Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

恢复管理密钥

Browse Source
This commit is contained in:
liulu 2026-03-10 16:16:34 +08:00
parent 16fb6fa04e
commit efec85a59c
2 changed files with 102 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java
View File

@ -3,6 +3,8 @@ package com.cisd.tms.modules.mk.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.integration.crypto.pcie.service.PcieCryptoService;
import com.cisd.tms.modules.mk.dto.LMK;
import com.cisd.tms.modules.mk.dto.MasterKeyRestoreDTO;
import com.cisd.tms.modules.mk.dto.RecoveryResult;
import com.cisd.tms.modules.mk.dto.UKeySignDTO;
import com.cisd.tms.modules.mk.dto.UKeySignEntity;
import com.cisd.tms.modules.mk.dto.UKeySignResult;
@ -15,6 +17,12 @@ import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import java.io.IOException;
import java.io.StreamCorruptedException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
/**
* @author liulu
* @since 2026/3/4
@ -60,4 +68,41 @@ public class LmkController {
return ApiResponse.success(UKeySignResult.builder().sign(signValue).extra(components).build());
}
/**
* 恢复主密钥
* @param masterKeyRestoreDTO
* @return
* @throws IOException
* @throws ClassNotFoundException
*/
@PostMapping("/recoveryMasterKey")
public ApiResponse<RecoveryResult> recoveryMasterKey(@RequestBody MasterKeyRestoreDTO masterKeyRestoreDTO)
throws IOException, ClassNotFoundException {
RecoveryResult result;
String mac;
try {
Collection<String> keyComponents = masterKeyRestoreDTO.getComponents().values();
List<String> keyComponentsList = new ArrayList<>(keyComponents);
mac = lmkService.recoveryLMK(keyComponentsList);
result = RecoveryResult.getInstance(false, mac);
} catch (StreamCorruptedException streamCorruptedException) {
String masterKey = lmkService.masterKeyCompose(masterKeyRestoreDTO.getComponents());
mac = lmkService.recoveryLMKAndGenIK(masterKey);
result = RecoveryResult.getInstance(true, mac);
}
return ApiResponse.success(result);
}
/**
* 分量合成恢复主密钥
* @param masterKeyRestoreDTO
* @return
*/
@PostMapping("/masterKeyRecovery")
public ApiResponse<LMK> masterKeyRecovery(@RequestBody MasterKeyRestoreDTO masterKeyRestoreDTO) {
String masterKey = lmkService.masterKeyCompose(masterKeyRestoreDTO.getComponents());
LMK lmk = lmkService.recoveryLMK1(LMK.getInstance(masterKey, masterKeyRestoreDTO));
return ApiResponse.success(lmk);
}
}

57
src/main/java/com/cisd/tms/modules/mk/service/LmkService.java
View File

@ -10,12 +10,15 @@ import com.cisd.tms.integration.crypto.pcie.service.PcieCryptoService;
import com.cisd.tms.modules.mk.common.LMKConstant;
import com.cisd.tms.modules.mk.dto.KeyComponent;
import com.cisd.tms.modules.mk.dto.LMK;
import com.cisd.tms.modules.mk.dto.LMKAndIK;
import com.cisd.tms.modules.mk.enums.IKEnums;
import jakarta.annotation.Resource;
import lombok.extern.slf4j.Slf4j;
import org.bouncycastle.util.encoders.Hex;
import org.springframework.stereotype.Service;
import java.io.IOException;
import java.io.StreamCorruptedException;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Base64;
@ -143,4 +146,58 @@ public class LmkService {
return keyComponentList.get(index);
}
public String masterKeyCompose(Map<String, String> componentMap) {
StringBuilder lmk = new StringBuilder();
for (int i = 0; i < LMKConstant.COMPONENT_NUM; i++) {
lmk.append(componentMap.get(String.valueOf(LMKConstant.KEY_ORDER[i])));
}
return lmk.toString();
}
public String recoveryLMK(List<String> keyComponents) throws IOException, ClassNotFoundException {
List<KeyComponent> componentList = new ArrayList<>();
for (String component : keyComponents) {
byte[] raw;
try {
raw = Base64.getDecoder().decode(component);
} catch (IllegalArgumentException e) {
StreamCorruptedException ex = new StreamCorruptedException("invalid component encoding");
ex.initCause(e);
throw ex;
}
try {
Object obj = SerializationUtil.deserializationObject(raw);
componentList.add((KeyComponent) obj);
} catch (ClassCastException e) {
StreamCorruptedException ex = new StreamCorruptedException("invalid component payload");
ex.initCause(e);
throw ex;
} catch (StreamCorruptedException e) {
throw e;
}
}
LMKAndIK lmkAndIK = LMKAndIK.getInstance(componentList);
pcieCryptoService.recoverLmkEx(Hex.decode(lmkAndIK.getLmk()));
pcieCryptoService.loadLmk();
byte[] seedMac = pcieCryptoService.exportLmkSeedMac();
return Hex.toHexString(seedMac);
}
public String recoveryLMKAndGenIK(String lmkComponentHex) {
pcieCryptoService.recoverLmkEx(Hex.decode(lmkComponentHex));
pcieCryptoService.generateIk(IKEnums.KEY_TYPE_AUTH.getCode());
pcieCryptoService.generateIk(IKEnums.KEY_TYPE_DEVICE.getCode());
pcieCryptoService.loadLmk();
byte[] seedMac = pcieCryptoService.exportLmkSeedMac();
return Hex.toHexString(seedMac);
}
public LMK recoveryLMK1(LMK lmk) {
pcieCryptoService.recoverLmkEx(Hex.decode(lmk.getPcLmk()));
pcieCryptoService.loadLmk();
byte[] seedMac = pcieCryptoService.exportLmkSeedMac();
lmk.setUcSessionKey(Hex.toHexString(seedMac));
return lmk;
}
}