From 10622bfb23f8b1ac56238877a3e39816998921cb Mon Sep 17 00:00:00 2001
From: yihzhou <468340218@qq.com>
Date: Thu, 18 May 2023 16:45:32 +0800
Subject: [PATCH] =?UTF-8?q?p1=20p7=E7=AD=BE=E5=90=8D=E5=85=BC=E5=AE=B9RSA?=
 =?UTF-8?q?=E3=80=81SM2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 DProto/8003.xml                               | 218 +++++++++---------
 DProto/8004.xml                               |  20 +-
 .../com/sunyard/inf/SydDetachedSVApi.java     |   7 +
 .../java/com/sunyard/inf/SydNakedSVApi.java   |  36 +++
 .../java/racal/sunyard/main/SydApi4j.java     | 144 +++++++++++-
 src/test/java/sample/Test4Nongxin.java        |   2 +
 6 files changed, 308 insertions(+), 119 deletions(-)
 create mode 100644 src/test/java/sample/Test4Nongxin.java

diff --git a/DProto/8003.xml b/DProto/8003.xml
index c478d06..1217c65 100644
--- a/DProto/8003.xml
+++ b/DProto/8003.xml
@@ -1,127 +1,137 @@
 <?xml version="1.0" encoding="UTF-8" ?>
 <packet extend="base">
-	<req>
+    <req>
 
-    <command>
-        <bin>8003</bin>
-    </command>
-    <data extend="data">
-        <rFlag len="1" required="false" cn="RSA标志">
-            可选，存在，则固定值为‘P’
-        </rFlag>
-        <signatureDataType len="1" cn="获取公私钥标记位">
-            <options>
-                <option cn="索引方式">
-                    <bin>00</bin>
-                </option>
-                <option cn="DN 方式">
-                    <bin>01</bin>
-                </option>
-            </options>
-        </signatureDataType>
+        <command>
+            <bin>8003</bin>
+        </command>
+        <data extend="data">
 
-        <DN cn="DN 或 DN索引">
-            若上面的标志为1，则此域为证书DN，若为0，则此域为两个字节的证书索引；
-        </DN>
+            <algFlag len="1" :value="algFlag()" cn="算法标记">
+            </algFlag>
 
-        <hashFlag len="1" :if="null != $packet.data.hash" cn="外部 hash 标记">
-            <text>P</text>
-        </hashFlag>
+            <signatureDataType len="1" cn="获取公私钥标记位">
+                <options>
+                    <option cn="索引方式">
+                        <bin>00</bin>
+                    </option>
+                    <option cn="DN 方式">
+                        <bin>01</bin>
+                    </option>
+                </options>
+            </signatureDataType>
 
-        <hash len="32" :if="null != $packet.data.hash" cn="外部 hash">
-        </hash>
+            <DN cn="DN 或 DN索引">
+                若上面的标志为1，则此域为证书DN，若为0，则此域为两个字节的证书索引；
+            </DN>
 
-        <dataLength len="2" :value="dataLen()" cn="待签名数据长度">
-            待签名数据长度
-        </dataLength>
+            <hashFlag len="1" :if="null != $packet.data.hash" :value="flag()" cn="外部 hash 标记">
+            </hashFlag>
 
-        <signData cn="待签名数据">
-            待签名数据
-        </signData>
+            <hash len="32" :if="null != $packet.data.hash" cn="外部 hash">
+            </hash>
 
-    </data>
+            <dataLength len="2" :value="dataLen()" :if="null == $packet.data.hash" cn="待签名数据长度">
+                待签名数据长度
+            </dataLength>
+
+            <signData cn="待签名数据" :if="null == $packet.data.hash">
+                待签名数据
+            </signData>
+
+        </data>
 
 
 
-	</req>
-	<res>
+    </req>
+    <res>
 
-    <command>
-        <bin>8004</bin>
-    </command>
-    <data>
-        <error len="2" cn="错误码" format="X" :catch="catchError('%s')">
-            <options>
-                <option cn="无错误">
-                    <hex>00</hex>
-                </option>
-                <option cn="无效的私钥类型">
-                    <hex>03</hex>
-                </option>
-                <option cn="无效私钥标记">
-                    <hex>04</hex>
-                </option>
-                <option cn="无效的哈希标识">
-                    <hex>05</hex>
-                </option>
-                <option cn="无效的签名标识">
-                    <hex>06</hex>
-                </option>
-                <option cn="无效的附加标识">
-                    <hex>07</hex>
-                </option>
-                <option cn="LMK 错误">
-                    LMK 错误；报告给管理员。
-                    <hex>13</hex>
-                </option>
-                <option cn="输入数据错">
-                    <hex>15</hex>
-                </option>
-                <option cn="DSP 错误">
-                    DSP 错误；报告给管理员。
-                    <hex>47</hex>
-                </option>
-                <option cn="私钥错误">
-                    私钥错误；报告给管理员。
-                    <hex>49</hex>
-                </option>
-                <option cn="无效摘要信息语法（仅仅无哈希模式）">
-                    <hex>74</hex>
-                </option>
-                <option cn="公钥长度错误">
-                    <hex>76</hex>
-                </option>
-                <option cn="私钥长度错误">
-                    <hex>78</hex>
-                </option>
-                <option cn="输入数据长度错误">
-                    <hex>80</hex>
-                </option>
-            </options>
-        </error>
+        <command>
+            <bin>8004</bin>
+        </command>
+        <data>
+            <error len="2" cn="错误码" format="X" :catch="catchError('%s')">
+                <options>
+                    <option cn="无错误">
+                        <hex>00</hex>
+                    </option>
+                    <option cn="无效的私钥类型">
+                        <hex>03</hex>
+                    </option>
+                    <option cn="无效私钥标记">
+                        <hex>04</hex>
+                    </option>
+                    <option cn="无效的哈希标识">
+                        <hex>05</hex>
+                    </option>
+                    <option cn="无效的签名标识">
+                        <hex>06</hex>
+                    </option>
+                    <option cn="无效的附加标识">
+                        <hex>07</hex>
+                    </option>
+                    <option cn="LMK 错误">
+                        LMK 错误；报告给管理员。
+                        <hex>13</hex>
+                    </option>
+                    <option cn="输入数据错">
+                        <hex>15</hex>
+                    </option>
+                    <option cn="DSP 错误">
+                        DSP 错误；报告给管理员。
+                        <hex>47</hex>
+                    </option>
+                    <option cn="私钥错误">
+                        私钥错误；报告给管理员。
+                        <hex>49</hex>
+                    </option>
+                    <option cn="无效摘要信息语法（仅仅无哈希模式）">
+                        <hex>74</hex>
+                    </option>
+                    <option cn="公钥长度错误">
+                        <hex>76</hex>
+                    </option>
+                    <option cn="私钥长度错误">
+                        <hex>78</hex>
+                    </option>
+                    <option cn="输入数据长度错误">
+                        <hex>80</hex>
+                    </option>
+                </options>
+            </error>
 
-        <signatureLen len="2" cn="签名的字节长度">
-            签名的字节长度
-        </signatureLen>
+            <signatureLen len="2" cn="签名的字节长度">
+                签名的字节长度
+            </signatureLen>
 
-        <signature :len="signatureLen()" cn="签名的 DER 编码">
-            签名的 DER 编码
-        </signature>
+            <signature :len="signatureLen()" cn="签名的 DER 编码">
+                签名的 DER 编码
+            </signature>
 
-        <tailSep len="1" required="false" cn="尾分隔">
-            可选项。如果显示消息尾域，则该域必须显示。值为 “X’19”。
-            <hex>19</hex>
-        </tailSep>
+            <tailSep len="1" required="false" cn="尾分隔">
+                可选项。如果显示消息尾域，则该域必须显示。值为 “X’19”。
+                <hex>19</hex>
+            </tailSep>
 
-        <tail maxLen="32" required="false" cn="尾部">
-            可选项。最大长度为 32个字符。
-        </tail>
-    </data>
+            <tail maxLen="32" required="false" cn="尾部">
+                可选项。最大长度为 32个字符。
+            </tail>
+        </data>
 
 
 
-	</res>
-	<script type="javascript"><![CDATA[
+    </res>
+    <script type="javascript"><![CDATA[
+function algFlag(){
+    if( 'P' == $packet.data.rFlag ) {
+        return ''
+    } else {
+        $packet.data.rFlag
+    }
+}
+function flag(){
+    return $packet.data.rFlag;
+}
 function dataLen(){
     def len = $packet.data.signData.length
     def ret = new byte[2]
diff --git a/DProto/8004.xml b/DProto/8004.xml
index b17d768..a350107 100644
--- a/DProto/8004.xml
+++ b/DProto/8004.xml
@@ -6,6 +6,10 @@
             <bin>8004</bin>
         </command>
         <data extend="data">
+
+            <algFlag len="1" :value="algFlag()" cn="算法标记">
+            </algFlag>
+
             <signatureDataType len="1" cn="获取公私钥标记位">
                 <options>
                     <option cn="索引方式">
@@ -32,8 +36,7 @@
                 标志为2 时存在
             </organizationNum>
 
-            <hashFlag len="1" :if="null != $packet.data.hash" cn="外部 hash 标记">
-                <text>P</text>
+            <hashFlag len="1" :if="null != $packet.data.hash" :value="flag()" cn="外部 hash 标记">
             </hashFlag>
 
             <hash len="32" :if="null != $packet.data.hash" cn="外部 hash">
@@ -132,7 +135,18 @@
 
     </res>
     <script><![CDATA[
-	function dataLen(){
+function algFlag(){
+    if( 'P' == $packet.data.rFlag ) {
+        return ''
+    } else {
+        $packet.data.rFlag
+    }
+}
+function flag(){
+    return $packet.data.rFlag;
+}
+
+function dataLen(){
     def len = $packet.data.odata.length
     def ret = new byte[2]
     ret[0] = (byte)(len >> 8 & 0xFF)
diff --git a/src/main/java/com/sunyard/inf/SydDetachedSVApi.java b/src/main/java/com/sunyard/inf/SydDetachedSVApi.java
index 4864ec2..9aee025 100644
--- a/src/main/java/com/sunyard/inf/SydDetachedSVApi.java
+++ b/src/main/java/com/sunyard/inf/SydDetachedSVApi.java
@@ -110,6 +110,13 @@ public interface SydDetachedSVApi {
             String sCertDN
     );
 
+    //SM2与RSA兼容
+    public String detachedSignAll(int rFlag,byte[] orgData, String sCertDN);
+
+
+    //SM2与RSA兼容
+    public boolean detachedVerifyAll(int rFlag,byte[] orgData, String sign);
+
     /**
      * 带公钥证书与签名属性的数字签名（遵循 PKCS#7）
      * @param dataType 数据类型：0，hash 模式，1为非hash模式
diff --git a/src/main/java/com/sunyard/inf/SydNakedSVApi.java b/src/main/java/com/sunyard/inf/SydNakedSVApi.java
index 3f528fd..94bf623 100644
--- a/src/main/java/com/sunyard/inf/SydNakedSVApi.java
+++ b/src/main/java/com/sunyard/inf/SydNakedSVApi.java
@@ -56,6 +56,42 @@ interface SydNakedSVApi {
             byte[] sign,
             String sCertDN
     );
+
+    /**
+     * 使用指定的证书 DN，从加密设备获取对应的私钥证书，对指定的原始数据编制裸签名(遵循 PKCS#1)
+     * @param rFlag 摘要算法  1—DIGEST_ALGO_MD5      M
+     *                       2—DIGEST_ALGO_SHA1     S
+     *                       3—DIGEST_ALGO_SHA256   R
+     *                       4-SM2 国密证书，SM3算法
+     *              S代表RSA-SHA1进行签名，如果为R代表RSA-SHA256进行签名，如果为M代表RSA-MD5进行签名
+     * @param orgData 待签名的原始数据
+     * @param sCertDN 签名者证书 DN
+     * @return 签名数据
+     */
+    public byte[] SYD_NakedSignAll(
+            int rFlag,
+            byte[] orgData,
+            String sCertDN
+    );
+
+    /**
+     * 使用指定的证书 DN，对指定的原始数据编制裸验签（遵循PKCS#1）
+     * @param rFlag 摘要算法         1—DIGEST_ALGO_MD5      M
+     *      *                       2—DIGEST_ALGO_SHA1     S
+     *      *                       3—DIGEST_ALGO_SHA256   R
+     *                              4-SM2 国密证书，SM3算法
+     *      *              S代表RSA-SHA1进行签名，如果为R代表RSA-SHA256进行签名，如果为M代表RSA-MD5进行签名
+     * @param orgData 待签名的原始数据
+     * @param sign 签名数据
+     * @param sCertDN 签名者证书 DN
+     * @return 验签是否通过
+     */
+    public boolean SYD_NakedVerifyAll(
+            int rFlag,
+            byte[] orgData,
+            byte[] sign,
+            String sCertDN
+    );
 }
 
 
diff --git a/src/main/java/racal/sunyard/main/SydApi4j.java b/src/main/java/racal/sunyard/main/SydApi4j.java
index 338bc00..3bcceae 100644
--- a/src/main/java/racal/sunyard/main/SydApi4j.java
+++ b/src/main/java/racal/sunyard/main/SydApi4j.java
@@ -398,6 +398,36 @@ public class SydApi4j implements SydApi {
         }
     }
 
+    public byte[] SYD_NakedSignAll(int rFlag,byte[] orgData, String sCertDN){
+        try {
+            String cert = getCertByDn(sCertDN);
+            boolean sm2Cert = CertUtil.isSM2Cert(cert);
+            if(!sm2Cert){//RSA
+                return SYD_NakedSign(rFlag,orgData,sCertDN);
+            }else {
+                return SYD_NakedSign(orgData,sCertDN);
+            }
+        } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException(e);
+        }
+
+    }
+
+    public boolean SYD_NakedVerifyAll(int rFlag,byte[] orgData,byte[] sign, String sCertDN){
+        try {
+            String cert = getCertByDn(sCertDN);
+            boolean sm2Cert = CertUtil.isSM2Cert(cert);
+            if(!sm2Cert){//RSA
+                return SYD_NakedVerify(rFlag,orgData,sign,sCertDN);
+            }else {
+                return SYD_NakedVerify(orgData,sign,sCertDN);
+            }
+        } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException(e);
+        }
+
+    }
+
     public byte[] SYD_NakedSign(byte[] orgData, String sCertDN) {
         if (orgData == null) {
             throw new IllegalArgumentException("输入数据为 null");
@@ -427,6 +457,7 @@ public class SydApi4j implements SydApi {
         data.put("signatureDataType$option", 1);
         data.put("DN", dn);
         data.put("signData", orgData);
+        data.put("rFlag", 'P');
         data.put("hash", hash);
         ByteBuffer bb = proto.rend(packet);
         synchronized(this) {
@@ -464,8 +495,22 @@ public class SydApi4j implements SydApi {
         return this.SYD_NakedSign(sCertDN, (byte[])null, hash);
     }
 
-    @Override
+    public byte[] SYD_NakedSign_OuterHash(int rFlag,byte[] orgData, String sCertDN) {
+        byte[] hash = this.itHash(rFlag, orgData);//  HASH类型。0: SHA1,1: SHA256,2: MD5
+        return this.SYD_NakedSign(rFlag,sCertDN, (byte[])null, hash);
+    }
+
+
     public byte[] SYD_NakedSign(int rFlag, byte[] orgData, String sCertDN) {
+        if (orgData == null) {
+            throw new IllegalArgumentException("输入数据为 null");
+        } else {
+            return orgData.length < 4096 ? this.SYD_NakedSign(rFlag,sCertDN, orgData, (byte[])null) : this.SYD_NakedSign_OuterHash(rFlag,orgData, sCertDN);
+        }
+    }
+
+
+    public byte[] SYD_NakedSign(int rFlag, String sCertDN,byte[] orgData,byte[] hash) {
         Proto8003 proto = new Proto8003();
         byte[] dn = new byte[256];
         byte[] s = null;
@@ -498,6 +543,7 @@ public class SydApi4j implements SydApi {
         data.put("signatureDataType$option", 1);
         data.put("DN", dn);
         data.put("signData", orgData);
+        data.put("hash", hash);
         // 渲染发送
         ByteBuffer bb = proto.rend(packet);
 
@@ -552,6 +598,7 @@ public class SydApi4j implements SydApi {
         data.put("signatureDataType$option", 1);
         data.put("DN", dn);
         data.put("odata", orgData);
+        data.put("rFlag", 'P');
         data.put("hash", hash);
         data.put("signature", sign);
         data.put("returnSign$option", 0);
@@ -594,9 +641,18 @@ public class SydApi4j implements SydApi {
         return this.SYD_NakedVerify(sCertDN, sign, orgData, hash);
     }
 
+    public boolean SYD_NakedVerify_OuterHash(int rFlag,byte[] orgData, byte[] sign, String sCertDN) {
+        byte[] hash = this.itHash(rFlag, orgData);
+        return this.SYD_NakedVerify(rFlag,sCertDN, sign, orgData, hash);
+    }
 
-    @Override
-    public boolean SYD_NakedVerify(int rFlag, byte[] orgData, byte[] sign, String sCertDN) {
+
+    public boolean SYD_NakedVerify(int rFlag,byte[] orgData, byte[] sign, String sCertDN) {
+        return orgData.length < 4096 ? this.SYD_NakedVerify( rFlag,sCertDN, sign, orgData, (byte[])null) : this.SYD_NakedVerify_OuterHash( rFlag,orgData, sign, sCertDN);
+    }
+
+
+    public boolean SYD_NakedVerify(int rFlag, String sCertDN,byte[] sign, byte[] orgData, byte[] hashData) {
         Proto8004 proto = new Proto8004();
 
         byte[] dn = new byte[256];
@@ -629,6 +685,7 @@ public class SydApi4j implements SydApi {
         data.put("DN", dn);
         data.put("odata", orgData);
         data.put("signature", sign);
+        data.put("hash", hashData);
         data.put("returnSign$option", 0);
         // 渲染发送
         ByteBuffer bb = proto.rend(packet);
@@ -798,6 +855,7 @@ public class SydApi4j implements SydApi {
     public boolean sm3WithoutPKDetachedVerify(byte[] orgData, String sign) {
         byte[] hash = SM3Hash(orgData);
         return detachedVerify(DATA_HASH, hash, sign);
+
     }
 
     // 测试通过
@@ -909,14 +967,41 @@ public class SydApi4j implements SydApi {
         return true;
     }
 
-    public boolean detachedVerifyRSA(int rFlag, int dataType, byte[] orgData, String sign) {
+    public boolean detachedVerifyAll(int rFlag,byte[] orgData, String sign){
+        try {
+            boolean sm2Cert = CertUtil.isSignedBySM2Cert(sign);
+            if(!sm2Cert){//RSA
+                return detachedVerifyRSA(rFlag,orgData,sign);
+            }else {
+                if( orgData.length<4096 ){
+                    return  detachedVerify(DATA_ORIGIN,orgData,sign);
+                }else {
+                    RetWrap retWrap = ASN1Util.takeOutOriginDataFromPKCS7Sign(sign);
+                    byte[] pk =(byte[]) retWrap.get("pk");
+                    byte[] hash = this.SM3Hash(Util.bytes2HexString(pk), orgData);
+                    return detachedVerify(DATA_HASH,hash,sign);
+                }
+            }
+        } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException(e);
+        } catch (CertificateException e) {
+            throw new RuntimeException(e);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        } catch (NoSuchProviderException e) {
+            throw new RuntimeException(e);
+        }
+
+    }
+
+    public boolean detachedVerifyRSA(int rFlag,byte[] orgData, String sign) {
         boolean deVerify =false;
         if(orgData.length<4096){
-            deVerify= detachedVerify(rFlag,dataType,orgData,sign);
+            deVerify= detachedVerify(rFlag,DATA_ORIGIN,orgData,sign);
         }else {
             //RetWrap hashData = countHash(0, 0, orgData, null);
-            byte[] hashData = itHash(0, orgData);
-            deVerify= this.detachedVerify(2, 0,  hashData, sign);
+            byte[] hashData = itHash(rFlag, orgData);
+            deVerify= this.detachedVerify(rFlag, DATA_HASH,  hashData, sign);
         }
         return deVerify;
     }
@@ -1107,15 +1192,38 @@ public class SydApi4j implements SydApi {
     }
 
 
+    public String detachedSignAll(int rFlag,byte[] orgData, String sCertDN){
+        try {
+            String cert = getCertByDn(sCertDN);
+            boolean sm2Cert = CertUtil.isSM2Cert(cert);
+            if(!sm2Cert){//RSA
+                return detachedSignRSA(rFlag,orgData,sCertDN);
+            }else {
+                if (orgData.length<4096){
+                    return detachedSign(DATA_ORIGIN,orgData,sCertDN);
+                }else {
+                    String pk = null;
+                    pk = this.SYD_SM2_Get_Dn_PublicKey_HA(sCertDN.getBytes("GBK"), 0);
+                    byte[] hash = this.SM3Hash(pk, orgData);
+                    return detachedSign(DATA_HASH,hash,sCertDN);
+                }
+            }
+        } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException(e);
+        }
+
+    }
+
+
     //人行大数据不指定摘要算法
-    public String detachedSignRSA(int rFlag, int dataType, byte[] orgData, String sCertDN) {
+    public String detachedSignRSA(int rFlag, byte[] orgData, String sCertDN) {
         String sign =null;
         if(orgData.length<4096){
-            sign = detachedSign(rFlag,dataType,orgData,sCertDN);
+            sign = detachedSign(rFlag,DATA_ORIGIN,orgData,sCertDN);
         }else{
            // RetWrap hashData = countHash(0, 0, orgData, null);
-            byte[] hash = itHash(0, orgData);
-            sign = detachedSign(2,0, hash, sCertDN);
+            byte[] hash = itHash(rFlag, orgData);
+            sign = detachedSign(rFlag,DATA_HASH, hash, sCertDN);
         }
         return sign;
     }
@@ -9174,7 +9282,19 @@ public class SydApi4j implements SydApi {
     @param hashType   HASH类型。0: SHA1,1: SHA256,2: MD5
     @param orgData    原始数据
      */
-    public byte[] itHash(int hashType, byte[] orgData) {
+    public byte[] itHash(int digestAlg, byte[] orgData) {
+        //同步加密机与裸签摘要算法枚举值
+        if(!(digestAlg==1||digestAlg==2||digestAlg==3)){
+            throw new IllegalArgumentException("不支持的算法:" + digestAlg);
+        }
+        int hashType = 0;
+        if (digestAlg == 1) {
+            hashType = 2;
+        }
+        if (digestAlg == 3) {
+            hashType = 1;
+        }
+
         byte[] hashData = new byte[0];
         final int packLen = 4064;
         // 如果长度小于等于 4064 ，发送唯一包
diff --git a/src/test/java/sample/Test4Nongxin.java b/src/test/java/sample/Test4Nongxin.java
new file mode 100644
index 0000000..865a450
--- /dev/null
+++ b/src/test/java/sample/Test4Nongxin.java
@@ -0,0 +1,2 @@
+package sample;public class Test4Nongxin {
+}