Android AES加密解密工具类
一个用于Android AES加密解密的工具类，记录一下。。。
import android.os.Build
import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import android.util.Base64
import androidx.annotation.RequiresApi
import java.io.*
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.IvParameterSpec
@RequiresApi(Build.VERSION_CODES.M)
class CryptoManager {
companion object {
private const val IV_BLOCK_SIZE = 16
private const val ALGORITHM = KeyProperties.KEY_ALGORITHM_AES
private const val BLOCK_MODE = KeyProperties.BLOCK_MODE_CBC
private const val PADDING = KeyProperties.ENCRYPTION_PADDING_PKCS7
private const val TRANSFORMATION = "$ALGORITHM/$BLOCK_MODE/$PADDING"
private const val KeyStoreType = "AndroidKeyStore"
private const val KEY_ALIAS = "SecretKeyAlias"
private val cipher = Cipher.getInstance(TRANSFORMATION) //创建密码器
fun encrypt(encryptBytes: ByteArray): ByteArray?{
try {
cipher.init(Cipher.ENCRYPT_MODE, getKey()) //用密钥初始化Cipher对象
val final = cipher.doFinal(encryptBytes)
return cipher.iv + final // iv占前16位,加密后的数据占后面
} catch (e: Exception) {
e.printStackTrace()
}
return null
}
fun decrypt(decryptBytes: ByteArray): ByteArray? {
try {
val iv = decryptBytes.copyOfRange(0, IV_BLOCK_SIZE) // 先取出IV
val decryptData = decryptBytes.copyOfRange(IV_BLOCK_SIZE, decryptBytes.size) // 取出加密后的数据
cipher.init(Cipher.DECRYPT_MODE, getKey(), IvParameterSpec(iv))
return cipher.doFinal(decryptData)
} catch (e: Exception) {
e.printStackTrace()
}
return null
}
// type设为"AndroidKeyStore"使用Android专门提供的密钥存储系统，可以根据别名获取key, 类似于sp
private val keyStore = KeyStore.getInstance(KeyStoreType).apply { load(null) }
private fun getKey(): SecretKey {
val existingKey = keyStore.getEntry(KEY_ALIAS, null) as? KeyStore.SecretKeyEntry
return existingKey?.secretKey ?: generateKey()
}
private fun generateKey(): SecretKey {
return KeyGenerator.getInstance(ALGORITHM, KeyStoreType).apply {
init(
KeyGenParameterSpec.Builder(
KEY_ALIAS,
KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
)
.setBlockModes(BLOCK_MODE)
.setEncryptionPaddings(PADDING)
.setUserAuthenticationRequired(false)
.setRandomizedEncryptionRequired(true)
.build()
)
}.generateKey()
}
/**
* 将 text 加密
*/
fun encrypt(text: String): String? {
val encryptedBytes = encrypt(text.toByteArray())
return encryptedBytes?.let {
// NO_WRAP is important as was getting \n at the end
Base64.encodeToString(it, Base64.NO_WRAP)
}
}
/**
* 将 text 解密
*/
fun decrypt(base64EncodedText: String): String? {
val decodedCipherBytes = Base64.decode(base64EncodedText, Base64.NO_WRAP)
val decryptedBytes = decrypt(decodedCipherBytes)
return decryptedBytes?.let { String(it) }
}
}
}
(注意：上面代码使用了一些API要求在 Android 6.0 以上)
以下 Cipher 类支持设置的加密算法：
上面代码中 Cipher 使用的就是 AES/CBC/PKCS7Padding 这一种加密算法。
这里关键的一点是加密解密用的 key 是使用 KeyStore 来存储，它是 Android 的密钥库系统，使用 KeyStore 存储的密钥只能使用但是不能从设备中导出，安全性更好。详情可以参考：Android 密钥库系统。
使用方式：
// 加密结果
val textEncrypted = CryptoManager.encrypt("hello world") ?: ""
// 解密结果
val textDecrypted = CryptoManager.decrypt(textEncrypted) ?: ""
这种使用方式是将文本加密后以Base64的字符串形式返回，解密时再传回这段Base64字符串。
还可以直接加密成 byte 数组来保存，但解密时同样需要传回 byte 数组：
// 加密结果
var encryptedBytes: ByteArray? = CryptoManager.encrypt(text.toByteArray())
// 如需将加密结果转换成文本，可以这样做
val textEncrypted = encryptedBytes?.let { String(it) } ?: ""
// 解密结果
var decryptedBytes: ByteArray? = encryptedBytes?.let { CryptoManager.decrypt(it) }
// 如需将解密结果转换成文本，可以这样做
val textDecrypted = decryptedBytes?.let { String(it) } ?: ""
示例 demo:
import android.os.Build
import android.os.Bundle
import androidx.activity.ComponentActivity
import androidx.activity.compose.setContent
import androidx.annotation.RequiresApi
import androidx.compose.foundation.layout.*
import androidx.compose.foundation.rememberScrollState
import androidx.compose.foundation.verticalScroll
import androidx.compose.material.Button
import androidx.compose.material.Text
import androidx.compose.material.TextField
import androidx.compose.runtime.getValue
import androidx.compose.runtime.mutableStateOf
import androidx.compose.runtime.remember
import androidx.compose.runtime.setValue
import androidx.compose.ui.Modifier
import androidx.compose.ui.unit.dp
import com.fly.mycompose.application.ui.theme.MyComposeApplicationTheme
@RequiresApi(Build.VERSION_CODES.M)
class EncryptActivity : ComponentActivity() {
var encryptedBytes: ByteArray? = null
var decryptedBytes: ByteArray? = null
override fun onCreate(savedInstanceState: Bundle?) {
super.onCreate(savedInstanceState)
setContent {
MyComposeApplicationTheme {
var text by remember { mutableStateOf("") }
var textEncrypted by remember { mutableStateOf("") }
var textDecrypted by remember { mutableStateOf("") }
Column(modifier = Modifier
.fillMaxSize()
.padding(32.dp)
.verticalScroll(rememberScrollState())
) {
TextField(
value = text,
onValueChange = { text = it },
modifier = Modifier.fillMaxWidth(),
placeholder = { Text(text = "请输入加密内容") }
)
Spacer(modifier = Modifier.height(8.dp))
Row {
Button(onClick = {
textEncrypted = CryptoManager.encrypt(text) ?: ""
// encryptedBytes = CryptoManager.encrypt(text.toByteArray())
// textEncrypted = encryptedBytes?.let { String(it) } ?: ""
}) {
Text(text = "加密")
}
Spacer(modifier = Modifier.width(16.dp))
Button(onClick = {
textDecrypted = CryptoManager.decrypt(textEncrypted) ?: ""
// decryptedBytes = encryptedBytes?.let { CryptoManager.decrypt(it) }
// textDecrypted = decryptedBytes?.let { String(it) } ?: ""
}) {
Text(text = "解密")
}
}
Text(text = "加密后的内容：$textEncrypted")
Text(text = "解密后的内容：$textDecrypted")
}
}
}
}
}
下面是另一个工具类，在其他地方看到的，实现方式也是类似，这个没有API在 Android 6.0 以上的限制，但是它没有使用 KeyStore 来存储 key，在加密/解密时还需要显示的指定一个密码。
import android.util.Base64
import android.util.Base64.*
import java.io.UnsupportedEncodingException
import java.security.GeneralSecurityException
import java.security.MessageDigest
import javax.crypto.Cipher
import javax.crypto.spec.IvParameterSpec
import javax.crypto.spec.SecretKeySpec
object AESCryptUtil {
private const val AES_MODE = "AES/CBC/PKCS7Padding"
private const val CHARSET = "UTF-8"
private const val CIPHER = "AES"
private const val HASH_ALGORITHM = "SHA-256"
private val IV_BYTES = byteArrayOf(0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
/**
* Generates SHA256 hash of the password which is used as key
*
* @param password used to generated key
* @return SHA256 of the password
*/
private fun generateKey(password: String): SecretKeySpec {
val digest = MessageDigest.getInstance(HASH_ALGORITHM)
val bytes = password.toByteArray(charset(CHARSET))
digest.update(bytes, 0, bytes.size)
val key = digest.digest()
return SecretKeySpec(key, CIPHER)
}
/**
* Encrypt and encode message using 256-bit AES with key generated from password.
*
* @param password used to generated key
* @param message the thing you want to encrypt assumed String UTF-8
* @return Base64 encoded CipherText
* @throws GeneralSecurityException if problems occur during encryption
*/
fun encrypt(password: String, message: String): String {
try {
val key = generateKey(password)
val cipherText = encrypt(key, IV_BYTES, message.toByteArray(charset(CHARSET)))
//NO_WRAP is important as was getting \n at the end
return Base64.encodeToString(cipherText, Base64.NO_WRAP)
} catch (e: UnsupportedEncodingException) {
throw GeneralSecurityException(e)
}
}
/**
* More flexible AES encrypt that doesn't encode
*
* @param key AES key typically 128, 192 or 256 bit
* @param iv Initiation Vector
* @param message in bytes (assumed it's already been decoded)
* @return Encrypted cipher text (not encoded)
* @throws GeneralSecurityException if something goes wrong during encryption
*/
@Throws(GeneralSecurityException::class)
fun encrypt(key: SecretKeySpec, iv: ByteArray, message: ByteArray): ByteArray {
val cipher = Cipher.getInstance(AES_MODE)
val ivSpec = IvParameterSpec(iv)
cipher.init(Cipher.ENCRYPT_MODE, key, ivSpec)
return cipher.doFinal(message)
}
/**
* Decrypt and decode ciphertext using 256-bit AES with key generated from password
*
* @param password used to generated key
* @param base64EncodedCipherText the encrpyted message encoded with base64
* @return message in Plain text (String UTF-8)
* @throws GeneralSecurityException if there's an issue decrypting
*/
@Throws(GeneralSecurityException::class)
fun decrypt(password: String, base64EncodedCipherText: String): String {
try {
val key = generateKey(password)
val decodedCipherText = Base64.decode(base64EncodedCipherText, Base64.NO_WRAP)
val decryptedBytes = decrypt(key, IV_BYTES, decodedCipherText)
return String(decryptedBytes, charset(CHARSET))
} catch (e: UnsupportedEncodingException) {
throw GeneralSecurityException(e)
}
}
/**
* More flexible AES decrypt that doesn't encode
*
* @param key AES key typically 128, 192 or 256 bit
* @param iv Initiation Vector
* @param decodedCipherText in bytes (assumed it's already been decoded)
* @return Decrypted message cipher text (not encoded)
* @throws GeneralSecurityException if something goes wrong during encryption
*/
@Throws(GeneralSecurityException::class)
fun decrypt(key: SecretKeySpec, iv: ByteArray, decodedCipherText: ByteArray): ByteArray {
val cipher = Cipher.getInstance(AES_MODE)
val ivSpec = IvParameterSpec(iv)
cipher.init(Cipher.DECRYPT_MODE, key, ivSpec)
return cipher.doFinal(decodedCipherText)
}
}
使用方式：
// 加密结果
val textEncrypted = AESCryptUtil.encrypt("123456", "hello world")
// 解密结果
val textDecrypted = AESCryptUtil.decrypt("123456", textEncrypted)