加签，验签

 

一般安全考虑，1，验签--签名，2，解密---加密

 

 

加签：签名原文，私钥，签名工具类生成签名--base64转化一次（不是非对称加密，是jdk专门的验，加签方法）

 

 

 

签名：

 String sign = Sign256lcUtil.generateSign(responseResult.getBizContent(), REQUEST_ID, privateKeyValue, responseResult.getSessionId());

           public static String generateSign(String encrptyJson,String REQUEST_ID,String  REQ_PRIVATE_KEY, String sessionId) throws Exception {

// 获取待签名字符串

String origSign = getOrigSign(sessionId,REQUEST_ID,encrptyJson);

// 使用SHA256withRSA算法生成签名

// 第二个参数为base64编码rsa密钥, 第三个参数为待签名串

// 结果返回base64编码签名

String sign = DigitalSignatureUtil.sign(EnumSignatureAlgorithm.SHA256withRSA, REQ_PRIVATE_KEY, origSign);

return sign;

}

 

     一般签名之后的字节码会base64：

public static String sign(EnumSignatureAlgorithm signatureAlgorithm, String strPrivateKey, String strData) throws Exception {

        byte[] bytes = sign(signatureAlgorithm, Base64Util.decode2Bytes(strPrivateKey), strData.getBytes("utf-8"));

        return Base64Util.encode2Str(bytes, "utf-8");

    }

 

   public static byte[] sign(EnumSignatureAlgorithm signatureAlgorithm, byte[] bytePrivateKey, byte[] byteData) throws Exception {

        Security.addProvider(new BouncyCastleProvider());

        PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(bytePrivateKey);

        KeyFactory keyFactory = KeyFactory.getInstance(signatureAlgorithm.getKeyAlgorithm().name());

        PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);

        return sign(signatureAlgorithm, privateKey, byteData);

    }

 

 

 

验签：  加签原文，与对方传过来的签名（对方私钥签名），在公钥的参数下，通过验签已有的工具类换算是否一致

 

  Sign256lcUtil.verifySignReq(baseResp,REQUEST_ID,AESKeyValue,publicKeyValue);

 

public static void verifySign(BaseResp response ,String REQUEST_ID,String AES_KEY, String XR_PUBLIC_KEY) throws Exception {

try {

if (StringUtils.isBlank(response.getSign())) {

System.out.println("返回签名信息为空");

}

 

// 生成签名原文

String origStr = getOrigSign(response.getSessionId(),REQUEST_ID, (String) (response.getBizContent()));

 

// SHA256withRSA算法验签, 第二个参数为base64编码的星融公钥, 第三个参数为utf8签名原文,

// 第四个参数为接口返回的base64编码签名，

boolean flag = DigitalSignatureUtil.verify(EnumSignatureAlgorithm.SHA256withRSA, XR_PUBLIC_KEY, origStr,

response.getSign());

 

if (!flag) {

System.out.println("签名验证异常");

}

 

// 解密报文体

// 接口请求成功解密报文体

if ("0000".equals(response.getResultCode())) {

String resposneStr = CipherUtil.decrypt(EnumCipherAlgorithm.AES_ECB_PKCS5Padding, AES_KEY,

(String) response.getBizContent());

System.out.println("解密后报文:[{}]" + resposneStr);

response.setBizContent(resposneStr);

}

} catch (Exception e) {

System.out.println("返回报文签名验证过程异常");

throw new Exception("返回报文签名验证过程异常", e);

}

}

 

 

 

 

 

public static boolean verify(EnumSignatureAlgorithm signatureAlgorithm, String strPublicKey, String origStr, String signStr) throws Exception {

        return verify(signatureAlgorithm, Base64Util.decode2Bytes(strPublicKey), origStr.getBytes("utf-8"), Base64Util.decode2Bytes(signStr, "utf-8"));

    }

public static boolean verify(EnumSignatureAlgorithm signatureAlgorithm, byte[] bytePublicKey, byte[] byteData, byte[] byteSign) throws Exception {

        Security.addProvider(new BouncyCastleProvider());

        X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(bytePublicKey);

        KeyFactory keyFactory = KeyFactory.getInstance(signatureAlgorithm.getKeyAlgorithm().name());

        PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);

        return verify(signatureAlgorithm, publicKey, byteData, byteSign);

    }