java结合keytool如何实现非对称签名和验证详解

$ keytool -genkey - alias signLegal -keystore examplestanstore -validity 1800

$ keytool -list -keystore examplestanstore - v

$ keytool - export -keystore examplestanstore - alias signLegal - file StanSmith.cer

$ java GenSig hello.txt   (生成文件sig和suepk)

$ java VerSig suepk sig hello.txt

signature verifies: true

import java.io.*;

import java.security.*;

class GenSig2 {

  public static void main(String[] args) {

  if (args.length != 1 ) {

   System.out.println( "Usage: java GenSig2 <nameOfFileToSign>" );

   }

  else try {

   /*create key paire use keytool:

   $ keytool -genkey -alias signLegal -keystore examplestanstore -validity 1800*/

   // read keystore file

   KeyStore ks = KeyStore.getInstance("JKS");

   FileInputStream ksfis = new FileInputStream("examplestanstore");

   BufferedInputStream ksbufin = new BufferedInputStream(ksfis);

   // open keystore and get private key

   // alias is 'signLeal', kpasswd/spasswd is 'vagrant'

   ks.load(ksbufin, "vagrant".toCharArray());

   PrivateKey priv = (PrivateKey) ks.getKey("signLegal", "vagrant".toCharArray());

   /* Create a Signature object and initialize it with the private key */

   Signature dsa = Signature.getInstance("SHA1withDSA", "SUN");

   dsa.initSign(priv);

   /* Update and sign the data */

   FileInputStream fis = new FileInputStream(args[0]);

   BufferedInputStream bufin = new BufferedInputStream(fis);

   byte[] buffer = new byte[1024];

   int len;

   while (bufin.available() != 0) {

   len = bufin.read(buffer);

   dsa.update(buffer, 0, len);

   };

   bufin.close();

   /* Now that all the data to be signed has been read in,

    generate a signature for it */

   byte[] realSig = dsa.sign();

   /* Save the signature in a file */

   FileOutputStream sigfos = new FileOutputStream("sig");

   sigfos.write(realSig);

   sigfos.close();

   /* public key file can export from keystore use keytool:

   $ keytool -export -keystore examplestanstore -alias signLegal -file StanSmith.cer */

  } catch (Exception e) {

   System.err.println( "Caught exception " + e.toString());

  }

  };

$ java GenSig2 hello.txt

import java.io.*;

import java.security.*;

import java.security.spec.*;

class VerSig2 {

  public static void main(String[] args) {

  /* Verify a DSA signature */

  if (args.length != 3) {

   System.out.println("Usage: VerSig publickeyfile signaturefile datafile");

   }

  else try{

   /* import encoded public cert */

   FileInputStream certfis = new FileInputStream(args[0]);

   java.security.cert.CertificateFactory cf =

   java.security.cert.CertificateFactory.getInstance("X.509");

   java.security.cert.Certificate cert = cf.generateCertificate(certfis);

   PublicKey pubKey = cert.getPublicKey();

   /* input the signature bytes */

   FileInputStream sigfis = new FileInputStream(args[1]);

   byte[] sigToVerify = new byte[sigfis.available()];

   sigfis.read(sigToVerify );

   sigfis.close();

   /* create a Signature object and initialize it with the public key */

   Signature sig = Signature.getInstance("SHA1withDSA", "SUN");

   sig.initVerify(pubKey);

   /* Update and verify the data */

   FileInputStream datafis = new FileInputStream(args[ 2 ]);

   BufferedInputStream bufin = new BufferedInputStream(datafis);

   byte [] buffer = new byte [ 1024 ];

   int len;

   while (bufin.available() != 0 ) {

   len = bufin.read(buffer);

   sig.update(buffer, 0 , len);

   };

   bufin.close();

   boolean verifies = sig.verify(sigToVerify);

   System.out.println( "signature verifies: " + verifies);

  } catch (Exception e) {

   System.err.println( "Caught exception " + e.toString());

  };

  }

}

$ java VerSig2 StanSmith.cer sig hello.txt

signature verifies: true

$ openssl genrsa -out key.pem 1024

$ cat key.pem

-----BEGIN RSA PRIVATE KEY-----

MIICXQIBAAKBgQCzVDmu6Cf2QF7cERCGYU3B8Epm6pkkpMZFgotphXMgAmBBNJbh

Si7qPH4R5JlEm1ZXPr5DZH /pyJBWQhiiHGeUAOve +GOgvt9Rk25r7OEWYvn /GCr/

JBfLBGqwtlzn /t2s2x04IooshsGkOd6YpZoztkEDtu2gKHedFczF607IvwIDAQAB

AoGAMdbIqUmwQYomUvcTJqXIXIwRwYSVx09cI1lisZL7Kfw /ECAzhq19WHAzgXmM

9zpMxraTXluCCVFKfA6mlfda+ZoBlKSYdOecwNB+TSAumf9XK8uHW /g8C +Ykq9OG

g9Uiy8rKnl12Zaiu9H8L82ud0CkTFW2636 /PuKgtp +4YbXECQQDhKdh8lwgumg7H

YIw5476QOHnPL7c3OFPGtaOZMZJkjMPfRzgR4B5PjcGnOLDoTlkATcBPmXtLwwJJ

SzaBdaRjAkEAy+NwdOzC1yQrTrkZQx1brNjO3iytfkl3t1xAWyz5Sy1IB7+4fsod

Eh3br5E1o5YRipY2GJZvp2OAAt3tz6iS9QJASvIYwu+qo4hX3vk9847gwTRrJxFk

1JaFHCEdgUJEzf8ku08DVL /alvRCPxzZlZluenFmz5fwuDkCq87DJ7g2rQJBAMDM

+SnIPdMeA8n0pRvfJjLD7pMP4pu6M3fzx3Owiqj5T9TsCjXzQBxCmdxizzs7DKll

tA /6Kek64PFVFa25tgUCQQCTM1VwfNKjFbd +0HuF6WAs3Odjuo0gKk /QIjdn7M5/

I0kxEApKxTto3oiuCQGeYL /sqy3WjM0476w48 +xUsQeF

-----END RSA PRIVATE KEY-----

$ openssl rsa - in key.pem -pubout -out pub-key.pem

$ cat pub-key.pem

-----BEGIN PUBLIC KEY-----

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzVDmu6Cf2QF7cERCGYU3B8Epm

6pkkpMZFgotphXMgAmBBNJbhSi7qPH4R5JlEm1ZXPr5DZH /pyJBWQhiiHGeUAOve

+GOgvt9Rk25r7OEWYvn /GCr/JBfLBGqwtlzn/t2s2x04IooshsGkOd6YpZoztkED

tu2gKHedFczF607IvwIDAQAB

-----END PUBLIC KEY-----

$ cat hello.txt

1234

$ openssl dgst -SHA256 -out hello.sha256 hello.txt

$ cat hello.sha256

SHA256(hello.txt)= a883dafc480d466ee04e0d6da986bd78eb1fdd2178d04693723da3a8f95d42f4

$ openssl rsautl -sign - in hello.sha256 -out hello.sign -inkey key.pem

$ openssl rsautl -verify - in hello.sign -inkey pub-key.pem -pubin

SHA256(hello.txt)= a883dafc480d466ee04e0d6da986bd78eb1fdd2178d04693723da3a8f95d42f4

$ openssl rsautl -verify - in hello.sign -inkey key.pem

SHA256(hello.txt)= a883dafc480d466ee04e0d6da986bd78eb1fdd2178d04693723da3a8f95d42f4