Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rootcert 完整性校验

Browse Source
This commit is contained in:
cheney 2026-05-14 16:53:37 +08:00
parent 22ca568e88
commit ee8c42dc8e
3 changed files with 147 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
device-activation-platform/Readme.md
View File

@ -63,4 +63,8 @@
~~设备指纹信息存储于文件 /home/tms/device/dev.info 文件，json 格式。~~ ~~设备指纹信息存储于文件 /home/tms/device/dev.info 文件，json 格式。~~
设备指纹存放于签名文件 /home/tms/device/dev.sign, pkcs1 格式。校验值 /home/tms/device/dev.sign.sm3。 设备指纹存放于签名文件 /home/tms/device/dev.sign, pkcs1 格式。校验值 /home/tms/device/dev.sign.sm3。
设备指纹密钥公钥存储于文件 /home/tms/device/dev.fingerprint.pub, 公钥格式。校验值 /home/tms/device/dev.fingerprint.pub.sm3。 设备指纹密钥公钥存储于文件 /home/tms/device/dev.fingerprint.pub, 公钥格式。校验值 /home/tms/device/dev.fingerprint.pub.sm3。
设备激活密钥公钥存储于文件 /home/tms/device/dev.active.pub, 公钥格式。校验值 /home/tms/device/dev.active.pub.sm3。 设备激活密钥公钥存储于文件 /home/tms/device/dev.active.pub, 公钥格式。校验值 /home/tms/device/dev.active.pub.sm3。
根证书校验证书 /home/tms/device/rootcert.sign
应用完整性公钥 /home/tms/device/dev.mac.pub, 公钥格式。校验值 /home/tms/device/dev.mac.pub.sm3。

80
device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java
View File

@ -1,5 +1,6 @@
package com.sunyard.cisd.device.tool; package com.sunyard.cisd.device.tool;
import java.io.InputStream;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.security.PublicKey; import java.security.PublicKey;
import java.util.Base64; import java.util.Base64;
@ -13,8 +14,15 @@ public class Main {
private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub"; private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub";
private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3"; private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3";
private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data"; private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data";
private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/fingerprint.sm2_private_key.pem"; private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/sm2_fingerprint_private_key.pem";
private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint.sm2_public_key.pem"; private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/sm2_fingerprint_public_key.pem";
private static final String MAC_PRIVATE_KEY_PATH = "/sm2_mac_private_key.pem";
private static final String MAC_PUBLIC_KEY_PATH = "/sm2_mac_public_key.pem";
private static final String ROOT_CERT_FILE = "/CFCA_TEST_CS_SM2_CA.cer";
private static final String ROOT_CERT_OUTPUT_FILE = DEVICE_DIR + "/CFCA_TEST_CS_SM2_CA.cer";
private static final String ROOT_CERT_SIGN_FILE = DEVICE_DIR + "/rootcert.sign";
private static final String MAC_PUBLIC_KEY_OUTPUT_FILE = DEVICE_DIR + "/dev.mac.pub";
private static final String MAC_PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.mac.pub.sm3";
public static void main(String[] args) { public static void main(String[] args) {
if (args.length == 0) { if (args.length == 0) {
@ -55,6 +63,12 @@ public class Main {
verifyMAC(args[1], args[2]); verifyMAC(args[1], args[2]);
} }
break; break;
case "rootcert-mac-gen":
generateRootCertMAC();
break;
case "rootcert-mac-vertify":
verifyRootCertMAC();
break;
default: default:
System.err.println("未知命令: " + command); System.err.println("未知命令: " + command);
printHelp(); printHelp();
@ -76,6 +90,8 @@ public class Main {
System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹"); System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹");
System.out.println(" mac-gen <文件夹> <输出文件> - 对指定文件夹下所有文件计算SM3并输出到文件"); System.out.println(" mac-gen <文件夹> <输出文件> - 对指定文件夹下所有文件计算SM3并输出到文件");
System.out.println(" mac-vertify <文件夹> <SM3文件> - 验证指定文件夹下所有文件的SM3值"); System.out.println(" mac-vertify <文件夹> <SM3文件> - 验证指定文件夹下所有文件的SM3值");
System.out.println(" rootcert-mac-gen - 生成根证书MAC签名");
System.out.println(" rootcert-mac-vertify - 验证根证书MAC签名");
System.out.println(); System.out.println();
} }
@ -201,4 +217,64 @@ public class Main {
System.out.println("=== 验证结果 ==="); System.out.println("=== 验证结果 ===");
System.out.println("完整性验证: " + verified); System.out.println("完整性验证: " + verified);
} }
private static void generateRootCertMAC() throws Exception {
System.out.println("=== 生成根证书MAC签名 ===");
InputStream certInputStream = Main.class.getResourceAsStream(ROOT_CERT_FILE);
if (certInputStream == null) {
throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE);
}
byte[] certData = certInputStream.readAllBytes();
certInputStream.close();
SM3Util.writeFile(ROOT_CERT_OUTPUT_FILE, certData);
System.out.println("根证书已输出: " + ROOT_CERT_OUTPUT_FILE);
byte[] signature = SM2Util.sign(certData, MAC_PRIVATE_KEY_PATH);
SM3Util.writeFile(ROOT_CERT_SIGN_FILE, signature);
System.out.println("签名文件已保存: " + ROOT_CERT_SIGN_FILE);
PublicKey macPublicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
String publicKeyPEM = SM2Util.publicKeyToPEM(macPublicKey);
SM3Util.writeFile(MAC_PUBLIC_KEY_OUTPUT_FILE, publicKeyPEM);
System.out.println("MAC公钥文件已保存: " + MAC_PUBLIC_KEY_OUTPUT_FILE);
String publicKeySm3 = SM3Util.sm3DigestHex(publicKeyPEM.getBytes(StandardCharsets.UTF_8));
SM3Util.writeFile(MAC_PUBLIC_KEY_SM3_FILE, publicKeySm3);
System.out.println("MAC公钥SM3校验值已保存: " + MAC_PUBLIC_KEY_SM3_FILE + " (" + publicKeySm3 + ")");
boolean verified = SM2Util.verify(certData, signature, macPublicKey);
System.out.println("\n签名验证结果: " + verified);
}
private static void verifyRootCertMAC() throws Exception {
System.out.println("=== 验证根证书MAC签名 ===");
String savedPublicKeyPEM = SM3Util.readFile(MAC_PUBLIC_KEY_OUTPUT_FILE).trim();
String savedPublicKeySm3 = SM3Util.readFile(MAC_PUBLIC_KEY_SM3_FILE).trim();
String currentPublicKeySm3 = SM3Util.sm3DigestHex(savedPublicKeyPEM.getBytes(StandardCharsets.UTF_8));
boolean publicKeyValid = savedPublicKeySm3.equals(currentPublicKeySm3);
System.out.println("公钥校验值验证: " + publicKeyValid);
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
InputStream certInputStream = Main.class.getResourceAsStream(ROOT_CERT_FILE);
if (certInputStream == null) {
throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE);
}
byte[] certData = certInputStream.readAllBytes();
certInputStream.close();
byte[] signature = SM3Util.readFileBytes(ROOT_CERT_SIGN_FILE);
boolean signatureVerified = SM2Util.verify(certData, signature, publicKey);
System.out.println("签名验证结果: " + signatureVerified);
System.out.println();
System.out.println("=== 验证结果 ===");
System.out.println("总体验证: " + (publicKeyValid && signatureVerified));
}
} }

101
device-fingerprint-tool/src/test/java/com/sunyard/cisd/SM2UtilTest.java
View File

@ -11,66 +11,93 @@ import java.nio.charset.StandardCharsets;
import java.security.KeyPair; import java.security.KeyPair;
public class SM2UtilTest { public class SM2UtilTest {
private static final String KEY_NAME_FINGERPRINT = "fingerprint";
private static final String KEY_NAME_MAC = "mac";
@Test @Test
public void testGenerateAndSaveKeyPair() throws Exception { public void testGenerateAndSaveKeyPairs() throws Exception {
KeyPair keyPair = SM2Util.generateKeyPair(); KeyPair fingerprintKeyPair = SM2Util.generateKeyPair();
KeyPair macKeyPair = SM2Util.generateKeyPair();
String privateKeyPEM = SM2Util.privateKeyToPEM(keyPair.getPrivate());
String publicKeyPEM = SM2Util.publicKeyToPEM(keyPair.getPublic());
String resourcesPath = "src/main/resources"; String resourcesPath = "src/main/resources";
File resourcesDir = new File(resourcesPath); File resourcesDir = new File(resourcesPath);
if (!resourcesDir.exists()) { if (!resourcesDir.exists()) {
resourcesDir.mkdirs(); resourcesDir.mkdirs();
} }
File privateKeyFile = new File(resourcesPath + "/mac_sm2_private_key.pem"); File fingerprintPrivateKeyFile = new File(resourcesPath + "/sm2_" + KEY_NAME_FINGERPRINT + "_private_key.pem");
try (Writer writer = new OutputStreamWriter(new FileOutputStream(privateKeyFile), StandardCharsets.UTF_8)) { try (Writer writer = new OutputStreamWriter(new FileOutputStream(fingerprintPrivateKeyFile), StandardCharsets.UTF_8)) {
writer.write(privateKeyPEM); writer.write(SM2Util.privateKeyToPEM(fingerprintKeyPair.getPrivate()));
} }
System.out.println("Private key saved to: " + privateKeyFile.getAbsolutePath()); System.out.println("Fingerprint private key saved to: " + fingerprintPrivateKeyFile.getAbsolutePath());
File publicKeyFile = new File(resourcesPath + "/mac_sm2_public_key.pem"); File fingerprintPublicKeyFile = new File(resourcesPath + "/sm2_" + KEY_NAME_FINGERPRINT + "_public_key.pem");
try (Writer writer = new OutputStreamWriter(new FileOutputStream(publicKeyFile), StandardCharsets.UTF_8)) { try (Writer writer = new OutputStreamWriter(new FileOutputStream(fingerprintPublicKeyFile), StandardCharsets.UTF_8)) {
writer.write(publicKeyPEM); writer.write(SM2Util.publicKeyToPEM(fingerprintKeyPair.getPublic()));
} }
System.out.println("Public key saved to: " + publicKeyFile.getAbsolutePath()); System.out.println("Fingerprint public key saved to: " + fingerprintPublicKeyFile.getAbsolutePath());
System.out.println("\nGenerated Key Pair:"); File macPrivateKeyFile = new File(resourcesPath + "/sm2_" + KEY_NAME_MAC + "_private_key.pem");
System.out.println("Private Key:\n" + privateKeyPEM); try (Writer writer = new OutputStreamWriter(new FileOutputStream(macPrivateKeyFile), StandardCharsets.UTF_8)) {
System.out.println("Public Key:\n" + publicKeyPEM); writer.write(SM2Util.privateKeyToPEM(macKeyPair.getPrivate()));
}
System.out.println("MAC private key saved to: " + macPrivateKeyFile.getAbsolutePath());
File macPublicKeyFile = new File(resourcesPath + "/sm2_" + KEY_NAME_MAC + "_public_key.pem");
try (Writer writer = new OutputStreamWriter(new FileOutputStream(macPublicKeyFile), StandardCharsets.UTF_8)) {
writer.write(SM2Util.publicKeyToPEM(macKeyPair.getPublic()));
}
System.out.println("MAC public key saved to: " + macPublicKeyFile.getAbsolutePath());
System.out.println("\n=== Generated Fingerprint Key Pair ===");
System.out.println("Private Key:\n" + SM2Util.privateKeyToPEM(fingerprintKeyPair.getPrivate()));
System.out.println("Public Key:\n" + SM2Util.publicKeyToPEM(fingerprintKeyPair.getPublic()));
System.out.println("\n=== Generated MAC Key Pair ===");
System.out.println("Private Key:\n" + SM2Util.privateKeyToPEM(macKeyPair.getPrivate()));
System.out.println("Public Key:\n" + SM2Util.publicKeyToPEM(macKeyPair.getPublic()));
} }
@Test @Test
public void testSignAndVerify() throws Exception { public void testSignAndVerify() throws Exception {
KeyPair keyPair = SM2Util.generateKeyPair(); KeyPair keyPair = SM2Util.generateKeyPair();
String testData = "Hello, SM2!"; String testData = "Hello, SM2!";
byte[] data = testData.getBytes(StandardCharsets.UTF_8); byte[] data = testData.getBytes(StandardCharsets.UTF_8);
byte[] signature = SM2Util.sign(data, keyPair.getPrivate()); byte[] signature = SM2Util.sign(data, keyPair.getPrivate());
System.out.println("Signature generated, length: " + signature.length + " bytes"); System.out.println("Signature generated, length: " + signature.length + " bytes");
boolean verified = SM2Util.verify(data, signature, keyPair.getPublic()); boolean verified = SM2Util.verify(data, signature, keyPair.getPublic());
System.out.println("Signature verified: " + verified); System.out.println("Signature verified: " + verified);
assert verified : "Signature verification failed"; assert verified : "Signature verification failed";
} }
@Test @Test
public void testSignAndVerifyWithKeyFiles() throws Exception { public void testSignAndVerifyWithKeyFiles() throws Exception {
testGenerateAndSaveKeyPair(); testGenerateAndSaveKeyPairs();
String testData = "Test data for SM2 signature"; String testData = "Test data for SM2 signature";
byte[] data = testData.getBytes(StandardCharsets.UTF_8); byte[] data = testData.getBytes(StandardCharsets.UTF_8);
byte[] signature = SM2Util.sign(data, "/sm2_private_key.pem"); byte[] fingerprintSignature = SM2Util.sign(data, "/sm2_fingerprint_private_key.pem");
System.out.println("Signature generated from file, length: " + signature.length + " bytes"); System.out.println("Fingerprint signature generated, length: " + fingerprintSignature.length + " bytes");
boolean verified = SM2Util.verify(data, signature, "/sm2_public_key.pem"); boolean fingerprintVerified = SM2Util.verify(data, fingerprintSignature, "/sm2_fingerprint_public_key.pem");
System.out.println("Signature verified from file: " + verified); System.out.println("Fingerprint signature verified: " + fingerprintVerified);
assert fingerprintVerified : "Fingerprint signature verification failed";
assert verified : "Signature verification with key files failed";
byte[] macSignature = SM2Util.sign(data, "/sm2_mac_private_key.pem");
System.out.println("MAC signature generated, length: " + macSignature.length + " bytes");
boolean macVerified = SM2Util.verify(data, macSignature, "/sm2_mac_public_key.pem");
System.out.println("MAC signature verified: " + macVerified);
assert macVerified : "MAC signature verification failed";
boolean crossVerified = SM2Util.verify(data, fingerprintSignature, "/sm2_mac_public_key.pem");
System.out.println("Cross verification (fingerprint signature with MAC key): " + crossVerified);
assert !crossVerified : "Cross verification should fail";
} }
} }