Sunyard/sydapi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

p1 p7签名兼容RSA、SM2

Browse Source
This commit is contained in:
yihzhou 2023-05-18 16:45:32 +08:00
parent ca32bb4c18
commit 10622bfb23
6 changed files with 308 additions and 119 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

218
DProto/8003.xml
View File

@ -1,127 +1,137 @@
<?xml version="1.0" encoding="UTF-8" ?>
<packet extend="base">
<req>
<req>
<command>
<bin>8003</bin>
</command>
<data extend="data">
<rFlag len="1" required="false" cn="RSA标志">
可选，存在，则固定值为‘P’
</rFlag>
<signatureDataType len="1" cn="获取公私钥标记位">
<options>
<option cn="索引方式">
<bin>00</bin>
</option>
<option cn="DN 方式">
<bin>01</bin>
</option>
</options>
</signatureDataType>
<command>
<bin>8003</bin>
</command>
<data extend="data">
<DN cn="DN 或 DN索引">
若上面的标志为1，则此域为证书DN，若为0，则此域为两个字节的证书索引；
</DN>
<algFlag len="1" :value="algFlag()" cn="算法标记">
</algFlag>
<hashFlag len="1" :if="null != $packet.data.hash" cn="外部 hash 标记">
<text>P</text>
</hashFlag>
<signatureDataType len="1" cn="获取公私钥标记位">
<options>
<option cn="索引方式">
<bin>00</bin>
</option>
<option cn="DN 方式">
<bin>01</bin>
</option>
</options>
</signatureDataType>
<hash len="32" :if="null != $packet.data.hash" cn="外部 hash">
</hash>
<DN cn="DN 或 DN索引">
若上面的标志为1，则此域为证书DN，若为0，则此域为两个字节的证书索引；
</DN>
<dataLength len="2" :value="dataLen()" cn="待签名数据长度">
待签名数据长度
</dataLength>
<hashFlag len="1" :if="null != $packet.data.hash" :value="flag()" cn="外部 hash 标记">
</hashFlag>
<signData cn="待签名数据">
待签名数据
</signData>
<hash len="32" :if="null != $packet.data.hash" cn="外部 hash">
</hash>
</data>
<dataLength len="2" :value="dataLen()" :if="null == $packet.data.hash" cn="待签名数据长度">
待签名数据长度
</dataLength>
<signData cn="待签名数据" :if="null == $packet.data.hash">
待签名数据
</signData>
</data>
</req>
<res>
</req>
<res>
<command>
<bin>8004</bin>
</command>
<data>
<error len="2" cn="错误码" format="X" :catch="catchError('%s')">
<options>
<option cn="无错误">
<hex>00</hex>
</option>
<option cn="无效的私钥类型">
<hex>03</hex>
</option>
<option cn="无效私钥标记">
<hex>04</hex>
</option>
<option cn="无效的哈希标识">
<hex>05</hex>
</option>
<option cn="无效的签名标识">
<hex>06</hex>
</option>
<option cn="无效的附加标识">
<hex>07</hex>
</option>
<option cn="LMK 错误">
LMK 错误；报告给管理员。
<hex>13</hex>
</option>
<option cn="输入数据错">
<hex>15</hex>
</option>
<option cn="DSP 错误">
DSP 错误；报告给管理员。
<hex>47</hex>
</option>
<option cn="私钥错误">
私钥错误；报告给管理员。
<hex>49</hex>
</option>
<option cn="无效摘要信息语法（仅仅无哈希模式）">
<hex>74</hex>
</option>
<option cn="公钥长度错误">
<hex>76</hex>
</option>
<option cn="私钥长度错误">
<hex>78</hex>
</option>
<option cn="输入数据长度错误">
<hex>80</hex>
</option>
</options>
</error>
<command>
<bin>8004</bin>
</command>
<data>
<error len="2" cn="错误码" format="X" :catch="catchError('%s')">
<options>
<option cn="无错误">
<hex>00</hex>
</option>
<option cn="无效的私钥类型">
<hex>03</hex>
</option>
<option cn="无效私钥标记">
<hex>04</hex>
</option>
<option cn="无效的哈希标识">
<hex>05</hex>
</option>
<option cn="无效的签名标识">
<hex>06</hex>
</option>
<option cn="无效的附加标识">
<hex>07</hex>
</option>
<option cn="LMK 错误">
LMK 错误；报告给管理员。
<hex>13</hex>
</option>
<option cn="输入数据错">
<hex>15</hex>
</option>
<option cn="DSP 错误">
DSP 错误；报告给管理员。
<hex>47</hex>
</option>
<option cn="私钥错误">
私钥错误；报告给管理员。
<hex>49</hex>
</option>
<option cn="无效摘要信息语法（仅仅无哈希模式）">
<hex>74</hex>
</option>
<option cn="公钥长度错误">
<hex>76</hex>
</option>
<option cn="私钥长度错误">
<hex>78</hex>
</option>
<option cn="输入数据长度错误">
<hex>80</hex>
</option>
</options>
</error>
<signatureLen len="2" cn="签名的字节长度">
签名的字节长度
</signatureLen>
<signatureLen len="2" cn="签名的字节长度">
签名的字节长度
</signatureLen>
<signature :len="signatureLen()" cn="签名的 DER 编码">
签名的 DER 编码
</signature>
<signature :len="signatureLen()" cn="签名的 DER 编码">
签名的 DER 编码
</signature>
<tailSep len="1" required="false" cn="尾分隔">
可选项。如果显示消息尾域，则该域必须显示。值为 “X’19”。
<hex>19</hex>
</tailSep>
<tailSep len="1" required="false" cn="尾分隔">
可选项。如果显示消息尾域，则该域必须显示。值为 “X’19”。
<hex>19</hex>
</tailSep>
<tail maxLen="32" required="false" cn="尾部">
可选项。最大长度为 32个字符。
</tail>
</data>
<tail maxLen="32" required="false" cn="尾部">
可选项。最大长度为 32个字符。
</tail>
</data>
</res>
<script type="javascript"><![CDATA[
</res>
<script type="javascript"><![CDATA[
function algFlag(){
if( 'P' == $packet.data.rFlag ) {
return ''
} else {
$packet.data.rFlag
}
}
function flag(){
return $packet.data.rFlag;
}
function dataLen(){
def len = $packet.data.signData.length
def ret = new byte[2]

20
DProto/8004.xml
View File

@ -6,6 +6,10 @@
<bin>8004</bin>
</command>
<data extend="data">
<algFlag len="1" :value="algFlag()" cn="算法标记">
</algFlag>
<signatureDataType len="1" cn="获取公私钥标记位">
<options>
<option cn="索引方式">
@ -32,8 +36,7 @@
标志为2 时存在
</organizationNum>
<hashFlag len="1" :if="null != $packet.data.hash" cn="外部 hash 标记">
<text>P</text>
<hashFlag len="1" :if="null != $packet.data.hash" :value="flag()" cn="外部 hash 标记">
</hashFlag>
<hash len="32" :if="null != $packet.data.hash" cn="外部 hash">
@ -132,7 +135,18 @@
</res>
<script><![CDATA[
function dataLen(){
function algFlag(){
if( 'P' == $packet.data.rFlag ) {
return ''
} else {
$packet.data.rFlag
}
}
function flag(){
return $packet.data.rFlag;
}
function dataLen(){
def len = $packet.data.odata.length
def ret = new byte[2]
ret[0] = (byte)(len >> 8 & 0xFF)

7
src/main/java/com/sunyard/inf/SydDetachedSVApi.java
View File

@ -110,6 +110,13 @@ public interface SydDetachedSVApi {
String sCertDN
);
//SM2与RSA兼容
public String detachedSignAll(int rFlag,byte[] orgData, String sCertDN);
//SM2与RSA兼容
public boolean detachedVerifyAll(int rFlag,byte[] orgData, String sign);
/**
* 带公钥证书与签名属性的数字签名（遵循 PKCS#7）
* @param dataType 数据类型：0，hash 模式，1为非hash模式

36
src/main/java/com/sunyard/inf/SydNakedSVApi.java
View File

@ -56,6 +56,42 @@ interface SydNakedSVApi {
byte[] sign,
String sCertDN
);
/**
* 使用指定的证书 DN，从加密设备获取对应的私钥证书，对指定的原始数据编制裸签名(遵循 PKCS#1)
* @param rFlag 摘要算法 1—DIGEST_ALGO_MD5 M
* 2—DIGEST_ALGO_SHA1 S
* 3—DIGEST_ALGO_SHA256 R
* 4-SM2 国密证书，SM3算法
* S代表RSA-SHA1进行签名，如果为R代表RSA-SHA256进行签名，如果为M代表RSA-MD5进行签名
* @param orgData 待签名的原始数据
* @param sCertDN 签名者证书 DN
* @return 签名数据
*/
public byte[] SYD_NakedSignAll(
int rFlag,
byte[] orgData,
String sCertDN
);
/**
* 使用指定的证书 DN，对指定的原始数据编制裸验签（遵循PKCS#1）
* @param rFlag 摘要算法 1—DIGEST_ALGO_MD5 M
* * 2—DIGEST_ALGO_SHA1 S
* * 3—DIGEST_ALGO_SHA256 R
* 4-SM2 国密证书，SM3算法
* * S代表RSA-SHA1进行签名，如果为R代表RSA-SHA256进行签名，如果为M代表RSA-MD5进行签名
* @param orgData 待签名的原始数据
* @param sign 签名数据
* @param sCertDN 签名者证书 DN
* @return 验签是否通过
*/
public boolean SYD_NakedVerifyAll(
int rFlag,
byte[] orgData,
byte[] sign,
String sCertDN
);
}

144
src/main/java/racal/sunyard/main/SydApi4j.java
View File

@ -398,6 +398,36 @@ public class SydApi4j implements SydApi {
}
}
public byte[] SYD_NakedSignAll(int rFlag,byte[] orgData, String sCertDN){
try {
String cert = getCertByDn(sCertDN);
boolean sm2Cert = CertUtil.isSM2Cert(cert);
if(!sm2Cert){//RSA
return SYD_NakedSign(rFlag,orgData,sCertDN);
}else {
return SYD_NakedSign(orgData,sCertDN);
}
} catch (UnsupportedEncodingException e) {
throw new RuntimeException(e);
}
}
public boolean SYD_NakedVerifyAll(int rFlag,byte[] orgData,byte[] sign, String sCertDN){
try {
String cert = getCertByDn(sCertDN);
boolean sm2Cert = CertUtil.isSM2Cert(cert);
if(!sm2Cert){//RSA
return SYD_NakedVerify(rFlag,orgData,sign,sCertDN);
}else {
return SYD_NakedVerify(orgData,sign,sCertDN);
}
} catch (UnsupportedEncodingException e) {
throw new RuntimeException(e);
}
}
public byte[] SYD_NakedSign(byte[] orgData, String sCertDN) {
if (orgData == null) {
throw new IllegalArgumentException("输入数据为 null");
@ -427,6 +457,7 @@ public class SydApi4j implements SydApi {
data.put("signatureDataType$option", 1);
data.put("DN", dn);
data.put("signData", orgData);
data.put("rFlag", 'P');
data.put("hash", hash);
ByteBuffer bb = proto.rend(packet);
synchronized(this) {
@ -464,8 +495,22 @@ public class SydApi4j implements SydApi {
return this.SYD_NakedSign(sCertDN, (byte[])null, hash);
}
@Override
public byte[] SYD_NakedSign_OuterHash(int rFlag,byte[] orgData, String sCertDN) {
byte[] hash = this.itHash(rFlag, orgData);// HASH类型。0: SHA1,1: SHA256,2: MD5
return this.SYD_NakedSign(rFlag,sCertDN, (byte[])null, hash);
}
public byte[] SYD_NakedSign(int rFlag, byte[] orgData, String sCertDN) {
if (orgData == null) {
throw new IllegalArgumentException("输入数据为 null");
} else {
return orgData.length < 4096 ? this.SYD_NakedSign(rFlag,sCertDN, orgData, (byte[])null) : this.SYD_NakedSign_OuterHash(rFlag,orgData, sCertDN);
}
}
public byte[] SYD_NakedSign(int rFlag, String sCertDN,byte[] orgData,byte[] hash) {
Proto8003 proto = new Proto8003();
byte[] dn = new byte[256];
byte[] s = null;
@ -498,6 +543,7 @@ public class SydApi4j implements SydApi {
data.put("signatureDataType$option", 1);
data.put("DN", dn);
data.put("signData", orgData);
data.put("hash", hash);
// 渲染发送
ByteBuffer bb = proto.rend(packet);
@ -552,6 +598,7 @@ public class SydApi4j implements SydApi {
data.put("signatureDataType$option", 1);
data.put("DN", dn);
data.put("odata", orgData);
data.put("rFlag", 'P');
data.put("hash", hash);
data.put("signature", sign);
data.put("returnSign$option", 0);
@ -594,9 +641,18 @@ public class SydApi4j implements SydApi {
return this.SYD_NakedVerify(sCertDN, sign, orgData, hash);
}
public boolean SYD_NakedVerify_OuterHash(int rFlag,byte[] orgData, byte[] sign, String sCertDN) {
byte[] hash = this.itHash(rFlag, orgData);
return this.SYD_NakedVerify(rFlag,sCertDN, sign, orgData, hash);
}
@Override
public boolean SYD_NakedVerify(int rFlag, byte[] orgData, byte[] sign, String sCertDN) {
public boolean SYD_NakedVerify(int rFlag,byte[] orgData, byte[] sign, String sCertDN) {
return orgData.length < 4096 ? this.SYD_NakedVerify( rFlag,sCertDN, sign, orgData, (byte[])null) : this.SYD_NakedVerify_OuterHash( rFlag,orgData, sign, sCertDN);
}
public boolean SYD_NakedVerify(int rFlag, String sCertDN,byte[] sign, byte[] orgData, byte[] hashData) {
Proto8004 proto = new Proto8004();
byte[] dn = new byte[256];
@ -629,6 +685,7 @@ public class SydApi4j implements SydApi {
data.put("DN", dn);
data.put("odata", orgData);
data.put("signature", sign);
data.put("hash", hashData);
data.put("returnSign$option", 0);
// 渲染发送
ByteBuffer bb = proto.rend(packet);
@ -798,6 +855,7 @@ public class SydApi4j implements SydApi {
public boolean sm3WithoutPKDetachedVerify(byte[] orgData, String sign) {
byte[] hash = SM3Hash(orgData);
return detachedVerify(DATA_HASH, hash, sign);
}
// 测试通过
@ -909,14 +967,41 @@ public class SydApi4j implements SydApi {
return true;
}
public boolean detachedVerifyRSA(int rFlag, int dataType, byte[] orgData, String sign) {
public boolean detachedVerifyAll(int rFlag,byte[] orgData, String sign){
try {
boolean sm2Cert = CertUtil.isSignedBySM2Cert(sign);
if(!sm2Cert){//RSA
return detachedVerifyRSA(rFlag,orgData,sign);
}else {
if( orgData.length<4096 ){
return detachedVerify(DATA_ORIGIN,orgData,sign);
}else {
RetWrap retWrap = ASN1Util.takeOutOriginDataFromPKCS7Sign(sign);
byte[] pk =(byte[]) retWrap.get("pk");
byte[] hash = this.SM3Hash(Util.bytes2HexString(pk), orgData);
return detachedVerify(DATA_HASH,hash,sign);
}
}
} catch (UnsupportedEncodingException e) {
throw new RuntimeException(e);
} catch (CertificateException e) {
throw new RuntimeException(e);
} catch (IOException e) {
throw new RuntimeException(e);
} catch (NoSuchProviderException e) {
throw new RuntimeException(e);
}
}
public boolean detachedVerifyRSA(int rFlag,byte[] orgData, String sign) {
boolean deVerify =false;
if(orgData.length<4096){
deVerify= detachedVerify(rFlag,dataType,orgData,sign);
deVerify= detachedVerify(rFlag,DATA_ORIGIN,orgData,sign);
}else {
//RetWrap hashData = countHash(0, 0, orgData, null);
byte[] hashData = itHash(0, orgData);
deVerify= this.detachedVerify(2, 0, hashData, sign);
byte[] hashData = itHash(rFlag, orgData);
deVerify= this.detachedVerify(rFlag, DATA_HASH, hashData, sign);
}
return deVerify;
}
@ -1107,15 +1192,38 @@ public class SydApi4j implements SydApi {
}
public String detachedSignAll(int rFlag,byte[] orgData, String sCertDN){
try {
String cert = getCertByDn(sCertDN);
boolean sm2Cert = CertUtil.isSM2Cert(cert);
if(!sm2Cert){//RSA
return detachedSignRSA(rFlag,orgData,sCertDN);
}else {
if (orgData.length<4096){
return detachedSign(DATA_ORIGIN,orgData,sCertDN);
}else {
String pk = null;
pk = this.SYD_SM2_Get_Dn_PublicKey_HA(sCertDN.getBytes("GBK"), 0);
byte[] hash = this.SM3Hash(pk, orgData);
return detachedSign(DATA_HASH,hash,sCertDN);
}
}
} catch (UnsupportedEncodingException e) {
throw new RuntimeException(e);
}
}
//人行大数据不指定摘要算法
public String detachedSignRSA(int rFlag, int dataType, byte[] orgData, String sCertDN) {
public String detachedSignRSA(int rFlag, byte[] orgData, String sCertDN) {
String sign =null;
if(orgData.length<4096){
sign = detachedSign(rFlag,dataType,orgData,sCertDN);
sign = detachedSign(rFlag,DATA_ORIGIN,orgData,sCertDN);
}else{
// RetWrap hashData = countHash(0, 0, orgData, null);
byte[] hash = itHash(0, orgData);
sign = detachedSign(2,0, hash, sCertDN);
byte[] hash = itHash(rFlag, orgData);
sign = detachedSign(rFlag,DATA_HASH, hash, sCertDN);
}
return sign;
}
@ -9174,7 +9282,19 @@ public class SydApi4j implements SydApi {
@param hashType HASH类型。0: SHA1,1: SHA256,2: MD5
@param orgData 原始数据
*/
public byte[] itHash(int hashType, byte[] orgData) {
public byte[] itHash(int digestAlg, byte[] orgData) {
//同步加密机与裸签摘要算法枚举值
if(!(digestAlg==1||digestAlg==2||digestAlg==3)){
throw new IllegalArgumentException("不支持的算法:" + digestAlg);
}
int hashType = 0;
if (digestAlg == 1) {
hashType = 2;
}
if (digestAlg == 3) {
hashType = 1;
}
byte[] hashData = new byte[0];
final int packLen = 4064;
// 如果长度小于等于 4064 ，发送唯一包

2
src/test/java/sample/Test4Nongxin.java Normal file
View File

@ -0,0 +1,2 @@
package sample;public class Test4Nongxin {
}