增加及修改文件以适应RSA密钥签名验签功能
This commit is contained in:
yihzhou
@@ -0,0 +1,6 @@
|
||||
06CE000000000000000080110000
|
||||
06C0 = 1728 3456
|
||||
2D2D2D2D2D424547494E2043455254494649434154452D2D2D2D2D0A4D4949453044434341376967417749424167494649414E4843544D774451594A4B6F5A496876634E41514546425141775754454C4D416B474131554542684D430A513034784D44417542674E5642416F544A304E6F6157356849455A70626D467559326C68624342445A584A3061575A70593246306157397549454631644768760A636D6C30655445594D4259474131554541784D5051305A445153425552564E5549453944515445784D423458445445314D444D784D7A41324D7A4D784D566F580A445449774D444D784D7A41324D7A4D784D566F77647A454C4D416B474131554542684D43593234784654415442674E5642416F5444454E4751304567564556540A564342445154454E4D4173474131554543784D45546B4E544D6A45554D4249474131554543784D4C525735305A584A77636D6C7A5A584D784C44417142674E560A42414D55497A41304D5542614E4441794E4455784D4441774D44457751464E6F595735456232356E514441774D4441774D4441784D494942496A414E42676B710A686B6947397730424151454641414F43415138414D49494243674B4341514541356A556E487733425870517064416D64766B4B4B766A6A34334166615670664B0A6C77704345532B475233386B4D4D5279594563323538305A4F36394E52525970515561635951316A585A5177567276324B787476556E54746E77756F324571450A7A77414D5963566163646345426D462F716F6A727745314844712F334E6352442F44753231676339634450474B62374B384862712F717138364B7042716754380A326466305331344E645770796135746B51544B417A34496B3346443733456C72537137336766614A2B623764526C634E4649306D77725A4A36684F7945764E660A537975553165475273775A455965586357576C3832472F6D464C6B3064746D34734E5930344E4A38724F51586B6569386D65494C6D687538537330654961346C0A794A556C4865487732316F566A75326835754B667848665670547669337258636E4E796851374550755A6272635364697845427256774944415141426F3449420A667A434341587377487759445652306A42426777466F41552F417538524A6F4F4D614744715947484A7834465173612F567667775341594456523067424545770A507A4139426768676752794737796F42416A41784D43384743437347415155464277494246694E6F644852774F693876643364334C6D4E6D59324575593239740A4C6D4E754C33567A4C33567A4C5445314C6D6830625443427A41594456523066424948454D4948424D49474F6F49474C6F494749686F47466247526863446F760A4C7A49784D4334334E4334304D5334784F4441364D7A67354C324E7550574E79624449774E6A677362335539556C4E424C45395650554E535443785050554E470A5130456756455654564342445153784450554E4F50324E6C636E52705A6D6C6A5958526C556D563262324E6864476C76626B78706333512F596D467A5A5439760A596D706C5933526A6247467A637A316A556B784561584E30636D6C69645852706232355162326C75644441756F4379674B6F596F6148523063446F764C7A49780A4D4334334E4334304D69347A4C303944515445784C314A545153396A636D77794D4459344C6D4E796244414C42674E564851384542414D43412B6777485159440A5652304F424259454642784838423835612B337A71464F416C48677054574F2B666646734D424D47413155644A51514D4D416F47434373474151554642774D430A4D413047435371475349623344514542425155414134494241514358457A464655352F447936724C50707A495361536934772B352B747351304C496156314E540A376277372F2F7A4D304A694974575A5A53354F54767859705951325466534A544D354F506B3045696F366856456B454651354F697457704D656E54674D3244320A572B4F4534494A44737652635551717565394B674E4A4171722F4B732F2B325A484D6C4C496B374669494C504F4B30354B585176574D413938396E3552744A770A7357743378443276504C2B46484976784C65627455584850595676462B49774B514E2F644F41684F625437386D6B327162534C47345473694F314A6A627250750A4A5774633564624A704933643876506E327A5A486258577055494D3457634F595133457858657341633258566842654F7A754E3373567A774C684550577235430A306A5964443777346E64657854543845754147644F43324B4F5655633551312B614B516A2B5351356A666D474F4235470A2D2D2D2D2D454E442043455254494649434154452D2D2D2D2D0A
|
||||
|
||||
HEXÊý¾Ý: 00200000000000000000374530303FD9071FE57D552F8E4564F991C7FCEF25B4DD5C
|
||||
HEXÊý¾Ý: 002C00000000000000003745303047381495D90480EEFAA38B04811AF6EA0BC41617F4F6023C1860DB6DE2870F23
|
||||
@@ -132,6 +132,18 @@ public interface SydGenApi {
|
||||
*/
|
||||
RetWrap SM2GenSessionKey(String publicKey);
|
||||
|
||||
|
||||
/**
|
||||
* 此函数用于会话密钥的产生，用于发起端。
|
||||
* 加密机产生随机会话密钥，输出两类密文：
|
||||
* 1、 RSA公钥加密的密文，用于密钥的传递。
|
||||
* 2、 本地 LMK 加密，用于本地应用数据的加解密。
|
||||
*
|
||||
* @param publicKey 公钥串，DER 编码，HEX 格式。
|
||||
* @return CipherKey 公钥加密的会话密钥,DER 编码，HEX 格式, SessionKey 本地LMK 加密的会话密钥，HEX 格式 , KCV 会话密钥的检验值，HEX 格式，长度为 16H
|
||||
*/
|
||||
RetWrap RSAGenSessionKey(String publicKey);
|
||||
|
||||
/**
|
||||
* 生成数字信封
|
||||
* @param publicKey 公钥
|
||||
@@ -228,6 +240,8 @@ public interface SydGenApi {
|
||||
*/
|
||||
RetWrap generateDEByDn(String certSerial, byte[] oData);
|
||||
|
||||
RetWrap generateDEByDn(int alg,String certSerial, byte[] oData);
|
||||
|
||||
/**
|
||||
* 产生对称密钥，通过公钥加密生成网联格式的数字信封。
|
||||
|
||||
@@ -325,6 +339,21 @@ public interface SydGenApi {
|
||||
*/
|
||||
RetWrap decryptDE(boolean pFlag, int model, byte[] certSerial, String pCipherKey);
|
||||
|
||||
/**
|
||||
* 接收用RSA私钥解密数字信封，还原对称密钥。
|
||||
*
|
||||
* @param pFlag 输入。 p标识，如果为true，则传入R
|
||||
* @param model 输入。 证书模式,0:证书序号，1：证书 DN
|
||||
* @param certSerial 输入。 对方 X509 证书的序列号或DN。
|
||||
* @param pCipherKey 输入。 公钥加密的会话密钥,BASE64 编码
|
||||
* @return RetWrap 包含 SessionKey KCV
|
||||
* oData 如果有机构码的话会返回原数据
|
||||
* SessionKey 输出。 本地LMK 加密的会话密钥，格式为：密钥类型|密钥密文，比如：02|密钥密文
|
||||
* KCV 会话密钥的检验值，HEX 格式，长度为 36H。
|
||||
* orgCode 如果有机构码的话会返回机构码
|
||||
*/
|
||||
RetWrap decryptDERSA(boolean pFlag, int model, byte[] certSerial, String pCipherKey);
|
||||
|
||||
/**
|
||||
* 产生要求长度的随即数据串，可用于身份认证
|
||||
*
|
||||
|
||||
@@ -28,6 +28,18 @@ interface SydNakedSVApi {
|
||||
byte[] orgData,
|
||||
String sCertDN
|
||||
);
|
||||
/**
|
||||
* 使用指定的证书 DN，从加密设备获取对应的私钥证书，对指定的原始数据编制裸签名(遵循 PKCS#1)
|
||||
* 人行项目增加RSA
|
||||
* @param orgData 待签名的原始数据
|
||||
* @param sCertDN 签名者证书 DN
|
||||
* @return 签名数据
|
||||
*/
|
||||
public byte[] SYD_NakedSign(
|
||||
int rFlag,
|
||||
byte[] orgData,
|
||||
String sCertDN
|
||||
);
|
||||
|
||||
|
||||
/**
|
||||
@@ -42,8 +54,22 @@ interface SydNakedSVApi {
|
||||
byte[] sign,
|
||||
String sCertDN
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* 使用指定的证书 DN，对指定的原始数据编制裸验签（遵循PKCS#1）
|
||||
* @param orgData 待签名的原始数据
|
||||
* @param sign 签名数据
|
||||
* @param sCertDN 签名者证书 DN
|
||||
* @return 验签是否通过
|
||||
*/
|
||||
public boolean SYD_NakedVerify(
|
||||
int rFlag,
|
||||
byte[] orgData,
|
||||
byte[] sign,
|
||||
String sCertDN
|
||||
);
|
||||
}
|
||||
/**
|
||||
* 带原文的签名验签
|
||||
*/
|
||||
@@ -182,6 +208,19 @@ interface SydAttachedSVApi {
|
||||
String attachedSign(byte[] orgData, String sCertDN) throws UnsupportedEncodingException;
|
||||
byte[] attachedSignC(byte[] orgData, String sCertDN);
|
||||
|
||||
|
||||
/**
|
||||
* 人行项目需要需要支持RSA
|
||||
* 带公钥证书与原始数据的数字签名（遵循 PKCS#7）
|
||||
* 使用指定的证书 DN，从加密设备获取对应的私钥证书，对指定的原始数据编制带公钥证书的数字签名（遵循 PKCS#7）。
|
||||
*
|
||||
* @param orgData 待签名数据
|
||||
* @param sCertDN 证书DN
|
||||
* @return
|
||||
* 符合PKCS7标准的签名结果
|
||||
*/
|
||||
String attachedSign(int rFlag,byte[] orgData, String sCertDN) throws UnsupportedEncodingException;
|
||||
|
||||
/**
|
||||
* 带公钥证书与原始数据的数字签名验签（遵循 PKCS#7）
|
||||
* 对指定的原始数据核验其带公钥证书签名。如签名有效（含证书无效）且需返回签名者公钥证书信息时，同时返回签名者公钥证书信息。
|
||||
@@ -190,6 +229,17 @@ interface SydAttachedSVApi {
|
||||
* @return true 验签通过 false 验签失败
|
||||
*/
|
||||
boolean attachedVerify(String sign);
|
||||
|
||||
/**
|
||||
* 带公钥证书与原始数据的数字签名验签（遵循 PKCS#7）
|
||||
* 对指定的原始数据核验其带公钥证书签名。如签名有效（含证书无效）且需返回签名者公钥证书信息时，同时返回签名者公钥证书信息。
|
||||
*
|
||||
* @param sign 已签名数据
|
||||
* @return true 验签通过 false 验签失败
|
||||
*/
|
||||
boolean attachedVerify(int rFlag,String sign);
|
||||
|
||||
|
||||
boolean attachedVerify(byte[] sign);
|
||||
|
||||
/**
|
||||
@@ -254,6 +304,19 @@ interface SydDetachedSVApi {
|
||||
String sCertDN
|
||||
);
|
||||
|
||||
/**
|
||||
* 人行项目需要RSA支持
|
||||
* 通过指定的私钥对指定的原始数据编制带公钥证书的数字签名（遵循PKCS#7）
|
||||
* @param orgData 待签名的原始数据
|
||||
* @param sCertDN 签名者证书 DN
|
||||
* @return 签名数据
|
||||
*/
|
||||
public String SYD_DetachedSign(
|
||||
int rFlag,
|
||||
byte[] orgData,
|
||||
String sCertDN
|
||||
);
|
||||
|
||||
|
||||
|
||||
/**
|
||||
@@ -361,6 +424,23 @@ interface SydDetachedSVApi {
|
||||
byte[] orgData,
|
||||
String sign);
|
||||
|
||||
/**
|
||||
* 对指定的原始数据核验其带公钥证书签名（PKCS#7）
|
||||
* 数据模式可选 DATA_HASH 或 DATA_ORIGIN
|
||||
*
|
||||
*
|
||||
* @param rFlag RSA标识
|
||||
* @param dataType 输入的数据为 HASH 后的数据 DATA_HASH = 0 ，输入的数据为原始数据库 DATA_ORIGIN = 1
|
||||
* @param orgData 待签名的原始数据
|
||||
* @param sign 签名数据
|
||||
* @return 验签是否通过
|
||||
*/
|
||||
boolean detachedVerify(
|
||||
int rFlag,
|
||||
int dataType,
|
||||
byte[] orgData,
|
||||
String sign);
|
||||
|
||||
/**
|
||||
* 带公钥证书与签名属性的数字签名验签（遵循 PKCS#7）
|
||||
* @param dataType 数据类型：0，hash 模式，1为非hash模式
|
||||
|
||||
@@ -18,12 +18,14 @@ public class ASN1Util {
|
||||
ASN1Sequence seq = ASN1Sequence.getInstance( Util.decodeBase64( sign ) );
|
||||
ASN1TaggedObject tag = (ASN1TaggedObject) seq.getObjectAt(1).toASN1Primitive();
|
||||
ASN1Sequence seq2 = (ASN1Sequence) tag.getObject();
|
||||
ASN1Sequence seq3 = (ASN1Sequence) seq2.getObjectAt( 2 ).toASN1Primitive();
|
||||
ASN1TaggedObject tag2 = (ASN1TaggedObject) seq3.getObjectAt( 1 );
|
||||
DEROctetString o = (DEROctetString) tag2.getObject();
|
||||
ret.put( "orgData", o.getOctets() );
|
||||
|
||||
|
||||
ASN1Sequence seq3 = null;
|
||||
try {
|
||||
seq3 = (ASN1Sequence) seq2.getObjectAt( 2 ).toASN1Primitive();
|
||||
ASN1TaggedObject tag2 = (ASN1TaggedObject) seq3.getObjectAt( 1 );
|
||||
DEROctetString o = (DEROctetString) tag2.getObject();
|
||||
ret.put( "orgData", o.getOctets() );
|
||||
} catch (Exception e) {
|
||||
}
|
||||
ASN1TaggedObject tag3 = (ASN1TaggedObject) seq2.getObjectAt(3).toASN1Primitive();
|
||||
ASN1Sequence seq4 = (ASN1Sequence) tag3.getObject();
|
||||
ret.put("cert", CertUtil.encodeBase64(seq4.getEncoded()));
|
||||
|
||||
@@ -76,7 +76,15 @@ public class CertUtil {
|
||||
* @return true 国密， false 非国密
|
||||
*/
|
||||
public static boolean isSM2Cert(String cert) throws CertificateException, NoSuchProviderException {
|
||||
X509Certificate certificate = convertToX509Cert(cert);
|
||||
String pemCert;
|
||||
if(cert.contains("-----BEGIN CERTIFICATE-----")){
|
||||
pemCert =cert;
|
||||
}else {
|
||||
String cert_begin = "-----BEGIN CERTIFICATE-----\n";
|
||||
String end_cert = "\n-----END CERTIFICATE-----";
|
||||
pemCert = cert_begin + cert + end_cert;
|
||||
}
|
||||
X509Certificate certificate = convertToX509Cert(pemCert);
|
||||
String signAlg = certificate.getSigAlgName();
|
||||
return signAlg.toUpperCase().indexOf("SM2") >= 0;
|
||||
}
|
||||
@@ -89,7 +97,16 @@ public class CertUtil {
|
||||
*/
|
||||
public static boolean isSignedBySM2Cert(String pkcs7) throws IOException, CertificateException, NoSuchProviderException {
|
||||
RetWrap ret = ASN1Util.takeOutOriginDataFromPKCS7Sign(pkcs7);
|
||||
return isSM2Cert((String) ret.get("cert"));
|
||||
//return isSM2Cert((String) ret.get("cert"));
|
||||
String cert =(String) ret.get("cert");
|
||||
if(cert.contains("-----BEGIN CERTIFICATE-----")){
|
||||
return isSM2Cert(cert);
|
||||
}else{
|
||||
String cert_begin = "-----BEGIN CERTIFICATE-----\n";
|
||||
String end_cert = "\n-----END CERTIFICATE-----";
|
||||
String pemCert = cert_begin + cert + end_cert;
|
||||
return isSM2Cert(pemCert);
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -438,6 +438,66 @@ public class SydApi4j implements SydApi {
|
||||
}
|
||||
|
||||
|
||||
@Override
|
||||
public byte[] SYD_NakedSign(int rFlag, byte[] orgData, String sCertDN) {
|
||||
Proto8003 proto = new Proto8003();
|
||||
byte[] dn = new byte[256];
|
||||
byte[] s = null;
|
||||
try {
|
||||
s = sCertDN.getBytes("GBK");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
System.arraycopy(s, 0, dn, 0, s.length);
|
||||
|
||||
// 填充数据
|
||||
HashMap<String, Object> packet = new HashMap<String, Object>();
|
||||
HashMap<String, Object> data = new HashMap<String, Object>();
|
||||
packet.put("data", data);
|
||||
PacketSN sn = PacketSN.gen();
|
||||
packet.put("header", sn.getSn().array());
|
||||
if(rFlag ==1){
|
||||
data.put("rFlag", 'M');
|
||||
}
|
||||
if(rFlag ==2){
|
||||
data.put("rFlag", 'S');
|
||||
}
|
||||
if(rFlag ==3){
|
||||
data.put("rFlag", 'R');
|
||||
}
|
||||
data.put("signatureDataType$option", 1);
|
||||
data.put("DN", dn);
|
||||
data.put("signData", orgData);
|
||||
// 渲染发送
|
||||
ByteBuffer bb = proto.rend(packet);
|
||||
|
||||
synchronized (this) {
|
||||
// 响应解析
|
||||
bb = syncRead(syncSend(bb));
|
||||
}
|
||||
|
||||
|
||||
Packet p = proto.parse(bb);
|
||||
Map<String, Object> ret = p.toMap();
|
||||
|
||||
if (
|
||||
!Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
|
||||
) {
|
||||
throw new SydApiException("包序号不匹配", -4);
|
||||
}
|
||||
ret = (Map<String, Object>) ret.get("data");
|
||||
PacketSection error = (PacketSection) ret.get("error");
|
||||
byte[] be = error.getBytes();
|
||||
if (
|
||||
(0 != (be[0] ^ be[1]))) {
|
||||
|
||||
throw new SydApiException(error.getInfo(), error.autoInt());
|
||||
}
|
||||
return ((PacketSection) ret.get("signature")).getBytes();
|
||||
}
|
||||
|
||||
|
||||
@Override
|
||||
public boolean SYD_NakedVerify(byte[] orgData, byte[] sign, String sCertDN) {
|
||||
Proto8004 proto = new Proto8004();
|
||||
@@ -493,6 +553,70 @@ public class SydApi4j implements SydApi {
|
||||
return true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean SYD_NakedVerify(int rFlag,byte[] orgData, byte[] sign, String sCertDN) {
|
||||
Proto8004 proto = new Proto8004();
|
||||
|
||||
byte[] dn = new byte[256];
|
||||
byte[] s = null;
|
||||
|
||||
try {
|
||||
s = sCertDN.getBytes("GBK");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
System.arraycopy(s, 0, dn, 0, s.length);
|
||||
|
||||
// 填充数据
|
||||
HashMap<String, Object> packet = new HashMap<String, Object>();
|
||||
HashMap<String, Object> data = new HashMap<String, Object>();
|
||||
packet.put("data", data);
|
||||
PacketSN sn = PacketSN.gen();
|
||||
packet.put("header", sn.getSn().array());
|
||||
if(rFlag ==1){
|
||||
data.put("rFlag", 'M');
|
||||
}
|
||||
if(rFlag ==2){
|
||||
data.put("rFlag", 'S');
|
||||
}
|
||||
if(rFlag ==3){
|
||||
data.put("rFlag", 'R');
|
||||
}
|
||||
data.put("signatureDataType$option", 1);
|
||||
data.put("DN", dn);
|
||||
data.put("odata", orgData);
|
||||
data.put("signature", sign);
|
||||
data.put("returnSign$option", 0);
|
||||
// 渲染发送
|
||||
ByteBuffer bb = proto.rend(packet);
|
||||
|
||||
synchronized (this) {
|
||||
byte[] b = syncSend(bb);
|
||||
|
||||
// 响应解析
|
||||
bb = syncRead(b);
|
||||
}
|
||||
|
||||
Packet p = proto.parse(bb, packet);
|
||||
Map<String, Object> ret = p.toMap();
|
||||
|
||||
if (
|
||||
!Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
|
||||
) {
|
||||
throw new SydApiException("包序号不匹配", -4);
|
||||
}
|
||||
ret = (Map<String, Object>) ret.get("data");
|
||||
PacketSection error = (PacketSection) ret.get("error");
|
||||
byte[] be = error.getBytes();
|
||||
if ((0 != (be[0] ^ be[1]))) {
|
||||
SydApiException e = new SydApiException(error.getInfo(), error.autoInt());
|
||||
println("验签失败=" + e.toString());
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
@Override
|
||||
public String sm3AndDetachedSign(byte[] orgData, String publicKey, String sCertDN) {
|
||||
@@ -743,6 +867,71 @@ public class SydApi4j implements SydApi {
|
||||
return true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean detachedVerify(int rFlag,int dataType, byte[] orgData, String sign) {
|
||||
Proto8006 proto = new Proto8006();
|
||||
|
||||
// 填充数据
|
||||
HashMap<String, Object> packet = new HashMap<String, Object>();
|
||||
HashMap<String, Object> data = new HashMap<String, Object>();
|
||||
packet.put("data", data);
|
||||
PacketSN sn = PacketSN.gen();
|
||||
if(rFlag ==1){//RSA证书
|
||||
data.put("rFlag", 'D');
|
||||
}
|
||||
if(rFlag ==2){
|
||||
data.put("rFlag", 'O');
|
||||
}
|
||||
if(rFlag ==3){
|
||||
data.put("rFlag", 'U');
|
||||
}
|
||||
packet.put("header", sn.getSn().array());
|
||||
|
||||
|
||||
if (dataType == DATA_HASH) {
|
||||
if(rFlag ==1){//RSA证书
|
||||
data.put("hashFlag", 'M');
|
||||
}
|
||||
if(rFlag ==2){
|
||||
data.put("hashFlag", 'S');
|
||||
}
|
||||
if(rFlag ==3){
|
||||
data.put("hashFlag", 'R');
|
||||
}
|
||||
data.put("hash", orgData);
|
||||
} else {
|
||||
data.put("originData", orgData);
|
||||
}
|
||||
data.put("signData", sign.getBytes());
|
||||
data.put("flag$option", 0);
|
||||
// 渲染发送
|
||||
ByteBuffer bb = proto.rend(packet);
|
||||
|
||||
synchronized (this) {
|
||||
// 响应解析
|
||||
bb = syncRead(syncSend(bb));
|
||||
}
|
||||
|
||||
Packet p = proto.parse(bb, packet);
|
||||
Map<String, Object> ret = p.toMap();
|
||||
|
||||
if (
|
||||
!Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
|
||||
) {
|
||||
throw new SydApiException("包序号不匹配", -4);
|
||||
}
|
||||
ret = (Map<String, Object>) ret.get("data");
|
||||
PacketSection error = (PacketSection) ret.get("error");
|
||||
byte[] be = error.getBytes();
|
||||
if ((0 != (be[0] ^ be[1]))) {
|
||||
SydApiException e = new SydApiException(error.getInfo(), error.autoInt());
|
||||
println("验签失败=" + e.toString());
|
||||
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public X509 detachedVerifyAndGetX509(int dataType, byte[] orgData, String sign) {
|
||||
|
||||
@@ -852,6 +1041,90 @@ public class SydApi4j implements SydApi {
|
||||
return detachedSign(DATA_ORIGIN, orgData, sCertDN);
|
||||
}
|
||||
|
||||
|
||||
public String SYD_RSA_DetachedSign_HA(
|
||||
int pFlag,
|
||||
byte[] orgData,
|
||||
String sCertDN
|
||||
) {
|
||||
return detachedSign(pFlag,DATA_ORIGIN, orgData, sCertDN);
|
||||
}
|
||||
|
||||
|
||||
public String detachedSign(int rFlag,int dataType, byte[] orgData, String sCertDN) {
|
||||
Proto8005 proto = new Proto8005();
|
||||
byte[] dn = new byte[256];
|
||||
byte[] s = null;
|
||||
try {
|
||||
sCertDN = DnUtil.verifyDn( sCertDN );
|
||||
s = sCertDN.getBytes("GBK");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
System.arraycopy(s, 0, dn, 0, s.length);
|
||||
|
||||
// 填充数据
|
||||
HashMap<String, Object> packet = new HashMap<String, Object>();
|
||||
HashMap<String, Object> data = new HashMap<String, Object>();
|
||||
packet.put("data", data);
|
||||
PacketSN sn = PacketSN.gen();
|
||||
packet.put("header", sn.getSn().array());
|
||||
if(rFlag ==1){//RSA证书加签方法
|
||||
data.put("rFlag", 'M');
|
||||
}
|
||||
if(rFlag ==2){
|
||||
data.put("rFlag", 'S');
|
||||
}
|
||||
if(rFlag ==3){
|
||||
data.put("rFlag", 'R');
|
||||
}
|
||||
data.put("DN", dn);
|
||||
if (dataType == DATA_HASH) {
|
||||
if(rFlag==1){
|
||||
data.put("hashFlag", 'M');
|
||||
}
|
||||
if(rFlag==2){
|
||||
data.put("hashFlag", 'S');
|
||||
}
|
||||
if(rFlag==3){
|
||||
data.put("hashFlag", 'R');
|
||||
}
|
||||
data.put("hash", orgData);
|
||||
} else {
|
||||
data.put("infoData", orgData);
|
||||
}
|
||||
|
||||
// 渲染发送
|
||||
ByteBuffer bb = proto.rend(packet);
|
||||
|
||||
synchronized (this) {
|
||||
// 响应解析
|
||||
bb = syncRead(syncSend(bb));
|
||||
}
|
||||
|
||||
|
||||
Packet p = proto.parse(bb);
|
||||
Map<String, Object> ret = p.toMap();
|
||||
|
||||
if (
|
||||
!Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
|
||||
) {
|
||||
throw new SydApiException("包序号不匹配", -4);
|
||||
}
|
||||
ret = (Map<String, Object>) ret.get("data");
|
||||
PacketSection error = (PacketSection) ret.get("error");
|
||||
byte[] be = error.getBytes();
|
||||
if (
|
||||
(0 != (be[0] ^ be[1]))) {
|
||||
|
||||
throw new SydApiException(error.getInfo(), error.autoInt());
|
||||
}
|
||||
|
||||
return ((PacketSection) ret.get("signature")).getString();
|
||||
|
||||
}
|
||||
|
||||
// 测试通过
|
||||
@Override
|
||||
public boolean SYD_SM2_DetachedVerify_HA(
|
||||
@@ -872,6 +1145,11 @@ public class SydApi4j implements SydApi {
|
||||
return SYD_SM2_DetachedSign_HA(orgData, sCertDN);
|
||||
}
|
||||
|
||||
@Override
|
||||
public String SYD_DetachedSign(int rFlag,byte[] orgData, String sCertDN) {
|
||||
return SYD_RSA_DetachedSign_HA(rFlag,orgData, sCertDN);
|
||||
}
|
||||
|
||||
@Override
|
||||
public X509 SYD_Get_X509_CertInfo_HA(
|
||||
byte[] orgData,
|
||||
@@ -994,6 +1272,7 @@ public class SydApi4j implements SydApi {
|
||||
}
|
||||
|
||||
r.put("certDNs", certs.toArray(new String[0]));
|
||||
// r.put("certDNlist", certs);
|
||||
|
||||
return r;
|
||||
}
|
||||
@@ -2423,6 +2702,15 @@ public class SydApi4j implements SydApi {
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public RetWrap generateDEByDn(int alg,String certSerial, byte[] oData) {
|
||||
if ( oData.length <= 4 * 1024 ) {
|
||||
return generateDEByDnHsmRSA(alg, certSerial, oData );
|
||||
} else {
|
||||
return generateDEByDnSoftRSA( alg,certSerial, oData );
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
public RetWrap generateDEByDnHsm(String certSerial, byte[] oData) {
|
||||
|
||||
@@ -2437,6 +2725,19 @@ public class SydApi4j implements SydApi {
|
||||
return generateDE(dnBytes, 3, 1, oData);
|
||||
}
|
||||
|
||||
public RetWrap generateDEByDnHsmRSA(int alg,String certSerial, byte[] oData) {
|
||||
|
||||
certSerial = DnUtil.verifyDn( certSerial );
|
||||
|
||||
byte[] dnBytes = null;
|
||||
try {
|
||||
dnBytes = certSerial.getBytes("gbk");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return generateDE(dnBytes, 0, 1, oData);
|
||||
}
|
||||
|
||||
@Override
|
||||
public RetWrap generateDE(byte[] certSerial, int alg, int model, byte[] oData) {
|
||||
Proto6A proto = new Proto6A();
|
||||
@@ -2454,7 +2755,7 @@ public class SydApi4j implements SydApi {
|
||||
data.put("certificateDn", certSerial);
|
||||
}
|
||||
|
||||
if (alg == 3) {
|
||||
if (alg == 3 || alg == 0 ) {
|
||||
data.put("orgData", oData);
|
||||
}
|
||||
|
||||
@@ -2562,6 +2863,19 @@ public class SydApi4j implements SydApi {
|
||||
return decryptDE(true, 1, dnBytes, pCipherKey);
|
||||
}
|
||||
|
||||
public RetWrap decryptDEByDNHsmRSA(String certSerial, String pCipherKey) {
|
||||
|
||||
certSerial = DnUtil.verifyDn( certSerial );
|
||||
|
||||
byte[] dnBytes = null;
|
||||
try {
|
||||
dnBytes = certSerial.getBytes("gbk");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return decryptDERSA(true, 1, dnBytes, pCipherKey);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* 通过 DN 查找证书
|
||||
@@ -2629,7 +2943,7 @@ public class SydApi4j implements SydApi {
|
||||
byte[] len = new byte[2];
|
||||
bb.get(len);
|
||||
|
||||
int l = len[0] * 256 + len[1];
|
||||
int l = Util.b2i(len); // len[0] * 256 + len[1];
|
||||
byte[] cert = new byte[l];
|
||||
bb.get(cert);
|
||||
|
||||
@@ -2706,6 +3020,70 @@ public class SydApi4j implements SydApi {
|
||||
}
|
||||
}
|
||||
|
||||
public RetWrap generateDEByDnSoftRSA(int alg,String certSerial, byte[] oData) {
|
||||
|
||||
certSerial = DnUtil.verifyDn( certSerial );
|
||||
|
||||
RetWrap ret = new RetWrap();
|
||||
byte[] dnBytes = null;
|
||||
try {
|
||||
dnBytes = certSerial.getBytes("gbk");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
// 查询完整证书
|
||||
String cert = getCertByDn(dnBytes);
|
||||
println("cert=" + cert);
|
||||
|
||||
try {
|
||||
X509Certificate x509 = getX509Certificate(new ByteArrayInputStream(cert.getBytes()));
|
||||
X500Principal issuser = x509.getIssuerX500Principal();
|
||||
|
||||
String pk = ByteUtils.toHexString(x509.getPublicKey().getEncoded());
|
||||
if (!pk.startsWith("03420004")) {
|
||||
int i = pk.indexOf("03420004");
|
||||
if ( i >= 0 ) {
|
||||
pk = pk.substring(i);
|
||||
} else {
|
||||
pk = "03420004" + pk;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// 生成会话密钥
|
||||
ret = RSAGenSessionKey(pk);
|
||||
String ciperKey = ret.get(SydApi.RET_CIPHER_KEY).toString();
|
||||
String sessionKeyByLMK = (String) ret.get(SydApi.RET_SESSION_KEY );
|
||||
ret.put(SydApi.RET_SESSION_KEY , sessionKeyByLMK.getBytes() );
|
||||
|
||||
println("ciperKey=" + ciperKey);
|
||||
println("sessionKeyByLMK=" + sessionKeyByLMK);
|
||||
|
||||
// 加密数据
|
||||
byte[] iv = new byte[32];
|
||||
Arrays.fill(iv, (byte) 0x30);
|
||||
RetWrap retWrap = SYMEnDeData(true, 2, sessionKeyByLMK, 1, 1, oData, iv, 0);
|
||||
byte[] enData = (byte[]) retWrap.get("msg_all");
|
||||
|
||||
// 组织格式
|
||||
ContentInfo cms = genCMSEnvelopedData( Util.hexString2Bytes(ciperKey), enData,
|
||||
x509.getSerialNumber().toString(16) ,
|
||||
dnToMap(issuser.getName() )
|
||||
);
|
||||
|
||||
ret.put(SydApi.RET_CIPHER_KEY, Util.encodeBase64(cms.getEncoded()).getBytes() );
|
||||
|
||||
return ret;
|
||||
|
||||
} catch (SydApiException syde) {
|
||||
throw syde;
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
throw new SydApiException("生成数字信封错误", -5);
|
||||
}
|
||||
}
|
||||
|
||||
private static Map<String, String>dnToMap(String dn) {
|
||||
Map<String, String>map = new HashMap<String, String>();
|
||||
String[] kvs = dn.split(",");
|
||||
@@ -2787,6 +3165,15 @@ public class SydApi4j implements SydApi {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
public RetWrap decryptDEByDN(int alg,String certSerial, byte[] pCipherKey){
|
||||
if ( pCipherKey.length <= 4 * 1024 ) {
|
||||
return decryptDEByDNHsmRSA( certSerial, new String(pCipherKey) );
|
||||
} else {
|
||||
return decryptDEByDNSoftRSA( certSerial, new String(pCipherKey) );
|
||||
}
|
||||
}
|
||||
|
||||
public RetWrap decryptDEByDNSoft(String certSerial, String pCipherKey) {
|
||||
|
||||
certSerial = DnUtil.verifyDn( certSerial );
|
||||
@@ -2826,6 +3213,46 @@ public class SydApi4j implements SydApi {
|
||||
return ret;
|
||||
}
|
||||
|
||||
public RetWrap decryptDEByDNSoftRSA(String certSerial, String pCipherKey) {
|
||||
|
||||
certSerial = DnUtil.verifyDn( certSerial );
|
||||
|
||||
byte[] dnBytes = null;
|
||||
try {
|
||||
dnBytes = certSerial.getBytes("gbk");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
RetWrap ret = null;
|
||||
|
||||
try {
|
||||
ret = deCMSEnvelopedData( Util.decodeBase64( pCipherKey ) );
|
||||
} catch ( Exception e) {
|
||||
throw new IllegalArgumentException("数字信封解封格式错误");
|
||||
}
|
||||
|
||||
byte[] sessionKeyDer = (byte[]) ret.get("sessionKeyDer");
|
||||
byte[] enData = (byte[]) ret.get("enData");
|
||||
|
||||
// 解密原文
|
||||
byte[] iv = (byte[]) ret.get("iv"); //new byte[32];
|
||||
// Arrays.fill(iv, (byte) 0x30);
|
||||
iv = Util.bytes2HexString( iv ).getBytes();
|
||||
|
||||
// 解密会话密钥
|
||||
ret = decryptDERSA(true, 1, dnBytes, Util.encodeBase64(sessionKeyDer) );
|
||||
String sessionKey = new String((byte[]) ret.get("SessionKey") );
|
||||
|
||||
RetWrap retWrap = SYMEnDeData(false, 2, sessionKey, 1, 1, enData, iv, 0);
|
||||
byte[] data = (byte[]) retWrap.get("msg_all");
|
||||
|
||||
ret.put("oData", data);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
|
||||
// 测试通过
|
||||
@Override
|
||||
@@ -2894,6 +3321,74 @@ public class SydApi4j implements SydApi {
|
||||
return rw;
|
||||
}
|
||||
|
||||
// 测试通过
|
||||
@Override
|
||||
public RetWrap decryptDERSA(boolean pFlag, int model, byte[] certSerial, String pCipherKey) {
|
||||
// 获取协议
|
||||
//ProtocolRender render = pset.getProtocolReqRender("6B");
|
||||
// 与6B相同
|
||||
Proto6BXF proto = new Proto6BXF();
|
||||
// 填充数据
|
||||
PacketSN sn = PacketSN.gen();
|
||||
HashMap<String, Object> packet = new HashMap<String, Object>();
|
||||
packet.put("header", sn.getSn().array());
|
||||
HashMap<String, Object> data = new HashMap<String, Object>();
|
||||
if (pFlag) {
|
||||
data.put("pFlag", "R");
|
||||
}
|
||||
data.put("certificateModel$option", model);
|
||||
|
||||
if (model == 0) {
|
||||
data.put("certificateSn", certSerial);
|
||||
} else {
|
||||
data.put("certificateDn", certSerial);
|
||||
}
|
||||
data.put("key", pCipherKey);
|
||||
data.put("keyType", "X");
|
||||
packet.put("data", data);
|
||||
|
||||
// 渲染发送
|
||||
ByteBuffer bb = proto.rend(packet);
|
||||
synchronized (this) {
|
||||
// 响应解析
|
||||
bb = syncRead(syncSend(bb));
|
||||
}
|
||||
|
||||
//ProtocolParser parser = pset.getProtocolResParse();
|
||||
Packet p = proto.parse(bb);
|
||||
|
||||
Map<String, Object> ret = p.toMap();
|
||||
if (
|
||||
!Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
|
||||
) {
|
||||
throw new SydApiException("包序号不匹配", -4);
|
||||
}
|
||||
ret = (Map<String, Object>) ret.get("data");
|
||||
PacketSection error = (PacketSection) ret.get("error");
|
||||
if (!"00".equals(error.getString())) {
|
||||
throw new SydApiException(error.getInfo(), error.autoInt());
|
||||
}
|
||||
RetWrap rw = new RetWrap();
|
||||
|
||||
if (pFlag) {
|
||||
rw.put("oData", ((PacketSection) ret.get("oData")).getBytes());
|
||||
}
|
||||
|
||||
int orgCodeLen = Util.a2i(((PacketSection) ret.get("orgCodeLen")).getBytes(), 10);
|
||||
if (orgCodeLen != 0) {
|
||||
rw.put("orgCode", ((PacketSection) ret.get("orgCode")).getBytes());
|
||||
}
|
||||
|
||||
rw.put(SydApi.RET_SESSION_KEY, (((PacketSection) ret.get("lmkHead")).getString() +
|
||||
((PacketSection) ret.get("lmk")).getString()).getBytes()
|
||||
);
|
||||
|
||||
rw.put(SydApi.RET_KCV, ((PacketSection) ret.get("keyCheck")).getBytes());
|
||||
|
||||
return rw;
|
||||
}
|
||||
|
||||
|
||||
// 测试通过
|
||||
@Override
|
||||
public String GenerateRandom(int nRandomSize) {
|
||||
@@ -5443,6 +5938,57 @@ public class SydApi4j implements SydApi {
|
||||
return rw;
|
||||
}
|
||||
|
||||
@Override
|
||||
public RetWrap RSAGenSessionKey(String publicKey) {
|
||||
// 获取协议
|
||||
//ProtocolRender render = pset.getProtocolReqRender("72");
|
||||
Proto72 proto = new Proto72();
|
||||
// 填充数据
|
||||
PacketSN sn = PacketSN.gen();
|
||||
HashMap<String, Object> packet = new HashMap<String, Object>();
|
||||
packet.put("header", sn.getSn().array());
|
||||
HashMap<String, Object> data = new HashMap<String, Object>();
|
||||
data.put("pFlag", "R");
|
||||
data.put("publicKey", Util.hexString2Bytes(publicKey));
|
||||
data.put("lmk", "L");
|
||||
packet.put("data", data);
|
||||
|
||||
// 渲染发送 耗时长
|
||||
ByteBuffer bb = proto.rend(packet);
|
||||
synchronized (this) {
|
||||
|
||||
// 响应解析
|
||||
bb = syncRead(syncSend(bb));
|
||||
}
|
||||
|
||||
//ProtocolParser parser = pset.getProtocolResParse();
|
||||
Packet p = proto.parse(bb);
|
||||
|
||||
Map<String, Object> ret = p.toMap();
|
||||
if (
|
||||
!Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
|
||||
) {
|
||||
throw new SydApiException("包序号不匹配", -4);
|
||||
}
|
||||
ret = (Map<String, Object>) ret.get("data");
|
||||
PacketSection error = (PacketSection) ret.get("error");
|
||||
if (!"00".equals(error.getString())) {
|
||||
throw new SydApiException(error.getInfo(), error.autoInt());
|
||||
}
|
||||
RetWrap rw = new RetWrap();
|
||||
rw.put(SydApi.RET_CIPHER_KEY,
|
||||
Util.bytes2HexString( ((PacketSection) ret.get("key")).getBytes() )
|
||||
);
|
||||
|
||||
rw.put(SydApi.RET_SESSION_KEY, (((PacketSection) ret.get("lmkHead")).getString() +
|
||||
((PacketSection) ret.get("lmk")).getString())
|
||||
);
|
||||
|
||||
rw.put(SydApi.RET_KCV, ((PacketSection) ret.get("keyCheck")).getString());
|
||||
|
||||
return rw;
|
||||
}
|
||||
|
||||
/**
|
||||
* 生成数字信封
|
||||
*
|
||||
@@ -8330,12 +8876,12 @@ public class SydApi4j implements SydApi {
|
||||
* @param hashType HASH类型。0: SHA1,1: SHA256,2: MD5
|
||||
* @param packSn 消息块号。0=仅一块,1=第一块,2=中间块,3=最后块
|
||||
* @param msg 二进制的消息块
|
||||
* @param filterData 过渡消息数据,只对“消息块号”为 2、3 时有效
|
||||
* @param filterData 过渡消息数据,只对“消息块号”为 2、1 时有效
|
||||
* @return filterData: 过渡消息数据.只对“消息块号”为 2、1 时有效
|
||||
* hash: hash
|
||||
*/
|
||||
// 测试通过
|
||||
public RetWrap conutHash(int hashType, int packSn, byte[] msg, byte[] filterData) {
|
||||
public RetWrap countHash(int hashType, int packSn, byte[] msg, byte[] filterData) {
|
||||
Proto7D proto = new Proto7D();
|
||||
HashMap<String, Object> packet = new HashMap();
|
||||
HashMap<String, Object> data = new HashMap();
|
||||
@@ -10756,6 +11302,22 @@ public class SydApi4j implements SydApi {
|
||||
return this.detachedVerify( 0, hash , sign2);
|
||||
}
|
||||
|
||||
private boolean attachedVerifyRSA(int rFlag,String sign){
|
||||
RetWrap ret = null;
|
||||
try {
|
||||
ret = ASN1Util.takeOutOriginDataFromPKCS7Sign( sign );
|
||||
} catch (IOException e) {
|
||||
e.printStackTrace();
|
||||
throw new IllegalArgumentException("解析 pkcs7 签名格式时错误");
|
||||
}
|
||||
|
||||
byte[] orgData = (byte[]) ret.get("orgData");
|
||||
// byte[] pk = (byte[]) ret.get("pk");
|
||||
// byte[] hash = this.SM3Hash( Util.bytes2HexString( pk ), orgData );
|
||||
String sign2 = (String) ret.get("sign");
|
||||
return this.detachedVerify( rFlag,0, orgData , sign2);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* 带公钥证书与原始数据的数字签名（遵循 PKCS#7）
|
||||
@@ -10778,6 +11340,95 @@ public class SydApi4j implements SydApi {
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public String attachedSign(int rFlag,byte[] orgData, String sCertDN) {
|
||||
//return attachedSignRSA( rFlag, orgData, sCertDN );
|
||||
try {
|
||||
if ( orgData.length > 4096 ) {
|
||||
return attachedSignRSASoft( rFlag,orgData, sCertDN );
|
||||
} else {
|
||||
return attachedSignRSAHsm( rFlag,orgData, sCertDN );
|
||||
}
|
||||
}catch (UnsupportedEncodingException e) {
|
||||
throw new IllegalArgumentException("DN is not in GBK");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
public String attachedSignRSASoft(int rFlag,byte[] orgData, String sCertDN) throws UnsupportedEncodingException {
|
||||
sCertDN = DnUtil.verifyDn( sCertDN );
|
||||
String pk = this.GetDNPublicKey( SydApi.FOR_SIGN, sCertDN.getBytes("GBK") );
|
||||
try {
|
||||
byte[] hash = this.SM3Hash( pk, orgData );
|
||||
String sign = this.detachedSign(rFlag,0, hash, sCertDN);
|
||||
return ASN1Util.addOriginDataToPKCS7Sign( orgData, sign );
|
||||
} catch (IOException e) {
|
||||
e.printStackTrace();
|
||||
throw new IllegalArgumentException("解析 pkcs7 签名格式时错误");
|
||||
}
|
||||
}
|
||||
|
||||
public String attachedSignRSAHsm(int rFlag,byte[] orgData, String sCertDN) {
|
||||
sCertDN = DnUtil.verifyDn( sCertDN );
|
||||
|
||||
Proto8018 proto = new Proto8018();
|
||||
byte[] dn = new byte[256];
|
||||
byte[] s = null;
|
||||
try {
|
||||
s = sCertDN.getBytes("GBK");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
System.arraycopy(s, 0, dn, 0, s.length);
|
||||
|
||||
// 填充数据
|
||||
HashMap<String, Object> packet = new HashMap<String, Object>();
|
||||
HashMap<String, Object> data = new HashMap<String, Object>();
|
||||
packet.put("data", data);
|
||||
PacketSN sn = PacketSN.gen();
|
||||
packet.put("header", sn.getSn().array());
|
||||
if(rFlag ==1){
|
||||
data.put("rFlag", 'M');
|
||||
}
|
||||
if(rFlag ==2){
|
||||
data.put("rFlag", 'S');
|
||||
}
|
||||
if(rFlag ==3){
|
||||
data.put("rFlag", 'R');
|
||||
}
|
||||
data.put("DN", dn);
|
||||
data.put("infoData", orgData);
|
||||
|
||||
// 渲染发送
|
||||
ByteBuffer bb = proto.rend(packet);
|
||||
|
||||
synchronized (this) {
|
||||
// 响应解析
|
||||
bb = syncRead(syncSend(bb));
|
||||
}
|
||||
|
||||
Packet p = proto.parse(bb);
|
||||
Map<String, Object> ret = p.toMap();
|
||||
|
||||
if (
|
||||
!Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
|
||||
) {
|
||||
throw new SydApiException("包序号不匹配", -4);
|
||||
}
|
||||
ret = (Map<String, Object>) ret.get("data");
|
||||
PacketSection error = (PacketSection) ret.get("error");
|
||||
byte[] be = error.getBytes();
|
||||
if ((0 != (be[0] ^ be[1]))) {
|
||||
|
||||
throw new SydApiException(error.getInfo(), error.autoInt());
|
||||
}
|
||||
|
||||
return ((PacketSection) ret.get("signature")).getString();
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
public String attachedSignHsm(byte[] orgData, String sCertDN) {
|
||||
sCertDN = DnUtil.verifyDn( sCertDN );
|
||||
@@ -10842,6 +11493,16 @@ public class SydApi4j implements SydApi {
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean attachedVerify(int rFlag,String sign) {
|
||||
|
||||
if ( sign.length() > 4096 ) {
|
||||
return attachedVerifyRSA( rFlag,sign );
|
||||
} else {
|
||||
return attachedVerify( sign.getBytes() );
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean attachedVerify(byte[] sign) {
|
||||
Proto8019 proto = new Proto8019();
|
||||
|
||||
@@ -0,0 +1,73 @@
|
||||
package com.sunyard.sydapi.test;
|
||||
|
||||
import com.sunyard.RetWrap;
|
||||
import com.sunyard.proto.Util;
|
||||
import com.sunyard.util.ASN1Util;
|
||||
import racal.sunyard.main.SydApi4j;
|
||||
import racal.sunyard.main.SydApiBuilder;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.io.UnsupportedEncodingException;
|
||||
|
||||
public class RSASignVertify {
|
||||
private static final String RSADN = "C=cn,O=CFCA TEST CA,OU=CIPSTEST,OU=Units,CN=041@3CIPSCNSHCLR@CN000000129@00000018";
|
||||
private static final byte[] orgData={1,2,3,4,5,6};
|
||||
private static final String SM2DN = "C=CN,O=123,OU=23,OU=23,CN=32";
|
||||
|
||||
// public p1
|
||||
// p7attach
|
||||
// p7detach
|
||||
public static void main(String[] args) throws IOException {
|
||||
//System.setProperty("com.sunyard.sydapi4j.debug", "true");
|
||||
//long startTime = System.currentTimeMillis(); //设置系统时间
|
||||
SydApiBuilder builder = new SydApiBuilder().setIp("172.16.18.59");
|
||||
SydApi4j api = (SydApi4j) builder.build();
|
||||
|
||||
|
||||
//
|
||||
// byte[] nakedSign = api.SYD_NakedSign(1,orgData,RSADN);
|
||||
// System.out.println("nakedSign"+nakedSign);
|
||||
// byte[] sm2Sign = api.SYD_NakedSign(orgData,SM2DN);
|
||||
// System.out.println("sm2Sign:"+sm2Sign);
|
||||
//
|
||||
// boolean nakedVerify = api.SYD_NakedVerify(1, orgData, nakedSign, RSADN);
|
||||
// System.out.println(nakedVerify);
|
||||
// boolean nakedVerify2 = api.SYD_NakedVerify( orgData, sm2Sign, SM2DN);
|
||||
// System.out.println(nakedVerify2);
|
||||
|
||||
// String attachedSign = api.attachedSign(orgData, SM2DN);
|
||||
// //System.out.println(attachedSign);
|
||||
// boolean attachedVerify = api.attachedVerify(attachedSign);
|
||||
// System.out.println(attachedVerify);
|
||||
//
|
||||
// String attachedSign2 = api.attachedSign(1,orgData, RSADN);
|
||||
// String attachedSign3 = api.attachedSign(2,orgData, RSADN);
|
||||
// String attachedSign4 = api.attachedSign(3,orgData, RSADN);
|
||||
// System.out.println("签名1："+attachedSign2);
|
||||
// System.out.println("签名2："+attachedSign3);
|
||||
// System.out.println("签名3："+attachedSign4);
|
||||
// boolean attachedVerify2 = api.attachedVerify(attachedSign2);
|
||||
// RetWrap retWrap = ASN1Util.takeOutOriginDataFromPKCS7Sign(attachedSign2);
|
||||
// System.out.println(attachedVerify2);
|
||||
// byte[] orgData = (byte[]) retWrap.get("orgData");
|
||||
// String cert = (String) retWrap.get("cert");
|
||||
// System.out.println(Util.bytes2HexString(orgData));
|
||||
// System.out.println(Util.bytes2HexString(Util.decodeBase64(cert)));
|
||||
// System.out.println("证书："+Util.bytes2HexString(Util.encodeBase64(RSADN.getBytes("GBK")).getBytes("GBK")));
|
||||
|
||||
String detachedSign = api.detachedSign(1, orgData, SM2DN);
|
||||
System.out.println(detachedSign);
|
||||
String detachedSign2 = api.detachedSign(1,0, orgData, RSADN);
|
||||
System.out.println(detachedSign2);
|
||||
boolean detachedVerify = api.detachedVerify(1, orgData, detachedSign);
|
||||
boolean detachedVerify2 = api.detachedVerify(1,0, orgData, detachedSign2);
|
||||
System.out.println(detachedVerify);
|
||||
System.out.println(detachedVerify2);
|
||||
|
||||
// String RSAsign = api.attachedSign(1, orgData.getBytes("GBK"), RSADN);
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -537,7 +537,7 @@ public class TestLast {
|
||||
RetWrap retWrap1 = api.conutHash(1,0, key2.getBytes(), key1.getBytes());
|
||||
byte[] bytes = api.RSASignC("0000000000000005", 1, 0,(byte[]) retWrap1.get("hash"));
|
||||
System.out.println(bytes);
|
||||
}*/
|
||||
}
|
||||
|
||||
|
||||
/* //15.6 RSA验证签名(+)
|
||||
@@ -560,7 +560,7 @@ public class TestLast {
|
||||
//15.7计算HASH散列值(MD5\SHA1\SHA256)(+) -> pass
|
||||
@Test
|
||||
public void RSASignC() {
|
||||
RetWrap retWrap1 = api.conutHash(1, 0, key2.getBytes(), key1.getBytes());
|
||||
RetWrap retWrap1 = api.countHash(1, 0, key2.getBytes(), key1.getBytes());
|
||||
System.out.println(retWrap1);
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,85 @@
|
||||
package sample;
|
||||
|
||||
import cn.hutool.crypto.asymmetric.SM2;
|
||||
import com.sunyard.RetWrap;
|
||||
import com.sunyard.cert.X509;
|
||||
import com.sunyard.proto.Util;
|
||||
import com.sunyard.util.ASN1Util;
|
||||
import com.sunyard.util.CertUtil;
|
||||
import org.junit.Test;
|
||||
import racal.sunyard.main.SydApi4j;
|
||||
import racal.sunyard.main.SydApiBuilder;
|
||||
|
||||
import java.io.UnsupportedEncodingException;
|
||||
import java.security.NoSuchProviderException;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
|
||||
import static com.sunyard.sydapi.util.PrintUtil.printRetWrap;
|
||||
|
||||
public class Shanghairenhang {
|
||||
private static final byte[] orgData2k = new byte[ 16 ];
|
||||
private static final String pcDnEN = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
|
||||
private static final String RSA = "C=cn,O=CFCA TEST CA,OU=NCS2,OU=Enterprises,CN=041@Z402451000010@ShanDong@00000001";
|
||||
|
||||
public static void main(String[] args) throws UnsupportedEncodingException, CertificateException, NoSuchProviderException {
|
||||
System.setProperty("com.sunyard.sydapi4j.debug", "true");
|
||||
long startTime = System.currentTimeMillis(); //获取开始时间
|
||||
SydApiBuilder builder = new SydApiBuilder().setIp("192.168.0.200");
|
||||
SydApi4j api = (SydApi4j) builder.build();
|
||||
|
||||
try {
|
||||
String orgData = "123456";
|
||||
|
||||
|
||||
/**
|
||||
* 产生对称密钥，通过公钥加密生成数字信封，。
|
||||
* @param pcDnEN: 清算所的公钥证书
|
||||
* @param pcData: 明文数据。
|
||||
* @return RetWrap: 数字信封
|
||||
*/
|
||||
RetWrap signData = api.generateDEByDn(0,RSA, orgData.getBytes());
|
||||
byte[] cpkey2 = (byte[]) signData.get("CipherKey");
|
||||
System.out.println("加密信封：" + new String(cpkey2));
|
||||
|
||||
/**
|
||||
* 接收用私钥解密数字信封，还原原文。。
|
||||
* @param pcDnEN: 清算所的公钥证书
|
||||
* @param cpkey: 数字信封。
|
||||
* @return preData: 原数据
|
||||
*/
|
||||
RetWrap oDataWrap = api.decryptDEByDN(0,RSA, cpkey2);
|
||||
byte[] preData = (byte[]) oDataWrap.get("oData");
|
||||
System.out.println("解密信封：" + Util.bytes2HexString(preData));
|
||||
|
||||
//
|
||||
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
} finally {
|
||||
long endTime = System.currentTimeMillis(); //获取结束时间
|
||||
System.out.println("程序运行时间：" + (endTime - startTime) + "ms"); //输出程序运行时间
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
// String [] certDNs =(String []) allCert.get("certDNs");
|
||||
// System.out.println(certDNs);
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,85 +1,137 @@
|
||||
package sample;
|
||||
|
||||
import cn.hutool.crypto.asymmetric.SM2;
|
||||
import com.sunyard.RetWrap;
|
||||
import com.sunyard.cert.X509;
|
||||
import com.sunyard.proto.Util;
|
||||
import com.sunyard.util.ASN1Util;
|
||||
import com.sunyard.util.CertUtil;
|
||||
import org.junit.Test;
|
||||
import racal.sunyard.main.SydApi4j;
|
||||
import racal.sunyard.main.SydApiBuilder;
|
||||
|
||||
public class ShangqingXingye {
|
||||
private static final byte[] orgData2k = new byte[ 2 * 1024];
|
||||
private static final String pcDnEN = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
|
||||
import java.io.UnsupportedEncodingException;
|
||||
import java.security.NoSuchProviderException;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
|
||||
public static void main(String[] args) {
|
||||
import static com.sunyard.sydapi.util.PrintUtil.printRetWrap;
|
||||
|
||||
public class ShangqingXingye {
|
||||
private static final byte[] orgData2k = new byte[ 16 ];
|
||||
private static final String pcDnEN = "C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
|
||||
private static final String RSA = "C=cn,O=CFCA TEST CA,OU=NCS2,OU=Enterprises,CN=041@Z402451000010@ShanDong@00000001";
|
||||
|
||||
public static void main(String[] args) throws UnsupportedEncodingException, CertificateException, NoSuchProviderException {
|
||||
//System.setProperty("com.sunyard.sydapi4j.debug", "true");
|
||||
long startTime = System.currentTimeMillis(); //获取开始时间
|
||||
SydApiBuilder builder = new SydApiBuilder().setIp("192.168.0.100");
|
||||
SydApiBuilder builder = new SydApiBuilder().setIp("192.168.0.200");
|
||||
SydApi4j api = (SydApi4j) builder.build();
|
||||
|
||||
try {
|
||||
String orgData = "123456";
|
||||
// String signData = null;
|
||||
// String certByDn = api.getCertByDn(RSA);
|
||||
// System.out.println(certByDn);
|
||||
// boolean signedBySM2Cert = CertUtil.isSM2Cert(certByDn);
|
||||
// System.out.println(signedBySM2Cert);
|
||||
// signData= api.attachedSign(2,orgData.getBytes(),RSA);
|
||||
// System.out.println("加签"+signData);
|
||||
// RetWrap ret = ASN1Util.takeOutOriginDataFromPKCS7Sign(signData);
|
||||
// String cert =(String)ret.get("cert");
|
||||
//
|
||||
//
|
||||
// String cert_begin = "-----BEGIN CERTIFICATE-----\n";
|
||||
// String end_cert = "\n-----END CERTIFICATE-----";
|
||||
// String pemCert = cert_begin + cert + end_cert;
|
||||
// System.out.println(pemCert);
|
||||
// boolean signedBySM2Cert1 = CertUtil.isSM2Cert(pemCert);
|
||||
// System.out.println(signedBySM2Cert1);
|
||||
//
|
||||
// boolean signedBySM2Cert2 = CertUtil.isSignedBySM2Cert(signData);
|
||||
// System.out.println(signedBySM2Cert2);
|
||||
|
||||
/**
|
||||
* 产生对称密钥，通过公钥加密生成数字信封，。
|
||||
* @param pcDnEN: 清算所的公钥证书
|
||||
* @param pcData: 明文数据。
|
||||
* @return RetWrap: 数字信封
|
||||
*/
|
||||
RetWrap signData = api.generateDEByDn(pcDnEN, orgData2k);
|
||||
byte[] cpkey2 = (byte[]) signData.get("CipherKey");
|
||||
System.out.println("加密信封：" + new String(cpkey2));
|
||||
RetWrap retWrap = api.countHash(2,1, orgData.getBytes(),null);
|
||||
// byte[] hashData = (byte[]) retWrap.get("hash");
|
||||
byte[] filterData = (byte[]) retWrap.get("filterData");
|
||||
System.out.println("过渡数据："+Util.bytes2HexString(filterData));
|
||||
|
||||
/**
|
||||
* 接收用私钥解密数字信封，还原原文。。
|
||||
* @param pcDnEN: 清算所的公钥证书
|
||||
* @param cpkey: 数字信封。
|
||||
* @return preData: 原数据
|
||||
*/
|
||||
RetWrap oDataWrap = api.decryptDEByDN(pcDnEN, cpkey2);
|
||||
byte[] preData = (byte[]) oDataWrap.get("oData");
|
||||
System.out.println("解密信封：" + Util.bytes2HexString(preData));
|
||||
RetWrap retWrap2 = api.countHash(2,3, orgData.getBytes(),filterData);
|
||||
//byte[] filterData2 = (byte[]) retWrap2.get("filterData");
|
||||
byte[] finalhash = (byte[]) retWrap2.get("hash");
|
||||
//System.out.println("中间数据："+Util.bytes2HexString(filterData2));
|
||||
System.out.println("最终数据："+Util.bytes2HexString(finalhash));
|
||||
|
||||
|
||||
/**
|
||||
* 通过指定的私钥对指定的原始数据编制带公钥证书的数字签名（遵循PKCS#7），
|
||||
* @param orgData: 待签名的原始数据
|
||||
* @param pcDnEN: 签名者证书 DN
|
||||
* @return signsData: 签名数据
|
||||
*/
|
||||
String signsData = api.SYD_SM2_DetachedSign_HA(orgData2k, pcDnEN);
|
||||
System.out.println("签名数据：" + signsData);
|
||||
|
||||
/**
|
||||
* 利用清算所的公钥证书对签名数据进行验签。
|
||||
* @param dataType: 数据模式, 0:输入的数据为 HASH 后的数据, 1:输入的数据为原始数据库(本次传入1)
|
||||
* @param orgData: 待签名的原始数据
|
||||
* @param sign: 签名数据。
|
||||
*/
|
||||
boolean result = api.detachedVerify(1, orgData2k, signsData);
|
||||
System.out.println("验签结果：" + result);
|
||||
|
||||
|
||||
/**
|
||||
* 产生对称密钥，通过清算所公钥证书加密生成数字信封。
|
||||
* 利用会员的私钥证书对数据进行签名
|
||||
* 上清所 SYD_SignDzigitalEnvelope (String pcDnEN, String pcDnSign, byte[] pcData);
|
||||
* @param pcDnEN: 清算所的公钥证书
|
||||
* @param pcDnSign：会员的私钥证书
|
||||
* @param pcData: 明文数据。
|
||||
* @return pcSignData: 签名数字信封
|
||||
*/
|
||||
String pcSignData = api.SYD_SignDigitalEnvelope(pcDnEN, pcDnEN, orgData2k);
|
||||
System.out.println("签名数字信封：" + pcSignData);
|
||||
|
||||
/**
|
||||
* 利用清算所公钥证书对签名数据进行验签。接收用会员的私钥证书解密数字信封，还原原文。
|
||||
* 上清所 byte[] SYD_VerifyDigitalEnveloe(String pcDnDe, String pcDnVerify, String pcSignData );
|
||||
* @param pcDnDe: 会员的私钥证书
|
||||
* @param pcDnVerify: 清算所公钥证书
|
||||
* @param pcSignData: 签名数字信封数据。
|
||||
* @return pcData：原数据
|
||||
*/
|
||||
|
||||
byte[] oData = api.SYD_VerifyDigitalEnveloe(pcDnEN, pcDnEN, pcSignData);
|
||||
System.out.println("原数据：" + Util.bytes2HexString(oData));
|
||||
//
|
||||
// /**
|
||||
// * 产生对称密钥，通过公钥加密生成数字信封，。
|
||||
// * @param pcDnEN: 清算所的公钥证书
|
||||
// * @param pcData: 明文数据。
|
||||
// * @return RetWrap: 数字信封
|
||||
// */
|
||||
// RetWrap signData = api.generateDEByDn(pcDnEN, orgData2k);
|
||||
// byte[] cpkey2 = (byte[]) signData.get("CipherKey");
|
||||
// System.out.println("加密信封：" + new String(cpkey2));
|
||||
//
|
||||
// /**
|
||||
// * 接收用私钥解密数字信封，还原原文。。
|
||||
// * @param pcDnEN: 清算所的公钥证书
|
||||
// * @param cpkey: 数字信封。
|
||||
// * @return preData: 原数据
|
||||
// */
|
||||
// RetWrap oDataWrap = api.decryptDEByDN(pcDnEN, cpkey2);
|
||||
// byte[] preData = (byte[]) oDataWrap.get("oData");
|
||||
// System.out.println("解密信封：" + Util.bytes2HexString(preData));
|
||||
//
|
||||
////
|
||||
//// /**
|
||||
//// * 通过指定的私钥对指定的原始数据编制带公钥证书的数字签名（遵循PKCS#7），
|
||||
//// * @param orgData: 待签名的原始数据
|
||||
//// * @param pcDnEN: 签名者证书 DN
|
||||
//// * @return signsData: 签名数据
|
||||
//// */
|
||||
//// String signsData = api.SYD_SM2_DetachedSign_HA(orgData2k, pcDnEN);
|
||||
//// System.out.println("签名数据：" + signsData);
|
||||
////
|
||||
//// /**
|
||||
//// * 利用清算所的公钥证书对签名数据进行验签。
|
||||
//// * @param dataType: 数据模式, 0:输入的数据为 HASH 后的数据, 1:输入的数据为原始数据库(本次传入1)
|
||||
//// * @param orgData: 待签名的原始数据
|
||||
//// * @param sign: 签名数据。
|
||||
//// */
|
||||
//// boolean result = api.detachedVerify(1, orgData2k, signsData);
|
||||
//// System.out.println("验签结果：" + result);
|
||||
////
|
||||
//
|
||||
// /**
|
||||
// * 产生对称密钥，通过清算所公钥证书加密生成数字信封。
|
||||
// * 利用会员的私钥证书对数据进行签名
|
||||
// * 上清所 SYD_SignDzigitalEnvelope (String pcDnEN, String pcDnSign, byte[] pcData);
|
||||
// * @param pcDnEN: 清算所的公钥证书
|
||||
// * @param pcDnSign：会员的私钥证书
|
||||
// * @param pcData: 明文数据。
|
||||
// * @return pcSignData: 签名数字信封
|
||||
// */
|
||||
// String pcSignData = api.SYD_SignDigitalEnvelope(pcDnEN, pcDnEN, orgData2k);
|
||||
// System.out.println("签名数字信封：" + pcSignData);
|
||||
//
|
||||
// /**
|
||||
// * 利用清算所公钥证书对签名数据进行验签。接收用会员的私钥证书解密数字信封，还原原文。
|
||||
// * 上清所 byte[] SYD_VerifyDigitalEnveloe(String pcDnDe, String pcDnVerify, String pcSignData );
|
||||
// * @param pcDnDe: 会员的私钥证书
|
||||
// * @param pcDnVerify: 清算所公钥证书
|
||||
// * @param pcSignData: 签名数字信封数据。
|
||||
// * @return pcData：原数据
|
||||
// */
|
||||
//
|
||||
// byte[] oData = api.SYD_VerifyDigitalEnveloe(pcDnEN, pcDnEN, pcSignData);
|
||||
// System.out.println("原数据：" + Util.bytes2HexString(oData));
|
||||
|
||||
|
||||
} catch (Exception e) {
|
||||
@@ -89,5 +141,38 @@ public class ShangqingXingye {
|
||||
System.out.println("程序运行时间：" + (endTime - startTime) + "ms"); //输出程序运行时间
|
||||
}
|
||||
|
||||
|
||||
RetWrap allCert = api.getAllCert(0);
|
||||
printRetWrap(allCert);
|
||||
String[] certDNs =(String[]) allCert.get("certDNs");
|
||||
System.out.println(certDNs[1]);
|
||||
ArrayList<String> certlist = new ArrayList<String>();
|
||||
Collections.addAll(certlist, certDNs);
|
||||
System.out.println("1111"+certlist.get(2));
|
||||
|
||||
|
||||
String certByDn = api.getCertByDn(RSA);
|
||||
System.out.println(certByDn);
|
||||
X509 certInfo = api.GetX509CertInfo(certByDn);
|
||||
System.out.println(certInfo.getSubject());
|
||||
boolean sm2Cert = CertUtil.isSM2Cert(certByDn);
|
||||
System.out.println(sm2Cert);
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
// String [] certDNs =(String []) allCert.get("certDNs");
|
||||
// System.out.println(certDNs);
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user