一：SM2简介
SM2是中国密码学算法标准中的一种非对称加密算法（包括公钥和私钥）。SM2主要用于数字签名、密钥交换和加密解密等密码学。
- 生成秘钥：用于生成一对公钥和私钥。公钥：用于加密数据和验证数字签名。私钥：用于解密数据和生成数字签名。
- 数字签名：用于生成和验证数字签名，可以独立使用。数字签名可以确保数据的完整性和身份认证，防止数据被篡改或冒充。发送方可以使用自己的私钥生成数字签名，并将签名附加在数据上发送给接收方。接收方使用发送方的公钥来验证数字签名的有效性，从而确保数据的完整性和身份认证。
- 密钥交换：双方可以使用各自的私钥和对方的公钥来生成一个共享密钥，用于后续的对称加密通信。
- 加密解密：发送方使用接收方的公钥进行加密，接收方使用自己的私钥进行解密。
CFCA
二：Java
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.9</version>
</dependency>
<dependency>
<groupId>com.cfca</groupId>
<artifactId>SADK</artifactId>
<version>3.2.1.3</version>
</dependency>
public class SM2Util {
private static final String PVK_FILE = ".pvk";
private static final String PUB_FILE = ".puk";
/**
* 加密数据
* @param publicKey
* @param data
*/
public static byte[] encrypt(PublicKey publicKey, byte[] data) throws Exception {
byte[] result = null;
SM2Toolkit sm2Toolkit = new SM2Toolkit();
SM2PublicKey sm2PublicKey = (SM2PublicKey)publicKey;
result = sm2Toolkit.SM2EncryptData(sm2PublicKey, data);
return result;
}
public static byte[] decryptString(PrivateKey privateKey, String base64Text) throws Exception {
SM2Toolkit sm2Toolkit = new SM2Toolkit();
SM2PrivateKey sm2PrivateKey = (SM2PrivateKey)privateKey;
return sm2Toolkit.SM2DecryptData(sm2PrivateKey, BASE64Toolkit.decode(base64Text));
}
public static void sm4EncryptFile(String key, String inFile, String outFile) throws Exception{
SM4Toolkit toolkit = new SM4Toolkit();
toolkit.SM4Init(key.getBytes(), key.getBytes());
toolkit.SM4EncryptFile(inFile, outFile);
}
public static boolean sM4DecryptFile(String key, String inFile, String outFile) throws Exception {
SM4Toolkit toolkit = new SM4Toolkit();
toolkit.SM4Init(key.getBytes(), key.getBytes());
return toolkit.SM4DecryptFile(inFile, outFile);
}
/**
* 签名
* @param privateKey
*/
public static String singnString(PrivateKey privateKey, byte[] srcBytes) throws Exception {
SM2Toolkit sm2Toolkit = new SM2Toolkit();
SM2PrivateKey sm2PrivateKey = (SM2PrivateKey)privateKey;
String result = BASE64Toolkit.encode(sm2Toolkit.SM2Sign(sm2PrivateKey, srcBytes));
return result;
}
public static String sm2SignFile(String filePath, String privateKeyPath) throws Exception {
SM2Toolkit sm2Toolkit = new SM2Toolkit();
byte[] privateBytes = readKey(privateKeyPath);
SM2PrivateKey sm2PrivateKey = (SM2PrivateKey)sm2Toolkit.SM2BuildPrivateKey(BASE64Toolkit.encode(privateBytes));
byte[] hash = SM3Toolkit.SM3HashFile(sm2PrivateKey.getSM2PublicKey(), filePath);
String result = BASE64Toolkit.encode(BCSoftSM2.sign(hash, sm2PrivateKey.dBigInteger(), true));
return result;
}
/**
* 文件验签
* @param outfilePath
* @param keyPath
* @param singStr
* @return
*/
public static boolean verify(String outfilePath, String keyPath, String singStr) {
boolean result = false;
try {
SM2Toolkit toolkit = new SM2Toolkit();
SM2PublicKey sm2PublicKey = (SM2PublicKey)toolkit.SM2BuildPublicKey(BASE64Toolkit.encode(readKey(keyPath)));
byte[] hash = SM3Toolkit.SM3HashFile(sm2PublicKey, outfilePath);
result = toolkit.SM2VerifyHash(sm2PublicKey, hash, BASE64Toolkit.decode(singStr));
} catch (Exception e) {
throw new RuntimeException("文件验签失败");
}
return result;
}
/**
* 读取私钥
* @param keyPath
* @return
*/
public static SM2PrivateKey buildPrivateKey(String keyPath) throws Exception {
if (!keyPath.endsWith(PVK_FILE)) {
keyPath += PVK_FILE;
}
byte[] privateKeyByte = readKey(keyPath);
SM2Toolkit sm2Toolkit = new SM2Toolkit();
SM2PrivateKey sm2PrivateKey = (SM2PrivateKey)sm2Toolkit.SM2BuildPrivateKey(BASE64Toolkit.encode(privateKeyByte));
return sm2PrivateKey;
}
/**
* 读取公钥
* @param keyPath
* @return
*/
public static SM2PublicKey buildPublicKey(String keyPath) throws Exception {
if (!keyPath.endsWith(PUB_FILE)) {
keyPath += PUB_FILE;
}
byte[] privateKeyByte = readKey(keyPath);
SM2Toolkit sm2Toolkit = new SM2Toolkit();
SM2PublicKey sm2PublicKey = (SM2PublicKey)sm2Toolkit.SM2BuildPublicKey(BASE64Toolkit.encode(privateKeyByte));
return sm2PublicKey;
}
/**
* 读取秘钥
* @param filePath
*/
public static byte[] readKey(String filePath) throws Exception {
try(FileInputStream is = new FileInputStream(filePath)) {
byte[] out = new byte[is.available()];
byte[] buffer = new byte[1024];
int len;
for (int offset = 0; (len = is.read(buffer, 0, buffer.length)) != -1; offset += len) {
System.arraycopy(buffer, 0, out, offset, len);
}
return out;
}
}
public static void main(String[] args) throws Exception {
SM2Toolkit toolkit = new SM2Toolkit();
KeyPair keyPair = toolkit.SM2GenerateKeyPair();
PublicKey publicKey = keyPair.getPublic();
PrivateKey privateKey = keyPair.getPrivate();
// 1. 对源文件进行签名（最终会作为签名文件和数据zip一起放到新的.zip中去）
String zipPath = "/Temp/data.zip";
String tempZipPath = "/Temp/Activiti/data.zip";
String signguare = sm2SignFile(zipPath, "xxx.pvk");
// 2. 对秘钥加密(最终将将加密的秘钥作为压缩包文件中的一部分)
String verifyChars = "1234567890abcdefghijkmnopqrstuvwxyz";
String encryptKey = RandomStringUtils.random(16, verifyChars).toUpperCase();
byte[] encrypt = encrypt(buildPublicKey("/Temp/xxx.puk"), random16.getBytes());
byte[] encryptKeyBytes = BASE64Toolkit.encode(encrypt).getBytes();
// 3. 加密源文件
sm4EncryptFile(encryptKey, zipPath, tempZipPath);
// 4. 新的zip = (sign文件、秘钥文件、加密源文件)
}
}
