );
// 3.验证签名
X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(rsaPublicKey.getEncoded());
keyFactory = KeyFactory.getInstance("RSA");
PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);
signature = Signature.getInstance("MD5withRSA");
signature.initVerify(publicKey);
signature.update(src.getBytes());
boolean bool = signature.verify(result);
System.out.println("jdk rsa verify:" + bool);
} catch (Exception e) {
System.out.println(e.toString());
}
}
}
数字签名算法 - RSA
数字签名算法 - DSA
- DSS（Digital Signature Standard）数字签名标准
- DSA（Digital Signature Algorithm）数字签名算法
- DSA 仅含数字签名（无法进行加密通讯）
| 密钥长度 | 默认 | 工作模式 | 实现方 | |
|---|---|---|---|---|
| SHA1withRSA | 512~1024（64的整数倍） | 1024 | JDK | |
| SHA224withRSA | BC | |||
| SHA256withRSA | BC | |||
| SHA384withRSA | BC | |||
| SHA512withRSA | BC |
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Signature;
import java.security.interfaces.DSAPrivateKey;
import java.security.interfaces.DSAPublicKey;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import org.apache.commons.codec.binary.Hex;
import com.sun.xml.internal.fastinfoset.algorithm.HexadecimalEncodingAlgorithm;
public class DSATest{
public static final String src = "DSA security is security";
public static void main(String[] args) {
jdkDSA();
}
/**
*
* @author timliu
* 说明： 用java的jdk里面相关方法实现dsa的签名及签名验证
*/
public static void jdkDSA(){
try {
// 1.初始化密钥
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("DSA");
keyPairGenerator.initialize(512);
KeyPair keyPair = keyPairGenerator.generateKeyPair();
DSAPublicKey dsaPublicKey = (DSAPublicKey)keyPair.getPublic();
DSAPrivateKey dsaPrivateKey = (DSAPrivateKey)keyPair.getPrivate();
// 2.进行签名
PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(dsaPrivateKey.getEncoded());
KeyFactory keyFactory = KeyFactory.getInstance("DSA");
PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);
Signature signature = Signature.getInstance("SHA1withDSA");
signature.initSign(privateKey);
signature.update(src.getBytes());
byte[] result = signature.sign();
System.out.println("jdk dsa sign:" + Hex.encodeHexString(result) );
// 3.验证签名
X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(dsaPublicKey.getEncoded());
keyFactory = KeyFactory.getInstance("DSA");
PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);
signature = Signature.getInstance("SHA1withDSA");
signature.initVerify(publicKey);
signature.update(src.getBytes());
boolean bool = signature.verify(result);
System.out.println("jdk dsa verify:" + bool);
} catch (Exception e) {
System.out.println(e.toString());
}
}
}
数字签名算法 - DSA
数字签名算法 - ECDSA
- 微软序列号
- Elliptic Curve Digital Signature Algorithm，椭圆曲线数据签名算法
- 速度快、强度高、签名短
| 算法 | 密钥长度 | 默认 | 签名长度 | 实现方 |
|---|---|---|---|---|
| NONEwithECDSA | 112~571 | 256 | JDK/BC | |
| RIPEMD160withECDSA | BC | |||
| SHA1withECDSA | JDK/BC | |||
| SHA224withECDSA | BC | |||
| SHA256withECDSA | JDK/BC | |||
| SHA384withECDSA | JDK/BC | |||
| SHA512withECDSA | JDK/BC |
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Signature;
import java.security.interfaces.DSAPrivateKey;
import java.security.interfaces.DSAPublicKey;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.ECPublicKey;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import org.apache.commons.codec.binary.Hex;
import com.sun.xml.internal.fastinfoset.algorithm.HexadecimalEncodingAlgorithm;
public class ECDSATest{
public static final String src = "ECDSA security is security";
public static void main(String[] args) {
jdkECDSA();
}
/**
* @author timliu
* 说明： 用java的jdk里面相关方法实现ECDSA的签名及签名验证,要jdk7.x以上，ECDSA：椭圆曲线数字签名算法
*/
public static void jdkECDSA(){
try {
// 1.初始化密钥
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
keyPairGenerator.initialize(256);
KeyPair keyPair = keyPairGenerator.generateKeyPair();
ECPublicKey ecPublicKey = (ECPublicKey)keyPair.getPublic();
ECPrivateKey ecPrivateKey = (ECPrivateKey)keyPair.getPrivate();
// 2.进行签名
PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(ecPrivateKey.getEncoded());
KeyFactory keyFactory = KeyFactory.getInstance("EC");
PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);
Signature signature = Signature.getInstance("SHA1withECDSA");
signature.initSign(privateKey);
signature.update(src.getBytes());
byte[] result = signature.sign();
System.out.println("jdk ecdsa sign:" + Hex.encodeHexString(result) );
// 3.验证签名
X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(ecPublicKey.getEncoded());
keyFactory = KeyFactory.getInstance("EC");
PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);
signature = Signature.getInstance("SHA1withECDSA");
signature.initVerify(publicKey);
signature.update(src.getBytes());
boolean bool = signature.verify(result);
System.out.println("jdk ecdsa verify:" + bool);
} catch (Exception e) {
System.out.println(e.toString());
}
}
}
数字签名算法 - ECDSA