简单的说就是允许两名用户在公开媒体上交换信息以生成“一致”的、可以共享的密钥。也就是由甲方产出一对密钥（公钥、私钥），乙方依照甲方公钥产生乙方密钥对（公钥、私钥）。

 以此为基线，作为数据传输保密基础，同时双方使用同一种对称加密算法构建本地密钥（SecretKey）对数据加密。这样，在互通了本地密钥（SecretKey）算法后，甲乙双方公开自己的公钥，使用对方的公钥和刚才产生的私钥加密数据，同时可以使用对方的公钥和自己的私钥对数据解密。不单单是甲乙双方两方，可以扩展为多方共享数据通讯，这样就完成了网络交互数据的安全通讯！

2、DH算法的通信模型

    2.1  甲方将自己的公钥发给乙方

   

    2.2  乙方根据甲方发来的公钥，生成自己的公钥和私钥

   

    2.3  乙方将自己的公钥发送给甲方

    

    2.4  甲方和乙方，生成一样的秘钥。用于加密数据

 

3、DH算法的数学原理

4、JDK实现

5、DH算法的编程步骤

5.1  生成密钥对

5.2  使用公钥私钥生成本地密钥

6、DH算法的实现

DHUtil.java

import java.security.InvalidKeyException;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.HashMap;
import java.util.Map;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.KeyAgreement;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.interfaces.DHPrivateKey;
import javax.crypto.interfaces.DHPublicKey;
import javax.crypto.spec.DHParameterSpec;public class DHUtil {/*** 定义加密方式*/private static final String KEY_DH = "DH";public static final String PUBLIC_KEY = "DHPublicKey";public static final String PRIVATE_KEY = "DHPrivateKey";// 开始生成本地密钥SecretKey 密钥算法为对称密码算法// 可以为 DES DES AESpublic static final String KEY_DH_DES = "DES";/*** 甲方初始化并返回密钥对* * @return*/public static Map<String, Object> initKey() {try {// 实例化密钥对生成器KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(KEY_DH);// 初始化密钥对生成器 默认是1024 512-1024 & 64的倍数keyPairGenerator.initialize(1024);// 生成密钥对KeyPair keyPair = keyPairGenerator.generateKeyPair();// 得到甲方公钥DHPublicKey publicKey = (DHPublicKey) keyPair.getPublic();// 得到甲方私钥DHPrivateKey privateKey = (DHPrivateKey) keyPair.getPrivate();// 将公钥和私钥封装在Map中， 方便之后使用Map<String, Object> keyMap = new HashMap<String, Object>();keyMap.put(PUBLIC_KEY, publicKey);keyMap.put(PRIVATE_KEY, privateKey);return keyMap;} catch (Exception e) {throw new RuntimeException(e);}}/*** 乙方根据甲方公钥初始化并返回密钥对* * @param key*            甲方的公钥* @return*/public static Map<String, Object> initKey(byte[] key) {try {// 将甲方公钥从字节数组转换为PublicKeyX509EncodedKeySpec keySpec = new X509EncodedKeySpec(key);// 实例化密钥工厂KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);// 产生甲方公钥pubKeyDHPublicKey dhPublicKey = (DHPublicKey) keyFactory.generatePublic(keySpec);// 剖析甲方公钥，得到其参数DHParameterSpec dhParameterSpec = dhPublicKey.getParams();// 实例化密钥对生成器KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(KEY_DH);// 用甲方公钥初始化密钥对生成器keyPairGenerator.initialize(dhParameterSpec);// 产生密钥对KeyPair keyPair = keyPairGenerator.generateKeyPair();// 得到乙方公钥DHPublicKey publicKey = (DHPublicKey) keyPair.getPublic();// 得到乙方私钥DHPrivateKey privateKey = (DHPrivateKey) keyPair.getPrivate();// 将公钥和私钥封装在Map中， 方便之后使用Map<String, Object> keyMap = new HashMap<String, Object>();keyMap.put(PUBLIC_KEY, publicKey);keyMap.put(PRIVATE_KEY, privateKey);return keyMap;} catch (Exception e) {throw new RuntimeException(e);}}/*** 根据对方的公钥和自己的私钥生成 本地密钥,返回的是SecretKey对象的字节数组* * @param publicKey*            公钥* @param privateKey*            私钥* @return*/public static byte[] getSecretKeyBytes(byte[] publicKey, byte[] privateKey) {try {// 实例化密钥工厂KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);// 将公钥从字节数组转换为PublicKeyX509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(publicKey);PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);// 将私钥从字节数组转换为PrivateKeyPKCS8EncodedKeySpec priKeySpec = new PKCS8EncodedKeySpec(privateKey);PrivateKey priKey = keyFactory.generatePrivate(priKeySpec);// 准备根据以上公钥和私钥生成本地密钥SecretKey// 先实例化KeyAgreementKeyAgreement keyAgreement = KeyAgreement.getInstance(KEY_DH);// 用自己的私钥初始化keyAgreementkeyAgreement.init(priKey);// 结合对方的公钥进行运算keyAgreement.doPhase(pubKey, true);// 开始生成本地密钥SecretKey 密钥算法为对称密码算法SecretKey secretKey = keyAgreement.generateSecret(KEY_DH_DES);return secretKey.getEncoded();} catch (Exception e) {throw new RuntimeException(e);}}/*** 根据对方的公钥和自己的私钥生成 本地密钥,返回的是SecretKey对象* * @param publicKey*            公钥* @param privateKey*            私钥* @return*/public static SecretKey getSecretKey(byte[] publicKey, byte[] privateKey) {try {// 实例化密钥工厂KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);// 将公钥从字节数组转换为PublicKeyX509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(publicKey);PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);// 将私钥从字节数组转换为PrivateKeyPKCS8EncodedKeySpec priKeySpec = new PKCS8EncodedKeySpec(privateKey);PrivateKey priKey = keyFactory.generatePrivate(priKeySpec);// 准备根据以上公钥和私钥生成本地密钥SecretKey// 先实例化KeyAgreementKeyAgreement keyAgreement = KeyAgreement.getInstance(KEY_DH);// 用自己的私钥初始化keyAgreementkeyAgreement.init(priKey);// 结合对方的公钥进行运算keyAgreement.doPhase(pubKey, true);// 开始生成本地密钥SecretKey 密钥算法为对称密码算法SecretKey secretKey = keyAgreement.generateSecret(KEY_DH_DES);return secretKey;} catch (Exception e) {throw new RuntimeException(e);}}/*** 从 Map 中取得公钥* * @param keyMap* @return*/public static byte[] getPublicKey(Map<String, Object> keyMap) {DHPublicKey key = (DHPublicKey) keyMap.get(PUBLIC_KEY);return key.getEncoded();}/*** 从 Map 中取得私钥* * @param keyMap* @return*/public static byte[] getPrivateKey(Map<String, Object> keyMap) {DHPrivateKey key = (DHPrivateKey) keyMap.get(PRIVATE_KEY);return key.getEncoded();}/*** DH 加密* * @param data*            带加密数据* @param publicKey*            甲方公钥* @param privateKey*            乙方私钥* @return*/public static byte[] encryptDH(byte[] data, byte[] publicKey,byte[] privateKey) {byte[] bytes = null;try {//SecretKey secretKey = getSecretKey(publicKey, privateKey);// 数据加密Cipher cipher = Cipher.getInstance(secretKey.getAlgorithm());cipher.init(Cipher.ENCRYPT_MODE, secretKey);bytes = cipher.doFinal(data);} catch (NoSuchAlgorithmException e) {e.printStackTrace();} catch (NoSuchPaddingException e) {e.printStackTrace();} catch (InvalidKeyException e) {e.printStackTrace();} catch (BadPaddingException e) {e.printStackTrace();} catch (IllegalBlockSizeException e) {e.printStackTrace();}return bytes;}/*** DH 解密* * @param data*            待解密数据* @param publicKey*            乙方公钥* @param privateKey*            甲方私钥* @return*/public static byte[] decryptDH(byte[] data, byte[] publicKey,byte[] privateKey) {byte[] bytes = null;try {//SecretKey secretKey = getSecretKey(publicKey, privateKey);// 数据加密Cipher cipher = Cipher.getInstance(secretKey.getAlgorithm());cipher.init(Cipher.DECRYPT_MODE, secretKey);bytes = cipher.doFinal(data);} catch (NoSuchAlgorithmException e) {e.printStackTrace();} catch (NoSuchPaddingException e) {e.printStackTrace();} catch (InvalidKeyException e) {e.printStackTrace();} catch (BadPaddingException e) {e.printStackTrace();} catch (IllegalBlockSizeException e) {e.printStackTrace();}return bytes;}}

字节数组转16进制

public class BytesToHex {public static String fromBytesToHex(byte[] resultBytes) {StringBuilder builder = new StringBuilder();for (int i = 0; i < resultBytes.length; i++) {if (Integer.toHexString(0xFF & resultBytes[i]).length() == 1) {builder.append("0").append(Integer.toHexString(0xFF & resultBytes[i]));} else {builder.append(Integer.toHexString(0xFF & resultBytes[i]));}}return builder.toString();}}

测试代码

import java.util.Map;public class Test {// 待加密的明文public static final String DATA = "test";public static void main(String[] args) throws Exception {/* Test DH */// 甲方公钥byte[] publicKey1;// 甲方私钥byte[] privateKey1;// 甲方本地密钥byte[] secretKey1;// 乙方公钥byte[] publicKey2;// 乙方私钥byte[] privateKey2;// 乙方本地密钥byte[] secretKey2;// 初始化密钥 并生成甲方密钥对Map<String, Object> keyMap1 = DHUtil.initKey();publicKey1 = DHUtil.getPublicKey(keyMap1);privateKey1 = DHUtil.getPrivateKey(keyMap1);System.out.println("DH 甲方公钥 : " + BytesToHex.fromBytesToHex(publicKey1));System.out.println("DH 甲方私钥 : "+ BytesToHex.fromBytesToHex(privateKey1));// 乙方根据甲方公钥产生乙方密钥对Map<String, Object> keyMap2 = DHUtil.initKey(publicKey1);publicKey2 = DHUtil.getPublicKey(keyMap2);privateKey2 = DHUtil.getPrivateKey(keyMap2);System.out.println("DH 乙方公钥 : " + BytesToHex.fromBytesToHex(publicKey2));System.out.println("DH 乙方私钥 : "+ BytesToHex.fromBytesToHex(privateKey2));// 对于甲方， 根据其私钥和乙方发过来的公钥， 生成其本地密钥secretKey1secretKey1 = DHUtil.getSecretKeyBytes(publicKey2, privateKey1);System.out.println("DH 甲方 本地密钥 : "+ BytesToHex.fromBytesToHex(secretKey1));// 对于乙方， 根据其私钥和甲方发过来的公钥， 生成其本地密钥secretKey2secretKey2 = DHUtil.getSecretKeyBytes(publicKey1, privateKey2);System.out.println("DH 乙方 本地密钥 : "+ BytesToHex.fromBytesToHex(secretKey2));// ---------------------------// 测试数据加密和解密System.out.println("加密前的数据" + DATA);// 甲方进行数据的加密// 用的是甲方的私钥和乙方的公钥byte[] encryptDH = DHUtil.encryptDH(DATA.getBytes(), publicKey2,privateKey1);System.out.println("加密后的数据 字节数组转16进制显示"+ BytesToHex.fromBytesToHex(encryptDH));// 乙方进行数据的解密// 用的是乙方的私钥和甲方的公钥byte[] decryptDH = DHUtil.decryptDH(encryptDH, publicKey1, privateKey2);System.out.println("解密后数据:" + new String(decryptDH));}
}