java 安全 JCA 之二

1、初始化加密对象

     一个加密对象通过getInstance方法获得，它有四种模式：

ENCRYPT_MODE

Encryption of data.

DECRYPT_MODE

Decryption of data.

WRAP_MODE

Wrapping a java.security.Key into bytes so that the key can be securely transported.包装一个对称密钥，用来安全传输

UNWRAP_MODE

Unwrapping of a previously wrapped key into a java.security.Key object.

Each of the Cipher initialization methods takes an operational mode parameter (opmode), and initializes the Cipher object for that mode. Other parameters include the key (key) or certificate containing the key (certificate), algorithm parameters (params), and a source of randomness (random).

每个初始化方法使用上面的四种模式之一，还有其他一些属性，如key\certificate\algorithm\random

public void init(int opmode, Key key);

public void init(int opmode, Certificate certificate);

public void init(int opmode, Key key, SecureRandom random);

public void init(int opmode, Certificate certificate, SecureRandom random);

public void init(int opmode, Key key, AlgorithmParameterSpec params);

public void init(int opmode, Key key, AlgorithmParameterSpec params, SecureRandom random);

public void init(int opmode, Key key, AlgorithmParameters params);

public void init(int opmode, Key key, AlgorithmParameters params, SecureRandom random);

当一个加密对象实例化后，它将失去之前的状态。实例化一个加密对象就像重新初始化一个加密对象。

2、加密、解密数据

   分为一次性加密或解密和多次加密或解密数据。

一次性:public byte[] doFinal(byte[] input);

public byte[] doFinal(byte[] input, int inputOffset, int inputLen);

public int doFinal(byte[] input, int inputOffset, int inputLen, byte[] output);

public int doFinal(byte[] input, int inputOffset, int inputLen, byte[] output, int outputOffset)

多次:public byte[] update(byte[] input);

 public byte[] update(byte[] input, int inputOffset, int inputLen);

 public int update(byte[] input, int inputOffset, int inputLen, byte[] output);

public int update(byte[] input, int inputOffset, int inputLen, byte[] output, int outputOffset)

 多次加密操作必须以上面的doFinal方法结束（如果最后一步仍然有一些输入数据)，或者以下面的doFInal方法结束(如果最后一步没有数据输入)

A multiple-part operation must be terminated by one of the above doFinal methods (if there is still some input data left for the last step), or by one of the followingdoFinal methods (if there is no input data left for the last step):

    public byte[] doFinal();

    public int doFinal(byte[] output, int outputOffset);

所有的doFinal方法会考虑到填充模式（或者非填充模式),如果有特别转换的填充模式的请求。

All the doFinal methods take care of any necessary padding (or unpadding), if padding (or unpadding) has been requested as part of the specified transformation.

调用doFinal将会重置加密对象到初始化时的状态。

A call to doFinal resets the Cipher object to the state it was in when initialized via a call toinit. That is, the Cipher object is reset and available to encrypt or decrypt (depending on the operation mode that was specified in the call toinit) more data.

3、包装、解包密钥

Wrapping a key enables secure transfer of the key from one place to another.

包装密钥可以安全的从一个地方到另一个地方传输密钥。

To wrap a Key, first initialize the Cipher object for WRAP_MODE, and then call the following:

    public final byte[] wrap(Key key);
包装一个密钥，使用将加密对象实例化成warp_mode,然后调用wrap方法

为了解包密钥，必须提供密钥的算法和密钥的类型(Cipher.SECRET_KEY, Cipher.PRIVATE_KEY, or Cipher.PUBLIC_KEY)

public final Key unwrap(byte[] wrappedKey, String wrappedKeyAlgorithm, int wrappedKeyType));

Here, wrappedKey is the bytes returned from the previous call to wrap, wrappedKeyAlgorithm is the algorithm associated with the wrapped key, and wrappedKeyType is the type of the wrapped key. This must be one of Cipher.SECRET_KEY, Cipher.PRIVATE_KEY, or Cipher.PUBLIC_KEY

SunJce提供商使用以下的密码算法的参数：

The following cipher algorithms implemented by the SunJCE provider use parameters:
  
  
  
  

   
   
   
   
DES, DES-EDE, and Blowfish, when used in feedback (i.e., CBC, CFB, OFB, or PCBC) mode, use an initialization vector (IV). The javax.crypto.spec.IvParameterSpec class can be used to initialize a Cipher object with a given IV.
   
   
   
   
PBEWithMD5AndDES uses a set of parameters, comprising a salt and an iteration count. The javax.crypto.spec.PBEParameterSpec class can be used to initialize a Cipher object implementing PBEWithMD5AndDES with a given salt and iteration count.
  
  
  
  

 

通过输入的字节数来确定输出缓冲器的大小。

Some of the update and doFinal methods of Cipher allow the caller to specify the output buffer into which to encrypt or decrypt the data. In these cases, it is important to pass a buffer that is large enough to hold the result of the encryption or decryption operation.

The following method in Cipher can be used to determine how big the output buffer should be:

    public int getOutputSize(int inputLen)

4、SealedObject class

    只要对象实现了java.io.Serializable 接口，就可以将该对象密封起来，加密算法可以是对称密钥或者非对称密钥。

加密对象采用如下方法:(字符串可以替换成对象)

Cipher c = Cipher.getInstance("DES"); c.init(Cipher.ENCRYPT_MODE, sKey); // do the sealing

 SealedObject so = new SealedObject("This is a secret", c);
解密对象采用如下方法之一:

c.init(Cipher.DECRYPT_MODE, sKey); try { String s = (String)so.getObject(c); } catch (Exception e) { // do something };

try { String s = (String)so.getObject(sKey); } catch (Exception e) { // do something };