From ee8c42dc8ebc3b2c6b4e0d2d172883e79e65815e Mon Sep 17 00:00:00 2001 From: cheney Date: Thu, 14 May 2026 16:53:37 +0800 Subject: [PATCH] =?UTF-8?q?rootcert=20=E5=AE=8C=E6=95=B4=E6=80=A7=E6=A0=A1?= =?UTF-8?q?=E9=AA=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- device-activation-platform/Readme.md | 6 +- .../com/sunyard/cisd/device/tool/Main.java | 80 +++++++++++++- .../java/com/sunyard/cisd/SM2UtilTest.java | 101 +++++++++++------- 3 files changed, 147 insertions(+), 40 deletions(-) diff --git a/device-activation-platform/Readme.md b/device-activation-platform/Readme.md index a5b53af..2f67ba4 100644 --- a/device-activation-platform/Readme.md +++ b/device-activation-platform/Readme.md @@ -63,4 +63,8 @@ ~~设备指纹信息存储于文件 /home/tms/device/dev.info 文件，json 格式。~~ 设备指纹存放于签名文件 /home/tms/device/dev.sign, pkcs1 格式。校验值 /home/tms/device/dev.sign.sm3。 设备指纹密钥公钥存储于文件 /home/tms/device/dev.fingerprint.pub, 公钥格式。校验值 /home/tms/device/dev.fingerprint.pub.sm3。 -设备激活密钥公钥存储于文件 /home/tms/device/dev.active.pub, 公钥格式。校验值 /home/tms/device/dev.active.pub.sm3。 \ No newline at end of file +设备激活密钥公钥存储于文件 /home/tms/device/dev.active.pub, 公钥格式。校验值 /home/tms/device/dev.active.pub.sm3。 + + +根证书校验证书 /home/tms/device/rootcert.sign +应用完整性公钥 /home/tms/device/dev.mac.pub, 公钥格式。校验值 /home/tms/device/dev.mac.pub.sm3。 \ No newline at end of file diff --git a/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java b/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java index 2f72af1..f2a3166 100644 --- a/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java +++ b/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java @@ -1,5 +1,6 @@ package com.sunyard.cisd.device.tool; +import java.io.InputStream; import java.nio.charset.StandardCharsets; import java.security.PublicKey; import java.util.Base64; @@ -13,8 +14,15 @@ public class Main { private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub"; private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3"; private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data"; - private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/fingerprint.sm2_private_key.pem"; - private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint.sm2_public_key.pem"; + private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/sm2_fingerprint_private_key.pem"; + private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/sm2_fingerprint_public_key.pem"; + private static final String MAC_PRIVATE_KEY_PATH = "/sm2_mac_private_key.pem"; + private static final String MAC_PUBLIC_KEY_PATH = "/sm2_mac_public_key.pem"; + private static final String ROOT_CERT_FILE = "/CFCA_TEST_CS_SM2_CA.cer"; + private static final String ROOT_CERT_OUTPUT_FILE = DEVICE_DIR + "/CFCA_TEST_CS_SM2_CA.cer"; + private static final String ROOT_CERT_SIGN_FILE = DEVICE_DIR + "/rootcert.sign"; + private static final String MAC_PUBLIC_KEY_OUTPUT_FILE = DEVICE_DIR + "/dev.mac.pub"; + private static final String MAC_PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.mac.pub.sm3"; public static void main(String[] args) { if (args.length == 0) { @@ -55,6 +63,12 @@ public class Main { verifyMAC(args[1], args[2]); } break; + case "rootcert-mac-gen": + generateRootCertMAC(); + break; + case "rootcert-mac-vertify": + verifyRootCertMAC(); + break; default: System.err.println("未知命令: " + command); printHelp(); @@ -76,6 +90,8 @@ public class Main { System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹"); System.out.println(" mac-gen <文件夹> <输出文件> - 对指定文件夹下所有文件计算SM3并输出到文件"); System.out.println(" mac-vertify <文件夹> - 验证指定文件夹下所有文件的SM3值"); + System.out.println(" rootcert-mac-gen - 生成根证书MAC签名"); + System.out.println(" rootcert-mac-vertify - 验证根证书MAC签名"); System.out.println(); } @@ -201,4 +217,64 @@ public class Main { System.out.println("=== 验证结果 ==="); System.out.println("完整性验证: " + verified); } + + private static void generateRootCertMAC() throws Exception { + System.out.println("=== 生成根证书MAC签名 ==="); + + InputStream certInputStream = Main.class.getResourceAsStream(ROOT_CERT_FILE); + if (certInputStream == null) { + throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE); + } + + byte[] certData = certInputStream.readAllBytes(); + certInputStream.close(); + + SM3Util.writeFile(ROOT_CERT_OUTPUT_FILE, certData); + System.out.println("根证书已输出: " + ROOT_CERT_OUTPUT_FILE); + + byte[] signature = SM2Util.sign(certData, MAC_PRIVATE_KEY_PATH); + SM3Util.writeFile(ROOT_CERT_SIGN_FILE, signature); + System.out.println("签名文件已保存: " + ROOT_CERT_SIGN_FILE); + + PublicKey macPublicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); + String publicKeyPEM = SM2Util.publicKeyToPEM(macPublicKey); + SM3Util.writeFile(MAC_PUBLIC_KEY_OUTPUT_FILE, publicKeyPEM); + System.out.println("MAC公钥文件已保存: " + MAC_PUBLIC_KEY_OUTPUT_FILE); + + String publicKeySm3 = SM3Util.sm3DigestHex(publicKeyPEM.getBytes(StandardCharsets.UTF_8)); + SM3Util.writeFile(MAC_PUBLIC_KEY_SM3_FILE, publicKeySm3); + System.out.println("MAC公钥SM3校验值已保存: " + MAC_PUBLIC_KEY_SM3_FILE + " (" + publicKeySm3 + ")"); + + boolean verified = SM2Util.verify(certData, signature, macPublicKey); + System.out.println("\n签名验证结果: " + verified); + } + + private static void verifyRootCertMAC() throws Exception { + System.out.println("=== 验证根证书MAC签名 ==="); + + String savedPublicKeyPEM = SM3Util.readFile(MAC_PUBLIC_KEY_OUTPUT_FILE).trim(); + String savedPublicKeySm3 = SM3Util.readFile(MAC_PUBLIC_KEY_SM3_FILE).trim(); + + String currentPublicKeySm3 = SM3Util.sm3DigestHex(savedPublicKeyPEM.getBytes(StandardCharsets.UTF_8)); + boolean publicKeyValid = savedPublicKeySm3.equals(currentPublicKeySm3); + System.out.println("公钥校验值验证: " + publicKeyValid); + + PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); + + InputStream certInputStream = Main.class.getResourceAsStream(ROOT_CERT_FILE); + if (certInputStream == null) { + throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE); + } + byte[] certData = certInputStream.readAllBytes(); + certInputStream.close(); + + byte[] signature = SM3Util.readFileBytes(ROOT_CERT_SIGN_FILE); + + boolean signatureVerified = SM2Util.verify(certData, signature, publicKey); + System.out.println("签名验证结果: " + signatureVerified); + + System.out.println(); + System.out.println("=== 验证结果 ==="); + System.out.println("总体验证: " + (publicKeyValid && signatureVerified)); + } } diff --git a/device-fingerprint-tool/src/test/java/com/sunyard/cisd/SM2UtilTest.java b/device-fingerprint-tool/src/test/java/com/sunyard/cisd/SM2UtilTest.java index f4ce940..b61f225 100644 --- a/device-fingerprint-tool/src/test/java/com/sunyard/cisd/SM2UtilTest.java +++ b/device-fingerprint-tool/src/test/java/com/sunyard/cisd/SM2UtilTest.java @@ -11,66 +11,93 @@ import java.nio.charset.StandardCharsets; import java.security.KeyPair; public class SM2UtilTest { - + + private static final String KEY_NAME_FINGERPRINT = "fingerprint"; + private static final String KEY_NAME_MAC = "mac"; + @Test - public void testGenerateAndSaveKeyPair() throws Exception { - KeyPair keyPair = SM2Util.generateKeyPair(); - - String privateKeyPEM = SM2Util.privateKeyToPEM(keyPair.getPrivate()); - String publicKeyPEM = SM2Util.publicKeyToPEM(keyPair.getPublic()); - + public void testGenerateAndSaveKeyPairs() throws Exception { + KeyPair fingerprintKeyPair = SM2Util.generateKeyPair(); + KeyPair macKeyPair = SM2Util.generateKeyPair(); + String resourcesPath = "src/main/resources"; File resourcesDir = new File(resourcesPath); if (!resourcesDir.exists()) { resourcesDir.mkdirs(); } - - File privateKeyFile = new File(resourcesPath + "/mac_sm2_private_key.pem"); - try (Writer writer = new OutputStreamWriter(new FileOutputStream(privateKeyFile), StandardCharsets.UTF_8)) { - writer.write(privateKeyPEM); + + File fingerprintPrivateKeyFile = new File(resourcesPath + "/sm2_" + KEY_NAME_FINGERPRINT + "_private_key.pem"); + try (Writer writer = new OutputStreamWriter(new FileOutputStream(fingerprintPrivateKeyFile), StandardCharsets.UTF_8)) { + writer.write(SM2Util.privateKeyToPEM(fingerprintKeyPair.getPrivate())); } - System.out.println("Private key saved to: " + privateKeyFile.getAbsolutePath()); - - File publicKeyFile = new File(resourcesPath + "/mac_sm2_public_key.pem"); - try (Writer writer = new OutputStreamWriter(new FileOutputStream(publicKeyFile), StandardCharsets.UTF_8)) { - writer.write(publicKeyPEM); + System.out.println("Fingerprint private key saved to: " + fingerprintPrivateKeyFile.getAbsolutePath()); + + File fingerprintPublicKeyFile = new File(resourcesPath + "/sm2_" + KEY_NAME_FINGERPRINT + "_public_key.pem"); + try (Writer writer = new OutputStreamWriter(new FileOutputStream(fingerprintPublicKeyFile), StandardCharsets.UTF_8)) { + writer.write(SM2Util.publicKeyToPEM(fingerprintKeyPair.getPublic())); } - System.out.println("Public key saved to: " + publicKeyFile.getAbsolutePath()); - - System.out.println("\nGenerated Key Pair:"); - System.out.println("Private Key:\n" + privateKeyPEM); - System.out.println("Public Key:\n" + publicKeyPEM); + System.out.println("Fingerprint public key saved to: " + fingerprintPublicKeyFile.getAbsolutePath()); + + File macPrivateKeyFile = new File(resourcesPath + "/sm2_" + KEY_NAME_MAC + "_private_key.pem"); + try (Writer writer = new OutputStreamWriter(new FileOutputStream(macPrivateKeyFile), StandardCharsets.UTF_8)) { + writer.write(SM2Util.privateKeyToPEM(macKeyPair.getPrivate())); + } + System.out.println("MAC private key saved to: " + macPrivateKeyFile.getAbsolutePath()); + + File macPublicKeyFile = new File(resourcesPath + "/sm2_" + KEY_NAME_MAC + "_public_key.pem"); + try (Writer writer = new OutputStreamWriter(new FileOutputStream(macPublicKeyFile), StandardCharsets.UTF_8)) { + writer.write(SM2Util.publicKeyToPEM(macKeyPair.getPublic())); + } + System.out.println("MAC public key saved to: " + macPublicKeyFile.getAbsolutePath()); + + System.out.println("\n=== Generated Fingerprint Key Pair ==="); + System.out.println("Private Key:\n" + SM2Util.privateKeyToPEM(fingerprintKeyPair.getPrivate())); + System.out.println("Public Key:\n" + SM2Util.publicKeyToPEM(fingerprintKeyPair.getPublic())); + + System.out.println("\n=== Generated MAC Key Pair ==="); + System.out.println("Private Key:\n" + SM2Util.privateKeyToPEM(macKeyPair.getPrivate())); + System.out.println("Public Key:\n" + SM2Util.publicKeyToPEM(macKeyPair.getPublic())); } - + @Test public void testSignAndVerify() throws Exception { KeyPair keyPair = SM2Util.generateKeyPair(); - + String testData = "Hello, SM2!"; byte[] data = testData.getBytes(StandardCharsets.UTF_8); - + byte[] signature = SM2Util.sign(data, keyPair.getPrivate()); System.out.println("Signature generated, length: " + signature.length + " bytes"); - + boolean verified = SM2Util.verify(data, signature, keyPair.getPublic()); System.out.println("Signature verified: " + verified); - + assert verified : "Signature verification failed"; } - + @Test public void testSignAndVerifyWithKeyFiles() throws Exception { - testGenerateAndSaveKeyPair(); - + testGenerateAndSaveKeyPairs(); + String testData = "Test data for SM2 signature"; byte[] data = testData.getBytes(StandardCharsets.UTF_8); - - byte[] signature = SM2Util.sign(data, "/sm2_private_key.pem"); - System.out.println("Signature generated from file, length: " + signature.length + " bytes"); - - boolean verified = SM2Util.verify(data, signature, "/sm2_public_key.pem"); - System.out.println("Signature verified from file: " + verified); - - assert verified : "Signature verification with key files failed"; + + byte[] fingerprintSignature = SM2Util.sign(data, "/sm2_fingerprint_private_key.pem"); + System.out.println("Fingerprint signature generated, length: " + fingerprintSignature.length + " bytes"); + + boolean fingerprintVerified = SM2Util.verify(data, fingerprintSignature, "/sm2_fingerprint_public_key.pem"); + System.out.println("Fingerprint signature verified: " + fingerprintVerified); + assert fingerprintVerified : "Fingerprint signature verification failed"; + + byte[] macSignature = SM2Util.sign(data, "/sm2_mac_private_key.pem"); + System.out.println("MAC signature generated, length: " + macSignature.length + " bytes"); + + boolean macVerified = SM2Util.verify(data, macSignature, "/sm2_mac_public_key.pem"); + System.out.println("MAC signature verified: " + macVerified); + assert macVerified : "MAC signature verification failed"; + + boolean crossVerified = SM2Util.verify(data, fingerprintSignature, "/sm2_mac_public_key.pem"); + System.out.println("Cross verification (fingerprint signature with MAC key): " + crossVerified); + assert !crossVerified : "Cross verification should fail"; } }