Java持久化秘钥

加密算法的秘钥持久化是是一个不可避免的话题，如何安全的存储更是重中之重。将秘钥保存在文件中是最简单的一种方法，下面来讨论如何使用Java代码将秘钥保存到文件中。

保存到文件中的秘钥最好用PBE进行口令加密。

下面介绍几种简单的保存秘钥的方式，以RSA秘钥为例。

1 保存PEM文件

PEM（Privacy Enhanced Mail）格式是一种安全的文件格式，主要用于存储证书、密钥和其他数据。它的格式遵循Base64编码规则，以“-----BEGIN CERTIFICATE-----“和”-----END CERTIFICATE-----"两句作为文件头尾标识。

PEM格式的证书包含数字证书（如SSL证书）、密钥、CSR（Certificate Signing Request）和其他文件。

PEM文件通常以.pem, .crt, .cer, .key等扩展名命名。

package com.qupeng.crypto.util;import org.bouncycastle.util.Strings;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemReader;
import org.bouncycastle.util.io.pem.PemWriter;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;import java.io.*;
import java.math.BigInteger;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.StandardOpenOption;
import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.spec.*;public class SecretKeyPersistence {public static void writePublicKeyToPem(PublicKey publicKey, Path keyFilePath) throws IOException {try (FileWriter fileWriter = new FileWriter(keyFilePath.toFile()); PemWriter pemWriter = new PemWriter(fileWriter)) {pemWriter.writeObject(new PemObject("RSA PUBLIC KEY", publicKey.getEncoded()));}}public static PublicKey readPublicKeyFromPem(Path keyFilePath) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {try (FileReader fileReader = new FileReader(keyFilePath.toFile()); PemReader pemReader = new PemReader(fileReader)) {PemObject pemObject = pemReader.readPemObject();X509EncodedKeySpec encPubKeySpec = new X509EncodedKeySpec(pemObject.getContent());PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(encPubKeySpec);return publicKey;}}public static void writePrivateKeyToPem(PrivateKey privateKey, Path keyFilePath) throws IOException {try (FileWriter fileWriter = new FileWriter(keyFilePath.toFile()); PemWriter pemWriter = new PemWriter(fileWriter)) {pemWriter.writeObject(new PemObject("RSA PRIVATE KEY", privateKey.getEncoded()));}}public static PrivateKey readPrivateKeyFromPem(Path keyFilePath) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {try (FileReader fileReader = new FileReader(keyFilePath.toFile()); PemReader pemReader = new PemReader(fileReader)) {PemObject pemObject = pemReader.readPemObject();PKCS8EncodedKeySpec encPriKeySpec = new PKCS8EncodedKeySpec(pemObject.getContent());PrivateKey privateKey = KeyFactory.getInstance("RSA").generatePrivate(encPriKeySpec);return privateKey;}}
}

引入bouncycastle依赖

        <dependency><groupId>org.bouncycastle</groupId><artifactId>bcpg-jdk18on</artifactId><version>1.72</version></dependency><dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk18on</artifactId><version>1.72</version></dependency>

2 保存文本文件

将秘钥保存到普通的文本文件中。

package com.qupeng.crypto.util;import org.bouncycastle.util.Strings;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemReader;
import org.bouncycastle.util.io.pem.PemWriter;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;import java.io.*;
import java.math.BigInteger;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.StandardOpenOption;
import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.spec.*;public class SecretKeyPersistence {public static void writePublicKeyToTxt(PublicKey publicKey, Path keyFilePath) throws IOException {Files.write(keyFilePath, new BASE64Encoder().encode(publicKey.getEncoded()).getBytes(), StandardOpenOption.CREATE, StandardOpenOption.WRITE, StandardOpenOption.TRUNCATE_EXISTING);}public static PublicKey readPublicKeyFromTxt(Path keyFilePath) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {X509EncodedKeySpec encPubKeySpec = new X509EncodedKeySpec(new BASE64Decoder().decodeBuffer(Strings.fromByteArray(Files.readAllBytes(keyFilePath))));PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(encPubKeySpec);return publicKey;}public static void writePrivateKeyToTxt(PrivateKey privateKey, Path keyFilePath) throws IOException {Files.write(keyFilePath, new BASE64Encoder().encode(privateKey.getEncoded()).getBytes(), StandardOpenOption.CREATE, StandardOpenOption.WRITE, StandardOpenOption.TRUNCATE_EXISTING);}public static PrivateKey readPrivateKeyFromTxt(Path keyFilePath) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {PKCS8EncodedKeySpec encPriKeySpec = new PKCS8EncodedKeySpec(new BASE64Decoder().decodeBuffer(Strings.fromByteArray(Files.readAllBytes(keyFilePath))));PrivateKey privateKey = KeyFactory.getInstance("RSA").generatePrivate(encPriKeySpec);return privateKey;}
}

3 Java序列化

这里利用Java系列保存类 RSAPublicKeySpec。RSAPublicKeySpec用于描述秘钥规格。

package com.qupeng.crypto.util;import org.bouncycastle.util.Strings;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemReader;
import org.bouncycastle.util.io.pem.PemWriter;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;import java.io.*;
import java.math.BigInteger;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.StandardOpenOption;
import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.spec.*;public class SecretKeyPersistence {public static void writePublicKeyToObj(PublicKey publicKey, Path keyFilePath) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {try (ObjectOutputStream objectOutputStream = new ObjectOutputStream(new BufferedOutputStream(new FileOutputStream(keyFilePath.toFile())))) {KeyFactory keyFactory = KeyFactory.getInstance("RSA");RSAPublicKeySpec rsaPublicKeySpec = keyFactory.getKeySpec(publicKey, RSAPublicKeySpec.class);objectOutputStream.writeObject(rsaPublicKeySpec.getModulus());objectOutputStream.writeObject(rsaPublicKeySpec.getPublicExponent());}}public static PublicKey readPublicKeyFromObj(Path keyFilePath) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException, ClassNotFoundException {try (ObjectInputStream objectInputStream = new ObjectInputStream(new BufferedInputStream(new FileInputStream(keyFilePath.toFile())))) {BigInteger modulus = (BigInteger)objectInputStream.readObject();BigInteger exponent = (BigInteger)objectInputStream.readObject();RSAPublicKeySpec rsaPublicKeySpec = new RSAPublicKeySpec(modulus, exponent);KeyFactory keyFactory = KeyFactory.getInstance("RSA");return keyFactory.generatePublic(rsaPublicKeySpec);}}public static void writePrivateKeyToObj(PublicKey privateKey, Path keyFilePath) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {try (ObjectOutputStream objectOutputStream = new ObjectOutputStream(new BufferedOutputStream(new FileOutputStream(keyFilePath.toFile())))) {KeyFactory keyFactory = KeyFactory.getInstance("RSA");RSAPublicKeySpec rsaPublicKeySpec = keyFactory.getKeySpec(privateKey, RSAPublicKeySpec.class);objectOutputStream.writeObject(rsaPublicKeySpec.getModulus());objectOutputStream.writeObject(rsaPublicKeySpec.getPublicExponent());}}public static PrivateKey readPrivateKeyFromObj(Path keyFilePath) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException, ClassNotFoundException {try (ObjectInputStream objectInputStream = new ObjectInputStream(new BufferedInputStream(new FileInputStream(keyFilePath.toFile())))) {BigInteger modulus = (BigInteger)objectInputStream.readObject();BigInteger exponent = (BigInteger)objectInputStream.readObject();RSAPrivateKeySpec rsaPrivateKeySpec = new RSAPrivateKeySpec(modulus, exponent);KeyFactory keyFactory = KeyFactory.getInstance("RSA");return keyFactory.generatePrivate(rsaPrivateKeySpec);}}
}

Java加解密（十）持久化秘钥相关推荐

60分钟搞定JAVA加解密
从摩尔电码到小伙伴之间老师来了的暗号,加密信息无处不在.从军事到生活,加密信息的必要性也不言而喻. 今天,我们就来看看java怎么对数据进行加解密分类 a.古典密码 -- 受限制算法:算法的保密性给 ...
Java加解密的艺术书摘
Java加解密的艺术密码学常用术语明文(Plaintext):指待加密信息.明文可以是文本文件.图片文件.二进制数据等. 密文(Ciphertext):指经过加密后的明文.密文通常以文本.二进制数 ...
erlang java 加解密（2）消息摘要算法（MD、SHA、MAC）之SHA
java加解密相关资料和代码参考<java加密与解密的艺>http://snowolf.iteye.com/blog/379860 sha(Data) -> Digest Types ...
crypto-js 前端DES加密/解密、生成秘钥详解
DES概述 DES全称为Data Encryption Standard,即数据加密标准,是一种使用密钥加密的块算法,1977年被美国联邦政府的国家标准局确定为联邦资料处理标准(FIPS),并授权在非 ...
Java加解密（八）PGP协议
目录 PGP协议 1 PGP提供的操作 1.1 身份识别 1.2 机密性 1.3 机密性与鉴别 1.4 电子邮件的兼容性 1.5 压缩 1.6 分段和重装 2 加密密钥和密钥环 2.1 公钥环 2.2 ...
Java 加解密技术系列之 RSA
序距离上一次写博客感觉已经很长时间了,先吐槽一下,这个月以来,公司一直在加班,又是发版.上线,又是新项目太紧,具体的就不多说了,想听我吐槽的小伙伴,可以私信给我(*^__^*) .上一篇文章,已经把 ...
Java 加解密工具类
一.对称加密算法加密和解密使用相同密钥的加密算法.常用的算法包括DES.3DES.AES.DESX.Blowfish.RC4.RC5.RC6. DES(Data Encryption Standa ...
[JAVA加解密]RSA算法、ElGamal算法
一.RSA算法: 1.简介:RSA公钥加密算法是1977年由罗纳德·李维斯特(Ron Rivest).阿迪·萨莫尔(Adi Shamir)和伦纳德·阿德曼(Leonard Adleman)一起提出的. ...
java 3des解密过程_6. Java 加解密技术系列之 3DES
importjavax.crypto.Cipher;importjavax.crypto.SecretKey;importjavax.crypto.spec.SecretKeySpec;importj ...

Java加解密（十）持久化秘钥

目录

Java持久化秘钥

1 保存PEM文件

2 保存文本文件

3 Java序列化

Java加解密（十）持久化秘钥相关推荐

最新文章

热门文章