打包签名验签

src/main/java/com/sunyard/inf/SydSVApi.java

@@ -4,6 +4,8 @@ package com.sunyard.inf;
 import com.sunyard.RetWrap;
 import com.sunyard.cert.X509;
 
+import java.io.UnsupportedEncodingException;
+
 /**
  * 签名验签相关接口
  */
@@ -177,7 +179,7 @@ interface SydAttachedSVApi {
      * @return
      * 符合PKCS7标准的签名结果
      */
-    String attachedSign(byte[] orgData, String sCertDN);
+    String attachedSign(byte[] orgData, String sCertDN) throws UnsupportedEncodingException;
     byte[] attachedSignC(byte[] orgData, String sCertDN);
 
     /**

src/main/java/com/sunyard/util/ASN1Util.java

@@ -0,0 +1,67 @@
+package com.sunyard.util;
+
+import cn.hutool.core.bean.BeanUtil;
+import com.sunyard.RetWrap;
+import com.sunyard.proto.R;
+import com.sunyard.proto.Util;
+import org.bouncycastle.asn1.*;
+
+import java.io.IOException;
+
+
+public class ASN1Util {
+
+
+    public static RetWrap takeOutOriginDataFromPKCS7Sign(String sign) throws IOException {
+        RetWrap ret = new RetWrap();
+
+        ASN1Sequence seq = ASN1Sequence.getInstance(  Util.decodeBase64( sign ) );
+        ASN1TaggedObject tag = (ASN1TaggedObject) seq.getObjectAt(1).toASN1Primitive();
+        ASN1Sequence seq2 = (ASN1Sequence) tag.getObject();
+        ASN1Sequence seq3 = (ASN1Sequence) seq2.getObjectAt( 2 ).toASN1Primitive();
+        ASN1TaggedObject tag2 = (ASN1TaggedObject) seq3.getObjectAt( 1 );
+        DEROctetString o = (DEROctetString) tag2.getObject();
+        ret.put( "orgData", o.getOctets() );
+
+
+        ASN1TaggedObject tag3 = (ASN1TaggedObject) seq2.getObjectAt(3).toASN1Primitive();
+        ASN1Sequence seq4 = (ASN1Sequence) tag3.getObject();
+        ret.put("cert", CertUtil.encodeBase64(seq4.getEncoded()));
+
+        ASN1Sequence seq5 = (ASN1Sequence) seq4.getObjectAt( 0 ).toASN1Primitive();
+        ASN1Sequence seq6 = (ASN1Sequence) seq5.getObjectAt( 6 ).toASN1Primitive();
+        DERBitString pk = (DERBitString) seq6.getObjectAt( 1 ).toASN1Primitive();
+        ret.put("pk", pk.getEncoded() );
+
+        ASN1Encodable[] elements = seq3.toArray();
+        ASN1Encodable[] elements2 = new ASN1Encodable[ elements.length - 1];
+        for ( int i = 0; i < elements.length -1 ; i++ ){
+            elements2[i] = elements[i];
+        }
+
+        BeanUtil.setProperty(  seq3,  "elements", elements2);
+
+        ret.put("sign", Util.encodeBase64(seq.getEncoded()) );
+        return ret;
+    }
+
+    public static String addOriginDataToPKCS7Sign( byte[] originData, String sign) throws IOException {
+        ASN1Sequence seq = ASN1Sequence.getInstance(  Util.decodeBase64( sign ) );
+        ASN1TaggedObject tag = (ASN1TaggedObject) seq.getObjectAt(1).toASN1Primitive();
+        ASN1Sequence seq2 = (ASN1Sequence) tag.getObject();
+        ASN1Sequence seq3 = (ASN1Sequence) seq2.getObjectAt( 2 ).toASN1Primitive();
+
+        ASN1Encodable[] elements = seq3.toArray();
+        ASN1Encodable[] elements2 = new ASN1Encodable[ elements.length + 1];
+        for ( int i = 0; i < elements.length ; i++ ){
+            elements2[i] = elements[i];
+        }
+
+        elements2[ elements.length ] = new DERTaggedObject(true, 0, new DEROctetString( originData ));
+
+        BeanUtil.setProperty(  seq3,  "elements", elements2);
+
+        return Util.encodeBase64(seq.getEncoded());
+    }
+
+}

src/main/java/com/sunyard/util/CertUtil.java

@@ -0,0 +1,9 @@
+package com.sunyard.util;
+
+import sun.misc.BASE64Encoder;
+
+public class CertUtil {
+    public static String encodeBase64(byte[] data){
+        return new BASE64Encoder().encode( data );
+    }
+}

src/main/java/racal/sunyard/main/SydApi4j.java

@@ -4960,7 +4960,7 @@ public class SydApi4j implements SydApi {
 
         // 填充数据
         PacketSN sn = PacketSN.gen();
-        final int packLen = 2048;
+        final int packLen = 4064; // 2048
         int loop = msg.length / packLen;
         if (msg.length % packLen > 0) {
             loop++;
@@ -5016,7 +5016,7 @@ public class SydApi4j implements SydApi {
             }
 
 
-            ByteBuffer bb = ByteBuffer.allocate(3000);
+            ByteBuffer bb = ByteBuffer.allocate(4 * 1024 + 128);
 
             byte[] ret = new byte[2];
             bb.put(ret);
@@ -10424,6 +10424,64 @@ public class SydApi4j implements SydApi {
         return sign.getBytes();
     }
 
+    public String attachedSignSoft(byte[] orgData, String sCertDN) throws UnsupportedEncodingException {
+        String pk = this.GetDNPublicKey( SydApi.FOR_SIGN, sCertDN.getBytes("GBK") );
+        try {
+            byte[] hash = this.SM3Hash( pk, orgData );
+            String sign = this.detachedSign(0, hash, sCertDN);
+            return ASN1Util.addOriginDataToPKCS7Sign( orgData, sign );
+        } catch (IOException e) {
+            e.printStackTrace();
+            throw new IllegalArgumentException("解析 pkcs7 签名格式时错误");
+        }
+    }
+
+    private RetWrap attachedVerifySoftGetAll(byte[] sign){
+        RetWrap ret = null;
+
+        try {
+            ret = ASN1Util.takeOutOriginDataFromPKCS7Sign( new String(sign) );
+        } catch (IOException e) {
+            e.printStackTrace();
+            throw new IllegalArgumentException("解析 pkcs7 签名格式时错误");
+        }
+
+        byte[] orgData = (byte[]) ret.get("orgData");
+        byte[] pk = (byte[]) ret.get("pk");
+        byte[] hash = this.SM3Hash( Util.bytes2HexString( pk ), orgData );
+        String sign2 = (String) ret.get("sign");
+        boolean pass = this.detachedVerify( 0, hash , sign2);
+        if ( pass ) {
+            ret.put("oData", orgData);
+            String certInfo = (String) ret.get("cert");
+            certInfo = "-----BEGIN CERTIFICATE-----\r\n" + certInfo;
+            certInfo = certInfo + "\r\n-----END CERTIFICATE-----\r\n";
+
+            X509 x509 = GetX509CertInfo( certInfo );
+            ret.put("x509", x509);
+            return ret;
+        } else {
+            return null;
+        }
+    }
+
+    private boolean attachedVerifySoft(String sign){
+        RetWrap ret = null;
+        try {
+            ret = ASN1Util.takeOutOriginDataFromPKCS7Sign( sign );
+        } catch (IOException e) {
+            e.printStackTrace();
+            throw new IllegalArgumentException("解析 pkcs7 签名格式时错误");
+        }
+
+        byte[] orgData = (byte[]) ret.get("orgData");
+        byte[] pk = (byte[]) ret.get("pk");
+        byte[] hash = this.SM3Hash( Util.bytes2HexString( pk ), orgData );
+        String sign2 = (String) ret.get("sign");
+        return this.detachedVerify( 0, hash , sign2);
+    }
+
+
     /**
      * 带公钥证书与原始数据的数字签名（遵循 PKCS#7）
      * 使用指定的证书 DN，从加密设备获取对应的私钥证书，对指定的原始数据编制带公钥证书的数字签名（遵循 PKCS#7）。
@@ -10434,6 +10492,19 @@ public class SydApi4j implements SydApi {
      */
     @Override
     public String attachedSign(byte[] orgData, String sCertDN) {
+        try {
+            if ( orgData.length > 4096 ) {
+                return attachedSignSoft( orgData, sCertDN );
+            } else {
+                return attachedSignHsm( orgData, sCertDN );
+            }
+        }catch (UnsupportedEncodingException e) {
+            throw new IllegalArgumentException("DN is not in GBK");
+        }
+    }
+
+
+    public String attachedSignHsm(byte[] orgData, String sCertDN) {
         sCertDN = DnUtil.verifyDn( sCertDN );
 
         Proto8018 proto = new Proto8018();
@@ -10483,10 +10554,18 @@ public class SydApi4j implements SydApi {
         return ((PacketSection) ret.get("signature")).getString();
     }
 
+    public boolean attachedVerifyHsm(String sign) {
+        return attachedVerify( sign.getBytes() );
+    }
+
     @Override
     public boolean attachedVerify(String sign) {
+        if ( sign.length() > 4096  ) {
+            return attachedVerifySoft( sign );
+        } else {
             return attachedVerify( sign.getBytes() );
         }
+    }
 
     @Override
     public boolean attachedVerify(byte[] sign) {
@@ -10568,7 +10647,19 @@ public class SydApi4j implements SydApi {
         return attachedVerifyAndGetAll( sign.getBytes() );
     }
 
+    // 大数据兼容处理
     public RetWrap attachedVerifyAndGetAll(byte[] sign) {
+        if( sign.length > 4096 ) {
+
+            return attachedVerifySoftGetAll( sign );
+
+        } else {
+            return attachedVerifyAndGetAllHsm( sign );
+        }
+    }
+
+
+    public RetWrap attachedVerifyAndGetAllHsm(byte[] sign) {
         Proto8019 proto = new Proto8019();
 
         // 填充数据

src/test/java/com/sunyard/sydapi/test/TestE0.java

@@ -12,7 +12,7 @@ import java.util.Arrays;
 public class TestE0 {
 
     private SydApi4j api;
-    private byte[] data = new byte[ 4 * 1024 -1 ];
+    private byte[] data = new byte[ 0x501 ];
     private byte[] iv = new byte[ 32 ];
 
     @Before

src/test/java/com/sunyard/sydapi/test/TestHT.java

@@ -11,7 +11,6 @@ import org.junit.Test;
 import racal.sunyard.main.SydApi4j;
 
 import java.io.UnsupportedEncodingException;
-import java.util.Arrays;
 
 
 /**
@@ -24,7 +23,7 @@ public class TestHT {
     @Before
     public void before() {
         // 通过设置debug的属性开启debug，如果不设置则默认不打开
-        System.setProperty("com.sunyard.sydapi4j.debug", "true");
+//        System.setProperty("com.sunyard.sydapi4j.debug", "true");
         api = (SydApi4j) new SydApi4j().connect("172.16.18.59", 8889, null, 1000);
 //        api = (SydApi4j) new SydApi4j().connect("192.168.0.66", 8889, null, 1000);
     }
@@ -42,9 +41,9 @@ public class TestHT {
      * 流程演示
      */
     @Test
-    public void testProcess() throws UnsupportedEncodingException {
+    public void testProcess() {
         String dn = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
-        byte[] orgData = "111111213323143243243".getBytes("UTF-8");
+        byte[] orgData = new byte[2 * 1024 * 1024];
 
         // 签名
         String sign = api.attachedSign(orgData, dn);
@@ -102,6 +101,67 @@ public class TestHT {
         System.out.println("解密后的数据:" + new String(bytes1));
     }
 
+
+    @Test
+    public void testDetachedSignAndVerify1() throws UnsupportedEncodingException {
+        String dn = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
+        String orgData = "111111213323143243243";
+
+
+        String sign = api.attachedSign(orgData.getBytes(), dn);
+        System.out.println("签名结果: " + sign);
+        System.out.println("签名结果 hex : " + Util.bytes2HexString(Util.decodeBase64(sign)));
+
+        boolean verify = api.attachedVerify(sign);
+        System.out.println("验签结果: " + verify);
+        Assert.assertTrue(verify);
+    }
+
+
+    @Test
+    public void testDetachedSignAndVerify2() throws UnsupportedEncodingException {
+        String dn = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
+        String orgData = "111111213323143243243";
+
+
+        String sign = api.attachedSignSoft(orgData.getBytes(), dn);
+        System.out.println("签名结果: " + sign);
+        System.out.println("签名结果 hex: " + Util.bytes2HexString(Util.decodeBase64(sign)));
+
+        boolean verify = api.attachedVerify(sign);
+        System.out.println("验签结果: " + verify);
+        Assert.assertTrue(verify);
+    }
+
+
+    @Test
+    public void testDetachedSignAndVerify3() throws UnsupportedEncodingException {
+        String dn = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
+        byte[] orgData = new byte[3 * 1024];
+
+        String sign = api.attachedSign(orgData, dn);
+        System.out.println("签名结果: " + sign);
+        System.out.println("签名结果 hex: " + Util.bytes2HexString(Util.decodeBase64(sign)));
+
+        boolean verify = api.attachedVerify(sign);
+        System.out.println("验签结果: " + verify);
+        Assert.assertTrue(verify);
+    }
+
+    @Test
+    public void testDetachedSignAndVerify8() throws UnsupportedEncodingException {
+        String dn = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
+        byte[] orgData = new byte[8 * 1024];
+
+        String sign = api.attachedSign(orgData, dn);
+        System.out.println("签名结果: " + sign);
+        System.out.println("签名结果 hex: " + Util.bytes2HexString(Util.decodeBase64(sign)));
+
+        boolean verify = api.attachedVerify(sign);
+        System.out.println("验签结果: " + verify);
+        Assert.assertTrue(verify);
+    }
+
     // 测试通过
     // 8018
     @Test
@@ -110,6 +170,7 @@ public class TestHT {
         String orgData = "111111213323143243243";
         String sign = api.attachedSign(orgData.getBytes(), dn);
         System.out.println("签名结果: " + sign);
+        System.out.println("签名结果 hex : " + Util.bytes2HexString(Util.decodeBase64(sign)));
 
         boolean verify = api.attachedVerify(sign);
         System.out.println("验签结果: " + verify);
@@ -122,6 +183,7 @@ public class TestHT {
         String sign = api.attachedSign(orgData, dn);
         System.out.println("签名结果: " + sign);
 
+
         X509 verify = api.attachedVerifyAndGetX509(sign);
         System.out.println("验签结果: " + Util.bytes2HexString(verify.getPubKey()));
     }
@@ -151,6 +213,20 @@ public class TestHT {
         }
     }
 
+    @Test
+    public void testAttachedSignAndVerifyGetAll8k() {
+        String dn = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
+        byte[] orgData = new byte[ 8 * 1024 ];
+        String sign = api.attachedSign(orgData, dn);
+        System.out.println("签名结果: " + sign);
+
+        RetWrap verify = api.attachedVerifyAndGetAll(sign);
+        if (verify != null) {
+            System.out.println("x509公钥: " + Util.bytes2HexString(((X509) verify.get("x509")).getPubKey()));
+            System.out.println("签名原数据: " + verify.get("oData"));
+        }
+    }
+
 
     @Test
     public void testAttachedSignAndVerifyGetX509C() {
@@ -295,10 +371,6 @@ public class TestHT {
     }
 
 
-
-
-
-
     // 测试通过
     // 76
     @Test
@@ -311,7 +383,6 @@ public class TestHT {
     }
 
 
-
     // =============================工具方法==============================================
 
     public static void printRetWrap(RetWrap rw) {
@@ -320,6 +391,7 @@ public class TestHT {
 
     /**
      * 输出
+     *
      * @param rw
      */
     public static void printRetWrap(RetWrap rw, boolean flag) {
@@ -339,7 +411,4 @@ public class TestHT {
             }
         }
     }
-
-
-
 }