devbox
盐析白兔
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

sm2证书生成（openssl生成公私钥对）—使用_openssl sm2

作者：盐析白兔 | 2024-04-05 03:58:23

赞

踩

openssl sm2

用上一篇的命令生成公私钥对。

1、sm2PubKey.pem

  1. -----BEGIN PUBLIC KEY-----
  2. MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEmxmSy4HOD2d2sakaJTw0QFhRGZs2
  3. 5umcKzmg12FAsYNjVRmtLxcbydzTMELGKpHHle//IZ0Eqx7P15IKiyoK/g==
  4. -----END PUBLIC KEY-----

2、sm2PriKeyPkcs8.pem

  1. -----BEGIN PRIVATE KEY-----
  2. MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgilIj1dWX+977jcQO
  3. oHDQq6XtbWaazcZdJiHjXpAhKD6hRANCAASbGZLLgc4PZ3axqRolPDRAWFEZmzbm
  4. 6ZwrOaDXYUCxg2NVGa0vFxvJ3NMwQsYqkceV7/8hnQSrHs/XkgqLKgr+
  5. -----END PRIVATE KEY-----

3、openssl ec -in sm2PriKeyPkcs8.pem -text

  1. read EC key
  2. Private-Key: (256 bit)
  3. priv:
  4.     8a:52:23:d5:d5:97:fb:de:fb:8d:c4:0e:a0:70:d0:
  5.     ab:a5:ed:6d:66:9a:cd:c6:5d:26:21:e3:5e:90:21:
  6.     28:3e
  7. pub:
  8.     04:9b:19:92:cb:81:ce:0f:67:76:b1:a9:1a:25:3c:
  9.     34:40:58:51:19:9b:36:e6:e9:9c:2b:39:a0:d7:61:
  10.     40:b1:83:63:55:19:ad:2f:17:1b:c9:dc:d3:30:42:
  11.     c6:2a:91:c7:95:ef:ff:21:9d:04:ab:1e:cf:d7:92:
  12.     0a:8b:2a:0a:fe
  13. ASN1 OID: SM2
  14. writing EC key
  15. -----BEGIN EC PRIVATE KEY-----
  16. MHcCAQEEIIpSI9XVl/ve+43EDqBw0Kul7W1mms3GXSYh416QISg+oAoGCCqBHM9V
  17. AYItoUQDQgAEmxmSy4HOD2d2sakaJTw0QFhRGZs25umcKzmg12FAsYNjVRmtLxcb
  18. ydzTMELGKpHHle//IZ0Eqx7P15IKiyoK/g==
  19. -----END EC PRIVATE KEY-----

5、工具类
BCECUtil.java

  1. package GMSM;
  2.  
  3. import org.bouncycastle.asn1.ASN1Encodable;
  4. import org.bouncycastle.asn1.ASN1EncodableVector;
  5. import org.bouncycastle.asn1.ASN1Encoding;
  6. import org.bouncycastle.asn1.ASN1Integer;
  7. import org.bouncycastle.asn1.ASN1ObjectIdentifier;
  8. import org.bouncycastle.asn1.ASN1OctetString;
  9. import org.bouncycastle.asn1.ASN1Primitive;
  10. import org.bouncycastle.asn1.DERNull;
  11. import org.bouncycastle.asn1.DEROctetString;
  12. import org.bouncycastle.asn1.DERSequence;
  13. import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
  14. import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
  15. import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
  16. import org.bouncycastle.asn1.x9.X962Parameters;
  17. import org.bouncycastle.asn1.x9.X9ECParameters;
  18. import org.bouncycastle.asn1.x9.X9ECPoint;
  19. import org.bouncycastle.asn1.x9.X9ObjectIdentifiers;
  20. import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
  21. import org.bouncycastle.crypto.generators.ECKeyPairGenerator;
  22. import org.bouncycastle.crypto.params.ECDomainParameters;
  23. import org.bouncycastle.crypto.params.ECKeyGenerationParameters;
  24. import org.bouncycastle.crypto.params.ECKeyParameters;
  25. import org.bouncycastle.crypto.params.ECPrivateKeyParameters;
  26. import org.bouncycastle.crypto.params.ECPublicKeyParameters;
  27. import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPrivateKey;
  28. import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPublicKey;
  29. import org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util;
  30. import org.bouncycastle.jcajce.provider.asymmetric.util.ECUtil;
  31. import org.bouncycastle.jce.provider.BouncyCastleProvider;
  32. import org.bouncycastle.jce.spec.ECNamedCurveSpec;
  33. import org.bouncycastle.jce.spec.ECParameterSpec;
  34. import org.bouncycastle.math.ec.ECCurve;
  35. import org.bouncycastle.math.ec.ECPoint;
  36. import org.bouncycastle.math.ec.FixedPointCombMultiplier;
  37. import org.bouncycastle.pqc.math.linearalgebra.ByteUtils;
  38. import org.bouncycastle.util.io.pem.PemObject;
  39. import org.bouncycastle.util.io.pem.PemReader;
  40. import org.bouncycastle.util.io.pem.PemWriter;
  41.  
  42. import java.io.ByteArrayInputStream;
  43. import java.io.ByteArrayOutputStream;
  44. import java.io.IOException;
  45. import java.io.InputStreamReader;
  46. import java.io.OutputStreamWriter;
  47. import java.math.BigInteger;
  48. import java.security.InvalidAlgorithmParameterException;
  49. import java.security.KeyFactory;
  50. import java.security.KeyPair;
  51. import java.security.KeyPairGenerator;
  52. import java.security.NoSuchAlgorithmException;
  53. import java.security.NoSuchProviderException;
  54. import java.security.SecureRandom;
  55. import java.security.spec.ECGenParameterSpec;
  56. import java.security.spec.InvalidKeySpecException;
  57. import java.security.spec.PKCS8EncodedKeySpec;
  58. import java.security.spec.X509EncodedKeySpec;
  59.  
  60. /**
  61.  * 这个工具类的方法，也适用于其他基于BC库的ECC算法
  62.  */
  63. public class BCECUtil {
  64. 	
  65.     private static final String ALGO_NAME_EC = "EC";
  66.     private static final String PEM_STRING_PUBLIC = "PUBLIC KEY";
  67.     private static final String PEM_STRING_ECPRIVATEKEY = "EC PRIVATE KEY";
  68.  
  69.     /**
  70.      * 生成ECC密钥对
  71.      *
  72.      * @return ECC密钥对
  73.      */
  74.     public static AsymmetricCipherKeyPair generateKeyPairParameter(
  75.             ECDomainParameters domainParameters, SecureRandom random) {
  76.         ECKeyGenerationParameters keyGenerationParams = new ECKeyGenerationParameters(domainParameters,
  77.                 random);
  78.         ECKeyPairGenerator keyGen = new ECKeyPairGenerator();
  79.         keyGen.init(keyGenerationParams);
  80.         return keyGen.generateKeyPair();
  81.     }
  82.  
  83.     public static KeyPair generateKeyPair(ECDomainParameters domainParameters, SecureRandom random)
  84.             throws NoSuchProviderException, NoSuchAlgorithmException,
  85.             InvalidAlgorithmParameterException {
  86.         KeyPairGenerator kpg = KeyPairGenerator.getInstance(ALGO_NAME_EC, BouncyCastleProvider.PROVIDER_NAME);
  87.         ECParameterSpec parameterSpec = new ECParameterSpec(domainParameters.getCurve(), domainParameters.getG(),
  88.                 domainParameters.getN(), domainParameters.getH());
  89.         kpg.initialize(parameterSpec, random);
  90.         return kpg.generateKeyPair();
  91.     }
  92.  
  93.     public static int getCurveLength(ECKeyParameters ecKey) {
  94.         return getCurveLength(ecKey.getParameters());
  95.     }
  96.  
  97.     public static int getCurveLength(ECDomainParameters domainParams) {
  98.         return (domainParams.getCurve().getFieldSize() + 7) / 8;
  99.     }
  100.  
  101.     public static byte[] fixToCurveLengthBytes(int curveLength, byte[] src) {
  102.         if (src.length == curveLength) {
  103.             return src;
  104.         }
  105.  
  106.         byte[] result = new byte[curveLength];
  107.         if (src.length > curveLength) {
  108.             System.arraycopy(src, src.length - result.length, result, 0, result.length);
  109.         } else {
  110.             System.arraycopy(src, 0, result, result.length - src.length, src.length);
  111.         }
  112.         return result;
  113.     }
  114.  
  115.     /**
  116.      * @param dHex             十六进制字符串形式的私钥d值，如果是SM2算法，Hex字符串长度应该是64（即32字节）
  117.      * @param domainParameters EC Domain参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#DOMAIN_PARAMS}
  118.      * @return
  119.      */
  120.     public static ECPrivateKeyParameters createECPrivateKeyParameters(
  121.             String dHex, ECDomainParameters domainParameters) {
  122.         return createECPrivateKeyParameters(ByteUtils.fromHexString(dHex), domainParameters);
  123.     }
  124.  
  125.     /**
  126.      * @param dBytes           字节数组形式的私钥d值，如果是SM2算法，应该是32字节
  127.      * @param domainParameters EC Domain参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#DOMAIN_PARAMS}
  128.      * @return
  129.      */
  130.     public static ECPrivateKeyParameters createECPrivateKeyParameters(
  131.             byte[] dBytes, ECDomainParameters domainParameters) {
  132.         return createECPrivateKeyParameters(new BigInteger(1, dBytes), domainParameters);
  133.     }
  134.  
  135.     /**
  136.      * @param d                大数形式的私钥d值
  137.      * @param domainParameters EC Domain参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#DOMAIN_PARAMS}
  138.      * @return
  139.      */
  140.     public static ECPrivateKeyParameters createECPrivateKeyParameters(
  141.             BigInteger d, ECDomainParameters domainParameters) {
  142.         return new ECPrivateKeyParameters(d, domainParameters);
  143.     }
  144.  
  145.     /**
  146.      * 根据EC私钥构造EC公钥
  147.      *
  148.      * @param priKey ECC私钥参数对象
  149.      * @return
  150.      */
  151.     public static ECPublicKeyParameters buildECPublicKeyByPrivateKey(ECPrivateKeyParameters priKey) {
  152.         ECDomainParameters domainParameters = priKey.getParameters();
  153.         ECPoint q = new FixedPointCombMultiplier().multiply(domainParameters.getG(), priKey.getD());
  154.         return new ECPublicKeyParameters(q, domainParameters);
  155.     }
  156.  
  157.     /**
  158.      * @param x                大数形式的公钥x分量
  159.      * @param y                大数形式的公钥y分量
  160.      * @param curve            EC曲线参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#CURVE}
  161.      * @param domainParameters EC Domain参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#DOMAIN_PARAMS}
  162.      * @return
  163.      */
  164.     public static ECPublicKeyParameters createECPublicKeyParameters(
  165.             BigInteger x, BigInteger y, ECCurve curve, ECDomainParameters domainParameters) {
  166.         return createECPublicKeyParameters(x.toByteArray(), y.toByteArray(), curve, domainParameters);
  167.     }
  168.  
  169.     /**
  170.      * @param xHex             十六进制形式的公钥x分量，如果是SM2算法，Hex字符串长度应该是64（即32字节）
  171.      * @param yHex             十六进制形式的公钥y分量，如果是SM2算法，Hex字符串长度应该是64（即32字节）
  172.      * @param curve            EC曲线参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#CURVE}
  173.      * @param domainParameters EC Domain参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#DOMAIN_PARAMS}
  174.      * @return
  175.      */
  176.     public static ECPublicKeyParameters createECPublicKeyParameters(
  177.             String xHex, String yHex, ECCurve curve, ECDomainParameters domainParameters) {
  178.         return createECPublicKeyParameters(ByteUtils.fromHexString(xHex), ByteUtils.fromHexString(yHex),
  179.                 curve, domainParameters);
  180.     }
  181.  
  182.     /**
  183.      * @param xBytes           十六进制形式的公钥x分量，如果是SM2算法，应该是32字节
  184.      * @param yBytes           十六进制形式的公钥y分量，如果是SM2算法，应该是32字节
  185.      * @param curve            EC曲线参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#CURVE}
  186.      * @param domainParameters EC Domain参数，一般是固定的，如果是SM2算法的可参考{@link SM2Util#DOMAIN_PARAMS}
  187.      * @return
  188.      */
  189.     public static ECPublicKeyParameters createECPublicKeyParameters(
  190.             byte[] xBytes, byte[] yBytes, ECCurve curve, ECDomainParameters domainParameters) {
  191.         final byte uncompressedFlag = 0x04;
  192.         int curveLength = getCurveLength(domainParameters);
  193.         xBytes = fixToCurveLengthBytes(curveLength, xBytes);
  194.         yBytes = fixToCurveLengthBytes(curveLength, yBytes);
  195.         byte[] encodedPubKey = new byte[1 + xBytes.length + yBytes.length];
  196.         encodedPubKey[0] = uncompressedFlag;
  197.         System.arraycopy(xBytes, 0, encodedPubKey, 1, xBytes.length);
  198.         System.arraycopy(yBytes, 0, encodedPubKey, 1 + xBytes.length, yBytes.length);
  199.         return new ECPublicKeyParameters(curve.decodePoint(encodedPubKey), domainParameters);
  200.     }
  201.  
  202.     public static ECPrivateKeyParameters convertPrivateKeyToParameters(BCECPrivateKey ecPriKey) {
  203.         ECParameterSpec parameterSpec = ecPriKey.getParameters();
  204.         ECDomainParameters domainParameters = new ECDomainParameters(parameterSpec.getCurve(), parameterSpec.getG(),
  205.                 parameterSpec.getN(), parameterSpec.getH());
  206.         return new ECPrivateKeyParameters(ecPriKey.getD(), domainParameters);
  207.     }
  208.  
  209.     public static ECPublicKeyParameters convertPublicKeyToParameters(BCECPublicKey ecPubKey) {
  210.         ECParameterSpec parameterSpec = ecPubKey.getParameters();
  211.         ECDomainParameters domainParameters = new ECDomainParameters(parameterSpec.getCurve(), parameterSpec.getG(),
  212.                 parameterSpec.getN(), parameterSpec.getH());
  213.         return new ECPublicKeyParameters(ecPubKey.getQ(), domainParameters);
  214.     }
  215.  
  216.     public static BCECPublicKey createPublicKeyFromSubjectPublicKeyInfo(SubjectPublicKeyInfo subPubInfo)
  217.             throws NoSuchProviderException,
  218.             NoSuchAlgorithmException, InvalidKeySpecException, IOException {
  219.         return BCECUtil.convertX509ToECPublicKey(subPubInfo.toASN1Primitive().getEncoded(ASN1Encoding.DER));
  220.     }
  221.  
  222.     /**
  223.      * 将ECC私钥转换为PKCS8标准的字节流
  224.      *
  225.      * @param priKey
  226.      * @param pubKey 可以为空，但是如果为空的话得到的结果OpenSSL可能解析不了
  227.      * @return
  228.      */
  229.     public static byte[] convertECPrivateKeyToPKCS8(
  230.             ECPrivateKeyParameters priKey, ECPublicKeyParameters pubKey) {
  231.         ECDomainParameters domainParams = priKey.getParameters();
  232.         ECParameterSpec spec = new ECParameterSpec(domainParams.getCurve(), domainParams.getG(),
  233.                 domainParams.getN(), domainParams.getH());
  234.         BCECPublicKey publicKey = null;
  235.         if (pubKey != null) {
  236.             publicKey = new BCECPublicKey(ALGO_NAME_EC, pubKey, spec,
  237.                     BouncyCastleProvider.CONFIGURATION);
  238.         }
  239.         BCECPrivateKey privateKey = new BCECPrivateKey(ALGO_NAME_EC, priKey, publicKey,
  240.                 spec, BouncyCastleProvider.CONFIGURATION);
  241.         return privateKey.getEncoded();
  242.     }
  243.  
  244.     /**
  245.      * 将PKCS8标准的私钥字节流转换为私钥对象
  246.      *
  247.      * @param pkcs8Key
  248.      * @return
  249.      * @throws NoSuchAlgorithmException
  250.      * @throws NoSuchProviderException
  251.      * @throws InvalidKeySpecException
  252.      */
  253.     public static BCECPrivateKey convertPKCS8ToECPrivateKey(byte[] pkcs8Key)
  254.             throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeySpecException {
  255.         PKCS8EncodedKeySpec peks = new PKCS8EncodedKeySpec(pkcs8Key);
  256.         KeyFactory kf = KeyFactory.getInstance(ALGO_NAME_EC, BouncyCastleProvider.PROVIDER_NAME);
  257.         return (BCECPrivateKey) kf.generatePrivate(peks);
  258.     }
  259.  
  260.     /**
  261.      * 将PKCS8标准的私钥字节流转换为PEM
  262.      *
  263.      * @param encodedKey
  264.      * @return
  265.      * @throws IOException
  266.      */
  267.     public static String convertECPrivateKeyPKCS8ToPEM(byte[] encodedKey) throws IOException {
  268.         return convertEncodedDataToPEM(PEM_STRING_ECPRIVATEKEY, encodedKey);
  269.     }
  270.  
  271.     /**
  272.      * 将PEM格式的私钥转换为PKCS8标准字节流
  273.      *
  274.      * @param pemString
  275.      * @return
  276.      * @throws IOException
  277.      */
  278.     public static byte[] convertECPrivateKeyPEMToPKCS8(String pemString) throws IOException {
  279.         return convertPEMToEncodedData(pemString);
  280.     }
  281.  
  282.     /**
  283.      * 将ECC私钥转换为SEC1标准的字节流
  284.      * openssl d2i_ECPrivateKey函数要求的DER编码的私钥也是SEC1标准的，
  285.      * 这个工具函数的主要目的就是为了能生成一个openssl可以直接“识别”的ECC私钥.
  286.      * 相对RSA私钥的PKCS1标准，ECC私钥的标准为SEC1
  287.      *
  288.      * @param priKey
  289.      * @param pubKey
  290.      * @return
  291.      * @throws IOException
  292.      */
  293.     public static byte[] convertECPrivateKeyToSEC1(
  294.             ECPrivateKeyParameters priKey, ECPublicKeyParameters pubKey) throws IOException {
  295.         byte[] pkcs8Bytes = convertECPrivateKeyToPKCS8(priKey, pubKey);
  296.         PrivateKeyInfo pki = PrivateKeyInfo.getInstance(pkcs8Bytes);
  297.         ASN1Encodable encodable = pki.parsePrivateKey();
  298.         ASN1Primitive primitive = encodable.toASN1Primitive();
  299.         byte[] sec1Bytes = primitive.getEncoded();
  300.         return sec1Bytes;
  301.     }
  302.  
  303.     /**
  304.      * 将SEC1标准的私钥字节流恢复为PKCS8标准的字节流
  305.      *
  306.      * @param sec1Key
  307.      * @return
  308.      * @throws IOException
  309.      */
  310.     public static byte[] convertECPrivateKeySEC1ToPKCS8(byte[] sec1Key) throws IOException {
  311.         /**
  312.          * 参考org.bouncycastle.asn1.pkcs.PrivateKeyInfo和
  313.          * org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPrivateKey，逆向拼装
  314.          */
  315.         X962Parameters params = getDomainParametersFromName(SM2Util.JDK_EC_SPEC, false);
  316.         ASN1OctetString privKey = new DEROctetString(sec1Key);
  317.         ASN1EncodableVector v = new ASN1EncodableVector();
  318.         v.add(new ASN1Integer(0)); //版本号
  319.         v.add(new AlgorithmIdentifier(X9ObjectIdentifiers.id_ecPublicKey, params)); //算法标识
  320.         v.add(privKey);
  321.         DERSequence ds = new DERSequence(v);
  322.         return ds.getEncoded(ASN1Encoding.DER);
  323.     }
  324.  
  325.     /**
  326.      * 将SEC1标准的私钥字节流转为BCECPrivateKey对象
  327.      *
  328.      * @param sec1Key
  329.      * @return
  330.      * @throws NoSuchAlgorithmException
  331.      * @throws NoSuchProviderException
  332.      * @throws InvalidKeySpecException
  333.      * @throws IOException
  334.      */
  335.     public static BCECPrivateKey convertSEC1ToBCECPrivateKey(byte[] sec1Key)
  336.             throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeySpecException, IOException {
  337.         PKCS8EncodedKeySpec peks = new PKCS8EncodedKeySpec(convertECPrivateKeySEC1ToPKCS8(sec1Key));
  338.         KeyFactory kf = KeyFactory.getInstance(ALGO_NAME_EC, BouncyCastleProvider.PROVIDER_NAME);
  339.         return (BCECPrivateKey) kf.generatePrivate(peks);
  340.     }
  341.  
  342.     /**
  343.      * 将SEC1标准的私钥字节流转为ECPrivateKeyParameters对象
  344.      * openssl i2d_ECPrivateKey函数生成的DER编码的ecc私钥是：SEC1标准的、带有EC_GROUP、带有公钥的，
  345.      * 这个工具函数的主要目的就是为了使Java程序能够“识别”openssl生成的ECC私钥
  346.      *
  347.      * @param sec1Key
  348.      * @return
  349.      * @throws NoSuchAlgorithmException
  350.      * @throws NoSuchProviderException
  351.      * @throws InvalidKeySpecException
  352.      */
  353.     public static ECPrivateKeyParameters convertSEC1ToECPrivateKey(byte[] sec1Key)
  354.             throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeySpecException, IOException {
  355.         BCECPrivateKey privateKey = convertSEC1ToBCECPrivateKey(sec1Key);
  356.         return convertPrivateKeyToParameters(privateKey);
  357.     }
  358.  
  359.     /**
  360.      * 将ECC公钥对象转换为X509标准的字节流
  361.      *
  362.      * @param pubKey
  363.      * @return
  364.      */
  365.     public static byte[] convertECPublicKeyToX509(ECPublicKeyParameters pubKey) {
  366.         ECDomainParameters domainParams = pubKey.getParameters();
  367.         ECParameterSpec spec = new ECParameterSpec(domainParams.getCurve(), domainParams.getG(),
  368.                 domainParams.getN(), domainParams.getH());
  369.         BCECPublicKey publicKey = new BCECPublicKey(ALGO_NAME_EC, pubKey, spec,
  370.                 BouncyCastleProvider.CONFIGURATION);
  371.         return publicKey.getEncoded();
  372.     }
  373.  
  374.     /**
  375.      * 将X509标准的公钥字节流转为公钥对象
  376.      *
  377.      * @param x509Bytes
  378.      * @return
  379.      * @throws NoSuchProviderException
  380.      * @throws NoSuchAlgorithmException
  381.      * @throws InvalidKeySpecException
  382.      */
  383.     public static BCECPublicKey convertX509ToECPublicKey(byte[] x509Bytes) throws NoSuchProviderException,
  384.             NoSuchAlgorithmException, InvalidKeySpecException {
  385.         X509EncodedKeySpec eks = new X509EncodedKeySpec(x509Bytes);
  386.         KeyFactory kf = KeyFactory.getInstance("EC", BouncyCastleProvider.PROVIDER_NAME);
  387.         return (BCECPublicKey) kf.generatePublic(eks);
  388.     }
  389.  
  390.     /**
  391.      * 将X509标准的公钥字节流转为PEM
  392.      *
  393.      * @param encodedKey
  394.      * @return
  395.      * @throws IOException
  396.      */
  397.     public static String convertECPublicKeyX509ToPEM(byte[] encodedKey) throws IOException {
  398.         return convertEncodedDataToPEM(PEM_STRING_PUBLIC, encodedKey);
  399.     }
  400.  
  401.     /**
  402.      * 将PEM格式的公钥转为X509标准的字节流
  403.      *
  404.      * @param pemString
  405.      * @return
  406.      * @throws IOException
  407.      */
  408.     public static byte[] convertECPublicKeyPEMToX509(String pemString) throws IOException {
  409.         return convertPEMToEncodedData(pemString);
  410.     }
  411.  
  412.     /**
  413.      * copy from BC
  414.      *
  415.      * @param genSpec
  416.      * @return
  417.      */
  418.     public static X9ECParameters getDomainParametersFromGenSpec(ECGenParameterSpec genSpec) {
  419.         return getDomainParametersFromName(genSpec.getName());
  420.     }
  421.  
  422.     /**
  423.      * copy from BC
  424.      *
  425.      * @param curveName
  426.      * @return
  427.      */
  428.     public static X9ECParameters getDomainParametersFromName(String curveName) {
  429.         X9ECParameters domainParameters;
  430.         try {
  431.             if (curveName.charAt(0) >= '0' && curveName.charAt(0) <= '2') {
  432.                 ASN1ObjectIdentifier oidID = new ASN1ObjectIdentifier(curveName);
  433.                 domainParameters = ECUtil.getNamedCurveByOid(oidID);
  434.             } else {
  435.                 if (curveName.indexOf(' ') > 0) {
  436.                     curveName = curveName.substring(curveName.indexOf(' ') + 1);
  437.                     domainParameters = ECUtil.getNamedCurveByName(curveName);
  438.                 } else {
  439.                     domainParameters = ECUtil.getNamedCurveByName(curveName);
  440.                 }
  441.             }
  442.         } catch (IllegalArgumentException ex) {
  443.             domainParameters = ECUtil.getNamedCurveByName(curveName);
  444.         }
  445.         return domainParameters;
  446.     }
  447.  
  448.     /**
  449.      * copy from BC
  450.      *
  451.      * @param ecSpec
  452.      * @param withCompression
  453.      * @return
  454.      */
  455.     public static X962Parameters getDomainParametersFromName(
  456.             java.security.spec.ECParameterSpec ecSpec, boolean withCompression) {
  457.         X962Parameters params;
  458.  
  459.         if (ecSpec instanceof ECNamedCurveSpec) {
  460.             ASN1ObjectIdentifier curveOid = ECUtil.getNamedCurveOid(((ECNamedCurveSpec) ecSpec).getName());
  461.             if (curveOid == null) {
  462.                 curveOid = new ASN1ObjectIdentifier(((ECNamedCurveSpec) ecSpec).getName());
  463.             }
  464.             params = new X962Parameters(curveOid);
  465.         } else if (ecSpec == null) {
  466.             params = new X962Parameters(DERNull.INSTANCE);
  467.         } else {
  468.             ECCurve curve = EC5Util.convertCurve(ecSpec.getCurve());
  469.  
  470.             X9ECParameters ecP = new X9ECParameters(
  471.                     curve,
  472.                     new X9ECPoint(EC5Util.convertPoint(curve, ecSpec.getGenerator()), withCompression),
  473.                     ecSpec.getOrder(),
  474.                     BigInteger.valueOf(ecSpec.getCofactor()),
  475.                     ecSpec.getCurve().getSeed());
  476.  
  477.             // 如果是1.62或更低版本的bcprov-jdk15on应该使用以下这段代码，因为高版本的EC5Util.convertPoint没有向下兼容
  478.             /*
  479.             X9ECParameters ecP = new X9ECParameters(
  480.                 curve,
  481.                 EC5Util.convertPoint(curve, ecSpec.getGenerator(), withCompression),
  482.                 ecSpec.getOrder(),
  483.                 BigInteger.valueOf(ecSpec.getCofactor()),
  484.                 ecSpec.getCurve().getSeed());
  485.             */
  486.  
  487.             params = new X962Parameters(ecP);
  488.         }
  489.  
  490.         return params;
  491.     }
  492.  
  493.     private static String convertEncodedDataToPEM(String type, byte[] encodedData) throws IOException {
  494.         ByteArrayOutputStream bOut = new ByteArrayOutputStream();
  495.         PemWriter pWrt = new PemWriter(new OutputStreamWriter(bOut));
  496.         try {
  497.             PemObject pemObj = new PemObject(type, encodedData);
  498.             pWrt.writeObject(pemObj);
  499.         } finally {
  500.             pWrt.close();
  501.         }
  502.         return new String(bOut.toByteArray());
  503.     }
  504.  
  505.     private static byte[] convertPEMToEncodedData(String pemString) throws IOException {
  506.         ByteArrayInputStream bIn = new ByteArrayInputStream(pemString.getBytes());
  507.         PemReader pRdr = new PemReader(new InputStreamReader(bIn));
  508.         try {
  509.             PemObject pemObject = pRdr.readPemObject();
  510.             return pemObject.getContent();
  511.         } finally {
  512.             pRdr.close();
  513.         }
  514.     }
  515. }

SM2Util.java

  1. package GMSM;
  2.  
  3. import org.bouncycastle.asn1.gm.GMNamedCurves;
  4. import org.bouncycastle.asn1.x9.X9ECParameters;
  5. import org.bouncycastle.crypto.CryptoException;
  6. import org.bouncycastle.crypto.InvalidCipherTextException;
  7. import org.bouncycastle.crypto.engines.SM2Engine;
  8. import org.bouncycastle.crypto.params.*;
  9. import org.bouncycastle.crypto.signers.SM2Signer;
  10. import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPrivateKey;
  11. import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPublicKey;
  12. import org.bouncycastle.jce.provider.BouncyCastleProvider;
  13. import org.bouncycastle.math.ec.ECCurve;
  14. import org.bouncycastle.math.ec.ECPoint;
  15. import org.bouncycastle.math.ec.custom.gm.SM2P256V1Curve;
  16. import org.bouncycastle.pqc.math.linearalgebra.ByteUtils;
  17. import org.bouncycastle.util.Strings;
  18. import org.bouncycastle.util.encoders.Base64;
  19. import org.bouncycastle.util.encoders.Hex;
  20.  
  21. import java.math.BigInteger;
  22. import java.nio.charset.Charset;
  23. import java.security.KeyPair;
  24. import java.security.KeyPairGenerator;
  25. import java.security.NoSuchAlgorithmException;
  26. import java.security.SecureRandom;
  27. import java.security.Security;
  28. import java.security.spec.ECFieldFp;
  29. import java.security.spec.ECGenParameterSpec;
  30. import java.security.spec.EllipticCurve;
  31.  
  32. /**
  33.  * SM2 工具类
  34.  */
  35. public class SM2Util {
  36. 	
  37. 	static {
  38.         Security.addProvider(new BouncyCastleProvider());
  39.     }
  40. 	
  41.     //
  42.     /*
  43.      * 以下为SM2推荐曲线参数
  44.      */
  45.     public static final SM2P256V1Curve CURVE = new SM2P256V1Curve();
  46.     public final static BigInteger SM2_ECC_P = CURVE.getQ();
  47.     public final static BigInteger SM2_ECC_A = CURVE.getA().toBigInteger();
  48.     public final static BigInteger SM2_ECC_B = CURVE.getB().toBigInteger();
  49.     public final static BigInteger SM2_ECC_N = CURVE.getOrder();
  50.     public final static BigInteger SM2_ECC_H = CURVE.getCofactor();
  51.     public final static BigInteger SM2_ECC_GX = new BigInteger(
  52.             "32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7", 16);
  53.     public final static BigInteger SM2_ECC_GY = new BigInteger(
  54.             "BC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0", 16);
  55.     public static final ECPoint G_POINT = CURVE.createPoint(SM2_ECC_GX, SM2_ECC_GY);
  56.     public static final ECDomainParameters DOMAIN_PARAMS = new ECDomainParameters(CURVE, G_POINT,
  57.             SM2_ECC_N, SM2_ECC_H);
  58.     public static final int CURVE_LEN = BCECUtil.getCurveLength(DOMAIN_PARAMS);
  59.     //
  60.  
  61.     public static final EllipticCurve JDK_CURVE = new EllipticCurve(new ECFieldFp(SM2_ECC_P), SM2_ECC_A, SM2_ECC_B);
  62.     public static final java.security.spec.ECPoint JDK_G_POINT = new java.security.spec.ECPoint(
  63.             G_POINT.getAffineXCoord().toBigInteger(), G_POINT.getAffineYCoord().toBigInteger());
  64.     public static final java.security.spec.ECParameterSpec JDK_EC_SPEC = new java.security.spec.ECParameterSpec(
  65.             JDK_CURVE, JDK_G_POINT, SM2_ECC_N, SM2_ECC_H.intValue());
  66.  
  67.     //
  68.  
  69. 	
  70. 	// SM2推荐曲线名称
  71. 	public static final String SM2_CURVE_NAME = "sm2p256v1";
  72.  
  73. 	public static final Charset UTF_8 = Charset.forName("utf-8");
  74.  
  75. 	/**
  76. 	 * 生成密钥
  77. 	 *
  78. 	 * @return
  79. 	 * @throws Exception
  80. 	 */
  81. 	public static KeyPair genKeyPair() throws Exception {
  82. 		final ECGenParameterSpec sm2Spec = new ECGenParameterSpec(SM2_CURVE_NAME);
  83. 		// 获取一个椭圆曲线类型的密钥对生成器
  84. 		final KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC", new BouncyCastleProvider());
  85. 		SecureRandom random = new SecureRandom();
  86. 		// 使用SM2的算法区域初始化密钥生成器
  87. 		kpg.initialize(sm2Spec, random);
  88. 		// 获取密钥对
  89. 		KeyPair keyPair = kpg.generateKeyPair();
  90.  
  91. 		return keyPair;
  92. 	}
  93.  
  94. 	/**
  95. 	 * SM2根据公钥加密 param: message 待加密内容 ， publicKey 加密公钥（BASE64编码） return:
  96. 	 * 加密信息的Base64编码
  97. 	 * 
  98. 	 * @throws InvalidCipherTextException
  99. 	 */
  100. 	public static String encryptBySM2(String message, String publicKey) throws InvalidCipherTextException {
  101. 		ECDomainParameters domin = getDomain();
  102. 		// 公钥对象
  103. 		ECPublicKeyParameters pubKeyParameters = getPubKey(publicKey, domin);
  104.  
  105. 		byte[] cipherBytes = new byte[0];
  106.  
  107. 		cipherBytes = encrypt(SM2Engine.Mode.C1C3C2, pubKeyParameters, message.getBytes(UTF_8));
  108.  
  109. 		return Base64.toBase64String(cipherBytes);
  110. 	}
  111.  
  112. 	/**
  113. 	 * SM2根据私钥解密 param： cipherText 待解密密文 privateKey-私钥（BASE64编码）
  114. 	 */
  115. 	public static String decryptBySM2(String cipherText, String privateKey) throws InvalidCipherTextException {
  116. 		BigInteger d = new BigInteger(1, Base64.decode(privateKey));
  117. 		ECDomainParameters domin = getDomain();
  118. 		// 私钥对象
  119. 		ECPrivateKeyParameters ecPrivateKeyParameters = new ECPrivateKeyParameters(d, domin);
  120. 		byte[] decrypt = decrypt(SM2Engine.Mode.C1C3C2, ecPrivateKeyParameters, Base64.decode(cipherText));
  121. 		return new String(decrypt, UTF_8);
  122. 	}
  123.  
  124. 	/**
  125. 	 * 根据公钥字符串创建公钥对象
  126. 	 *
  127. 	 */
  128. 	public static ECPublicKeyParameters getPubKey(String publicKey, ECDomainParameters domain) {
  129. 		ECCurve curve = domain.getCurve();
  130. 		ECPoint point = curve.decodePoint(Base64.decode(publicKey));
  131. 		ECPublicKeyParameters PublicKey = new ECPublicKeyParameters(point, domain);
  132. 		return PublicKey;
  133. 	}
  134.  
  135. 	/**
  136. 	 * @param mode             指定密文结构，旧标准的为C1C2C3，新的[《SM2密码算法使用规范》 GM/T
  137. 	 *                         0009-2012]标准为C1C3C2
  138. 	 * @param pubKeyParameters 公钥
  139. 	 * @param srcData          原文
  140. 	 * @return 根据mode不同，输出的密文C1C2C3排列顺序不同。C1为65字节第1字节为压缩标识，这里固定为0x04，后面64字节为xy分量各32字节。C3为32字节。C2长度与原文一致。
  141. 	 * @throws InvalidCipherTextException
  142. 	 */
  143. 	public static byte[] encrypt(SM2Engine.Mode mode, ECPublicKeyParameters pubKeyParameters, byte[] srcData)
  144. 			throws InvalidCipherTextException {
  145. 		SM2Engine engine = new SM2Engine(mode);
  146. 		ParametersWithRandom pwr = new ParametersWithRandom(pubKeyParameters, new SecureRandom());
  147. 		engine.init(true, pwr);
  148. 		return engine.processBlock(srcData, 0, srcData.length);
  149. 	}
  150.  
  151. 	/**
  152. 	 * @param mode             指定密文结构，旧标准的为C1C2C3，新的[《SM2密码算法使用规范》 GM/T
  153. 	 *                         0009-2012]标准为C1C3C2
  154. 	 * @param priKeyParameters 私钥
  155. 	 * @param sm2Cipher        根据mode不同，需要输入的密文C1C2C3排列顺序不同。C1为65字节第1字节为压缩标识，这里固定为0x04，后面64字节为xy分量各32字节。C3为32字节。C2长度与原文一致。
  156. 	 * @return 原文。SM2解密返回了数据则一定是原文，因为SM2自带校验，如果密文被篡改或者密钥对不上，都是会直接报异常的。
  157. 	 * @throws InvalidCipherTextException
  158. 	 */
  159. 	public static byte[] decrypt(SM2Engine.Mode mode, ECPrivateKeyParameters priKeyParameters, byte[] sm2Cipher)
  160. 			throws InvalidCipherTextException {
  161. 		SM2Engine engine = new SM2Engine(mode);
  162. 		engine.init(false, priKeyParameters);
  163. 		return engine.processBlock(sm2Cipher, 0, sm2Cipher.length);
  164. 	}
  165.  
  166. 	public static ECDomainParameters getDomain() {
  167. 		// 获取一条SM2曲线参数
  168. 		X9ECParameters x9ECParameters = GMNamedCurves.getByName(SM2_CURVE_NAME);
  169. 		// 构造domain参数
  170. 		ECDomainParameters domain = new ECDomainParameters(x9ECParameters.getCurve(), x9ECParameters.getG(),
  171. 				x9ECParameters.getN(), x9ECParameters.getH());
  172. 		return domain;
  173. 	}
  174.  
  175. 	/**
  176. 	 * 私钥签名
  177. 	 * 
  178. 	 * @param privateKey 私钥
  179. 	 * @param content    待签名内容
  180. 	 * @return
  181. 	 */
  182. 	public static String sign(String privateKey, String content) throws CryptoException, CryptoException {
  183. 		// 待签名内容转为字节数组
  184. 		byte[] message = content.getBytes();
  185.  
  186. 		BigInteger domainParameters = new BigInteger(1, Base64.decode(privateKey));
  187. 		ECDomainParameters domin = getDomain();
  188.  
  189. 		// 私钥对象
  190. 		ECPrivateKeyParameters privateKeyParameters = new ECPrivateKeyParameters(domainParameters, domin);
  191.  
  192. 		// 创建签名实例
  193. 		SM2Signer sm2Signer = new SM2Signer();
  194.  
  195. 		// 初始化签名实例,带上ID,国密的要求,ID默认值:1234567812345678
  196. 		try {
  197. 			sm2Signer.init(true,
  198. 					new ParametersWithID(
  199. 							new ParametersWithRandom(privateKeyParameters, SecureRandom.getInstance("SHA1PRNG")),
  200. 							Strings.toByteArray("1234567812345678")));
  201. 		} catch (NoSuchAlgorithmException e) {
  202. 			e.printStackTrace();
  203. 		}
  204. 		sm2Signer.update(message, 0, message.length);
  205. 		// 生成签名,签名分为两部分r和s,分别对应索引0和1的数组
  206. 		byte[] signBytes = sm2Signer.generateSignature();
  207.  
  208. 		String sign = Base64.toBase64String(signBytes);
  209.  
  210. 		return sign;
  211. 	}
  212.  
  213. 	/**
  214. 	 * 验证签名
  215. 	 * 
  216. 	 * @param publicKey 公钥
  217. 	 * @param content   待签名内容
  218. 	 * @param sign      签名值
  219. 	 * @return
  220. 	 */
  221. 	public static boolean verify(String publicKey, String content, String sign) {
  222. 		// 待签名内容
  223. 		byte[] message = content.getBytes();
  224. 		byte[] signData = Base64.decode(sign);
  225.  
  226. 		// 获取一条SM2曲线参数
  227. 		X9ECParameters sm2ECParameters = GMNamedCurves.getByName(SM2_CURVE_NAME);
  228. 		// 构造domain参数
  229. 		ECDomainParameters domainParameters = new ECDomainParameters(sm2ECParameters.getCurve(), sm2ECParameters.getG(),
  230. 				sm2ECParameters.getN());
  231. 		// 提取公钥点
  232. 		ECPoint pukPoint = sm2ECParameters.getCurve().decodePoint(java.util.Base64.getDecoder().decode(publicKey));
  233. 		// 公钥前面的02或者03表示是压缩公钥，04表示未压缩公钥, 04的时候，可以去掉前面的04
  234. 		ECPublicKeyParameters publicKeyParameters = new ECPublicKeyParameters(pukPoint, domainParameters);
  235. 		// 创建签名实例
  236. 		SM2Signer sm2Signer = new SM2Signer();
  237. 		ParametersWithID parametersWithID = new ParametersWithID(publicKeyParameters,
  238. 				Strings.toByteArray("1234567812345678"));
  239. 		sm2Signer.init(false, parametersWithID);
  240. 		sm2Signer.update(message, 0, message.length);
  241. 		// 验证签名结果
  242. 		boolean verify = sm2Signer.verifySignature(signData);
  243. 		return verify;
  244. 	}
  245. 	
  246.     /**
  247.      * 获取私钥（16进制字符串，头部不带00长度共64）
  248.      * @param privateKey 私钥
  249.      * @return
  250.      */
  251.     public static String getPriKeyHexString(PrivateKey privateKey){
  252.         BCECPrivateKey s=(BCECPrivateKey)privateKey;
  253.         String priKeyHexString = Hex.toHexString(s.getD().toByteArray());
  254.         if(null!= priKeyHexString && priKeyHexString.length()==66 && "00".equals(priKeyHexString.substring(0,2))){
  255.             return priKeyHexString.substring(2);
  256.         }
  257.         return priKeyHexString;
  258.     }
  259.  
  260.     /**
  261.      * 获取公钥（16进制字符串，头部带04长度共130）
  262.      * @param publicKey
  263.      * @return
  264.      */
  265.     public static String getPubKeyHexString(PublicKey publicKey){
  266.         BCECPublicKey p=(BCECPublicKey)publicKey;
  267.         return Hex.toHexString(p.getQ().getEncoded(false));
  268.     }
  269.     
  270. }

6、写一个main方法

  1. public static void main(String[] args) throws Exception {
  2. 		
  3. 		//openssl生成sm2公私钥对
  4. 		//公钥
  5. 		String pu1 = "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEmxmSy4HOD2d2sakaJTw0QFhRGZs25umcKzmg12FAsYNjVRmtLxcbydzTMELGKpHHle//IZ0Eqx7P15IKiyoK/g==";
  6. 		//私钥
  7. 		String pr1 = "MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgilIj1dWX+977jcQOoHDQq6XtbWaazcZdJiHjXpAhKD6hRANCAASbGZLLgc4PZ3axqRolPDRAWFEZmzbm6ZwrOaDXYUCxg2NVGa0vFxvJ3NMwQsYqkceV7/8hnQSrHs/XkgqLKgr+";
  8. 		
  9. 		//公钥文件是x509格式，转换成ECPublicKey，提取真正的公钥
  10. 		byte[] x509pu1 = Base64.decode(pu1);
  11. 		BCECPublicKey bcecPublicKey = BCECUtil.convertX509ToECPublicKey(x509pu1);
  12. 		String s1 = ByteUtils.toHexString(bcecPublicKey.getQ().getEncoded(false));
  13. 		System.out.println("公钥：" + s1);
  14. 		
  15. 		//私钥文件是pkcs8格式，转换成ECPrivateKey，提取真正的私钥
  16. 		byte[] x509pr1 = Base64.decode(pr1);
  17. 		BCECPrivateKey bcecPrivateKey = BCECUtil.convertPKCS8ToECPrivateKey(x509pr1);
  18. 		String s2 = ByteUtils.toHexString(bcecPrivateKey.getD().toByteArray());
  19. 		//java会在私钥前加00，要去除
  20. 		s2 = s2.substring(2);
  21. 		System.out.println("私钥：" + s2);
  22. 		
  23. 		System.out.println("==========测试加密解密==========");
  24. 		
  25. 		//String publicKey = "049b1992cb81ce0f6776b1a91a253c34405851199b36e6e99c2b39a0d76140b183635519ad2f171bc9dcd33042c62a91c795efff219d04ab1ecfd7920a8b2a0afe";
  26. 		String publicKey = s1;
  27. 		String str = "11111111111111111111111111111111111111111111111111111111111";
  28. 		String en = encryptBySM2(str, Base64.toBase64String(Hex.decode(publicKey)) );
  29. 		System.out.println("加密后：" + en);
  30. 		//String privateKey = "8a5223d5d597fbdefb8dc40ea070d0aba5ed6d669acdc65d2621e35e9021283e";
  31. 		String privateKey = s2;
  32. 		String de = decryptBySM2(en, Base64.toBase64String(Hex.decode(privateKey)) );
  33. 		System.out.println("解密后：" + de);
  34. 		
  35. 		System.out.println("==========测试签名验签==========");
  36. 		
  37. 		String sign = sign(Base64.toBase64String(Hex.decode(privateKey)), str);
  38. 		System.out.println("sign：" + sign);
  39. 		boolean flag = verify(Base64.toBase64String(Hex.decode(publicKey)), str, sign);
  40. 		System.out.println("验签结果：" + flag);
  41. 	}

执行结果：

  1. 公钥：049b1992cb81ce0f6776b1a91a253c34405851199b36e6e99c2b39a0d76140b183635519ad2f171bc9dcd33042c62a91c795efff219d04ab1ecfd7920a8b2a0afe
  2. 私钥：8a5223d5d597fbdefb8dc40ea070d0aba5ed6d669acdc65d2621e35e9021283e
  3. ==========测试加密解密==========
  4. 加密后：BKIe16SRgAgHGgOalBDv1xtIONHVQtrfCXpnVnH2iOwhKoXXYLCDrp8FlcNtJwnpJxtF9soslWvO+HhfpmW4knRBGk+NLs9ftf+mSeNaVkFG2ySt0tIjUKHl51GUZlkW1yQ/DRm7w9BNheJgow+PX5jorKhzM1IIv2AshlNFQg9Yut066j+5dLtE+no5/32O9+4dP80z6jGc+FcI
  5. 解密后：11111111111111111111111111111111111111111111111111111111111
  6. ==========测试签名验签==========
  7. sign：MEUCICKGZZ5X1JAFa40/vtqD4de+HKh9rAiWaAtiUKVAODPgAiEAkXcnA3OxcXk0latkmmr3KS5ptwBI6PiPVJcyJJrnSp8=
  8. 验签结果：true

密钥和命令解析出来的一样。
依赖包：bcprov-jdk15on-1.70.jar

SM2加密算法的结果长度，取决于明文长度，没记错的话是C1+C2+C3, C1和C3是定长，分别为64字节和32字节，C2的长度等于明文长度
准确的计算过程，可以看看GM/T 0003.4

用密钥明文16进制转16进制字符串再base64编码：

  1.     public static void main(String[] args) throws Exception {
  2.     	//公钥明文字符串转base64编码，公钥明文字符串128字节长度不带04
  3. 		String pu2 = "OWIxOTkyY2I4MWNlMGY2Nzc2YjFhOTFhMjUzYzM0NDA1ODUxMTk5YjM2ZTZlOTljMmIzOWEwZDc2MTQwYjE4MzYzNTUxOWFkMmYxNzFiYzlkY2QzMzA0MmM2MmE5MWM3OTVlZmZmMjE5ZDA0YWIxZWNmZDc5MjBhOGIyYTBhZmU=";
  4. 		//私钥明文字符串转base64编码，私钥明文字符串64字节长度
  5. 		String pr2 = "OGE1MjIzZDVkNTk3ZmJkZWZiOGRjNDBlYTA3MGQwYWJhNWVkNmQ2NjlhY2RjNjVkMjYyMWUzNWU5MDIxMjgzZQ==";
  6. 		
  7. 		//base64解码
  8. 		String s3 = "04" + new String(Base64.decode(pu2)); //公钥前加04
  9. 		String s4 = new String(Base64.decode(pr2));
  10. 		System.out.println("公钥：" + s3);
  11. 		System.out.println("私钥：" + s4);
  12. 		
  13. 		byte pub2[] = Hex.decode("04" + new String(Base64.decode(pu2))); 
  14. 		byte pri2[] = Hex.decode(new String(Base64.decode(pr2)));
  15. 		
  16. 		String str = "11111111111111111111111111111111111111111111111111111111111";
  17. 		
  18. 		System.out.println("==========测试加密解密==========");
  19. 		
  20. 		String en = encryptBySM2(str, Base64.toBase64String(pub2));
  21. 		System.out.println("加密后：" + en);
  22. 		String de = decryptBySM2(en, Base64.toBase64String(pri2));
  23. 		System.out.println("解密后：" + de);
  24. 		
  25. 		System.out.println("==========测试签名验签==========");
  26. 		
  27. 		String sign = sign(Base64.toBase64String(pri2), str);
  28. 		System.out.println("sign：" + sign);
  29. 		boolean flag = verify(Base64.toBase64String(pub2), str, sign);
  30. 		System.out.println("验签结果：" + flag);
  31. 		
  32. 	}

执行结果：

  1. 公钥：049b1992cb81ce0f6776b1a91a253c34405851199b36e6e99c2b39a0d76140b183635519ad2f171bc9dcd33042c62a91c795efff219d04ab1ecfd7920a8b2a0afe
  2. 私钥：8a5223d5d597fbdefb8dc40ea070d0aba5ed6d669acdc65d2621e35e9021283e
  3. ==========测试加密解密==========
  4. 加密后：BIPG2WfWmBz+xU/btAI796VF7RX53WYZfsujS2ICC5umdS7x6hIE+zDEJpStVY/rAYmJeqEsmNx2oHN/8rbWiDgkZJS2xZL50br+a2RThzmh2fcdFSy3MtNcvcFGB/FD/h+pm5ImdPO94HD9Efv3apNum3/V5sNxUOM08YMgXrIYx30osZzBE41NSfO7El2NM5Ryy7xj0qgPmq3j
  5. 解密后：11111111111111111111111111111111111111111111111111111111111
  6. ==========测试签名验签==========
  7. sign：MEUCIQDTzmVPjkPqPvpV2hMJvqPIMNjakS5/iMY5aeIGIYjGAAIgOREKqHSC0bfb1RIbhGz80wKpU87qqFYYCxyjiI64CRg=
  8. 验签结果：true

用工具类生成密钥对：

  1.     public static void main(String[] args) throws NoSuchAlgorithmException, InvalidAlgorithmParameterException {
  2.  
  3.         String M="encryption standard";
  4.         System.out.println("\n明文："+ M);
  5.  
  6.         SM2Util sm2 = new SM2Util();
  7.         KeyPair keyPair = sm2.geneSM2KeyPair();
  8.  
  9.         PublicKey publicKey = keyPair.getPublic();
  10.         String pubKeyHexString = sm2.getPubKeyHexString(publicKey);
  11.         System.out.println("公钥："+ pubKeyHexString);
  12.  
  13.         PrivateKey privateKey = keyPair.getPrivate();
  14.         String priKeyHexString = sm2.getPriKeyHexString(privateKey);
  15.         System.out.println("私钥："+ priKeyHexString);
  16.  
  17.         String cipherData = sm2.encrypt(pubKeyHexString, M);
  18.         System.out.println("密文：" + cipherData);
  19.  
  20.         String text=sm2.decrypt(priKeyHexString, cipherData);
  21.         System.out.println("解密："+text);
  22.     }

参考资料：
支付对接常用的加密方式介绍以及java代码实现_京东云官方的技术博客_51CTO博客

对于如何从SM2的pfx证书文件中解析公钥和私钥，并从二次加密的密文中解密 - 旧信 - 博客园 (cnblogs.com)

GitHub - ZZMarquis/gmhelper: 基于BC库：国密SM2/SM3/SM4算法简单封装；实现SM2 X509v3证书的签发；实现SM2 pfx证书的签发

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/盐析白兔/article/detail/363197
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号