使用RSA生成公钥和私钥

1.jdk keytool

可以用keytool工具直接生成，需要openssl工具Binaries - OpenSSLWiki设置到环境变量里

@echo offcd ../outputIF exist auth.jks del auth.jksIF exist auth.key del auth.keykeytool -genkeypair -alias xxxx_key -keyalg RSA -keypass xxxxxx -keystore auth.jks -storepass xxxxxx -dname CN=xxxkeytool -list -rfc --keystore auth.jks -storepass xxxxxx | openssl x509 -inform pem -pubkey > temp.key(@FOR /f "tokens=1* delims=:" %%a IN ('findstr /n "^" "temp.key"') DO @IF %%a leq 9 ECHO(%%b) > auth.keydel temp.keyecho Build OK!pause

 2.认证与鉴权使用

生成的authkey放到gateway下，生成的auth.jks放到auth认证服务下

网关结合鉴权，需要配置如下配置文件                

spring:    security:        oauth2:            resourceserver:                jwt:                    public-key-location: classpath:auth.key

认证服务配置Bean

    @Bean    public JWKSource jwkSource() throws Exception {        KeyStore keyStore = KeyStore.getInstance("JKS");        // 取得JKS文件        Resource resource = new ClassPathResource(DEFAULT_KEY_STORE_FILE);        if (!resource.exists()) {            resource = new FileSystemResource(DEFAULT_KEY_STORE_FILE);        }        try (InputStream inputStream = resource.getInputStream()) {            keyStore.load(inputStream, DEFAULT_KEY_STORE_PASSWORD.toCharArray());            RSAPublicKey publicKey = (RSAPublicKey) keyStore.getCertificate(DEFAULT_KEY_ALIAS).getPublicKey();            RSAPrivateKey privateKey = (RSAPrivateKey) keyStore.getKey(DEFAULT_KEY_ALIAS, DEFAULT_KEY_PASSWORD.toCharArray());            RSAKey rsaKey = new RSAKey.Builder(publicKey)                    .privateKey(privateKey)                    .keyStore(keyStore)                    .build();            JWKSet jwkSet = new JWKSet(rsaKey);            return new ImmutableJWKSet<>(jwkSet);        }    }

3.工程项目直接生成

接口AuthToolController

package xxx.authtool.controller;import xxx.authtool.util.RsaUtil;import org.springframework.beans.factory.annotation.Value;import org.springframework.web.bind.annotation.GetMapping;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RequestParam;import org.springframework.web.bind.annotation.RestController;import javax.servlet.http.HttpServletResponse;import java.io.File;import java.io.FileInputStream;import java.io.IOException;import java.io.InputStream;import java.io.OutputStream;import java.nio.file.Files;import java.security.KeyPair;import java.text.SimpleDateFormat;import java.util.ArrayList;import java.util.Date;import java.util.List;import java.util.zip.ZipEntry;import java.util.zip.ZipOutputStream;@RestController@RequestMapping("/generate")public class AuthToolController {    @Value("${file-path:}")    private String filePath;        @GetMapping("/downloadAuthKeyZip")    public void downloadAuthKeyZip(@RequestParam(required = false) Integer days, HttpServletResponse response) throws IOException {        String dirPath = mkdir();        // 创建一个临时zip文件，用于存放要下载的多个文件        File zipFile = new File(dirPath + "/" + "authKeys.zip");        // 获取需要下载的多个文件，并将它们添加到zip文件中        List filesToDownload = getFilesToDownload(dirPath, days);        addFilesToZip(filesToDownload, zipFile);        deleteFiles(filesToDownload);        //设置响应头信息        response.setContentType("application/zip");        response.setHeader("Content-Disposition", "attachment; filename=authKeys.zip");        // 将zip文件内容写入到HttpServletResponse输出流中，实现文件下载        try (InputStream inputStream = Files.newInputStream(zipFile.toPath());             OutputStream outputStream = response.getOutputStream()) {            byte[] buffer = new byte[4096];            int length;            while ((length = inputStream.read(buffer)) > 0) {                outputStream.write(buffer, 0, length);                outputStream.flush();            }        }    }        private void deleteFiles(List filesToDownload) {        for (File file : filesToDownload) {            file.delete();        }    }        private List getFilesToDownload(String dirPath, Integer days) {        // 获取需要下载的多个文件        List files = new ArrayList<>();        KeyPair keyPair = RsaUtil.genKeyPair();        File publicFile = RsaUtil.genPublicFile(keyPair, dirPath);        File privateFile = RsaUtil.genPrivateFile(keyPair, dirPath, days);        files.add(publicFile);        files.add(privateFile);        return files;    }        private void addFilesToZip(List filesToDownload, File zipFile) throws IOException {        // 将多个文件压缩到zip文件中        try (ZipOutputStream zipOutputStream = new ZipOutputStream(Files.newOutputStream(zipFile.toPath()))) {            for (File file : filesToDownload) {                zipOutputStream.putNextEntry(new ZipEntry(file.getName()));                try (FileInputStream inputStream = new FileInputStream(file)) {                    byte[] buf = new byte[1024];                    int len;                    while ((len = inputStream.read(buf)) > 0) {                        zipOutputStream.write(buf, 0, len);                    }                }                zipOutputStream.closeEntry();            }        }    }        private String mkdir() {        String dateString = getDateString();        // 文件夹路径        String dirPath = filePath + "/" + dateString;        File directory = new File(dirPath);        // 判断文件夹是否存在        if (!directory.exists()) {            // 创建文件夹及其父目录            directory.mkdirs();        }        return dirPath;    }        private String getDateString() {        Date currentDate = new Date();        SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy_MM_dd_HH_mm_ss");        return dateFormat.format(currentDate);    }}

RSAUtil

package xxx.authtool.util;import org.bouncycastle.cert.X509v3CertificateBuilder;import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;import org.bouncycastle.jce.provider.BouncyCastleProvider;import org.bouncycastle.openssl.jcajce.JcaPEMWriter;import org.bouncycastle.operator.ContentSigner;import org.bouncycastle.operator.OperatorCreationException;import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;import sun.security.x509.X500Name;import java.io.BufferedWriter;import java.io.File;import java.io.FileOutputStream;import java.io.FileWriter;import java.io.IOException;import java.io.StringWriter;import java.math.BigInteger;import java.security.KeyPair;import java.security.KeyPairGenerator;import java.security.KeyStore;import java.security.KeyStoreException;import java.security.NoSuchAlgorithmException;import java.security.PrivateKey;import java.security.PublicKey;import java.security.SecureRandom;import java.security.cert.Certificate;import java.security.cert.CertificateException;import java.util.Date;public final class RsaUtil {    public static final String DEFAULT_KEY_STORE_FILE = "auth.jks";    public static final String DEFAULT_KEY_FILE = "auth.key";    public static final String DEFAULT_KEY_STORE_PASSWORD = "xxxxxx";    public static final String DEFAULT_KEY_ALIAS = "xxxx";    public static final String DEFAULT_KEY_PASSWORD = "xxxxxx";        public static KeyPair genKeyPair() {        try {            // KeyPairGenerator类用于生成公钥和私钥对，基于RSA算法生成对象            KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");            // 初始化密钥对生成器，密钥大小为96-1024位            keyPairGen.initialize(2048, new SecureRandom());            // 生成一个密钥对，保存在keyPair中            return keyPairGen.generateKeyPair();        } catch (NoSuchAlgorithmException e) {            throw new RuntimeException(e);        }    }        public static File genPrivateFile(KeyPair keyPair, String dirPath, Integer days) {        File file = new File(dirPath + "/" + DEFAULT_KEY_STORE_FILE);        try (FileOutputStream fos = new FileOutputStream(file)) {            KeyStore keyStore = KeyStore.getInstance("JKS");            keyStore.load(null, DEFAULT_KEY_PASSWORD.toCharArray());            // 得到私钥            PrivateKey privateKey = keyPair.getPrivate();            // 为以下对象生成 2048 位RSA密钥对和自签名证书 (SHA256withRSA) (有效期为 90 天):            String dn = "CN=xxxx";            // 有效期默认为 90 天            int day = 90;            if (days != null) {                day = days;            }            X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(                    new X500Name(dn).asX500Principal(),                    BigInteger.valueOf(System.currentTimeMillis()),                    new Date(System.currentTimeMillis()),                    new Date(System.currentTimeMillis() + day * 24 * 60 * 60 * 1000L),                    new X500Name(dn).asX500Principal(),                    keyPair.getPublic());            ContentSigner signer =                    new JcaContentSignerBuilder("SHA256withRSA").setProvider(new BouncyCastleProvider()).build(keyPair.getPrivate());            Certificate cert = new JcaX509CertificateConverter().setProvider(new BouncyCastleProvider()).getCertificate(builder.build(signer));            keyStore.setKeyEntry(DEFAULT_KEY_ALIAS, privateKey, DEFAULT_KEY_PASSWORD.toCharArray(), new Certificate[]{cert});            keyStore.store(fos, DEFAULT_KEY_STORE_PASSWORD.toCharArray());            return file;        } catch (KeyStoreException | IOException | CertificateException | NoSuchAlgorithmException |                 OperatorCreationException e) {            throw new RuntimeException(e);        }    }        public static File genPublicFile(KeyPair keyPair, String dirPath) {        try (StringWriter sw = new StringWriter()) {            // 得到公钥            PublicKey publicKey = keyPair.getPublic();            // 获取PublicKey并将其转换为PEM格式的字符串            try (JcaPEMWriter pemWriter = new JcaPEMWriter(sw)) {                pemWriter.writeObject(publicKey);            } catch (IOException e) {                throw new RuntimeException(e);            }            File file = new File(dirPath + "/" + DEFAULT_KEY_FILE);            try (FileWriter fw = new FileWriter(file.getAbsoluteFile(), true);                 BufferedWriter bw = new BufferedWriter(fw)            ) {                bw.write(sw.toString());            } catch (IOException e) {                throw new RuntimeException(e);            }            return file;        } catch (IOException e) {            throw new RuntimeException(e);        }    }}

依赖

implementation 'org.bouncycastle:bcprov-jdk15on:1.69'implementation 'org.bouncycastle:bcpkix-jdk15on:1.69'

访问localhost:6080/generate/downloadAuthKeyZip可获取90天许可的证书

4.RSA工具类

package xxx.socket.stomp.config;import java.nio.charset.StandardCharsets;import java.security.InvalidKeyException;import java.security.KeyFactory;import java.security.KeyPair;import java.security.KeyPairGenerator;import java.security.NoSuchAlgorithmException;import java.security.PrivateKey;import java.security.PublicKey;import java.security.SecureRandom;import java.security.spec.EncodedKeySpec;import java.security.spec.InvalidKeySpecException;import java.security.spec.PKCS8EncodedKeySpec;import java.security.spec.X509EncodedKeySpec;import java.util.Base64;import javax.crypto.BadPaddingException;import javax.crypto.Cipher;import javax.crypto.IllegalBlockSizeException;import javax.crypto.NoSuchPaddingException;import org.springframework.util.Assert;public class RsaUtils {    private static String publicKeyStr = "";    private static String privateKeyStr = "";    public static void main(String[] args) {        genKeyPair();        String password = "xxxx";        String rawPassword = encrypt(password);        String password2 = decrypt(rawPassword);        Assert.isTrue(password.equals(password2), "Error");    }    public static String encrypt(String password) {        try {            KeyFactory keyFactory = KeyFactory.getInstance("RSA");            EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(publicKeyStr));            PublicKey publicKey = keyFactory.generatePublic(publicKeySpec);            Cipher cipher = Cipher.getInstance("RSA");            cipher.init(Cipher.ENCRYPT_MODE, publicKey);            byte[] passwordBytes = cipher.doFinal(password.getBytes(StandardCharsets.UTF_8));            String result = new String(Base64.getEncoder().encode(passwordBytes), StandardCharsets.UTF_8);            System.out.println("Encrypt Password: " + result);            return result;        } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {            System.out.println("Algorithm Error\n" + e);        } catch (NoSuchPaddingException | InvalidKeyException e) {            System.out.println("Cipher Error\n" + e);        } catch (IllegalBlockSizeException | BadPaddingException e) {            System.out.println("Password Error\n" + e);        }        return null;    }    public static String decrypt(String password) {        try {            KeyFactory keyFactory = KeyFactory.getInstance("RSA");            EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(Base64.getDecoder().decode(privateKeyStr));            PrivateKey privateKey = keyFactory.generatePrivate(privateKeySpec);            Cipher cipher = Cipher.getInstance("RSA");            cipher.init(Cipher.DECRYPT_MODE, privateKey);            byte[] passwordBytes = cipher.doFinal(Base64.getDecoder().decode(password.getBytes(StandardCharsets.UTF_8)));            String result = new String(passwordBytes, StandardCharsets.UTF_8);            System.out.println("Decrypt Password: " + result);            return result;        } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {            System.out.println("Algorithm Error\n" + e);        } catch (NoSuchPaddingException | InvalidKeyException e) {            System.out.println("Cipher Error\n" + e);        } catch (IllegalBlockSizeException | BadPaddingException e) {            System.out.println("Password Error\n" + e);        }        return null;    }        public static void genKeyPair() {        try {            // KeyPairGenerator类用于生成公钥和私钥对，基于RSA算法生成对象            KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");            // 初始化密钥对生成器，密钥大小为96-1024位            keyPairGen.initialize(2048, new SecureRandom());            // 生成一个密钥对，保存在keyPair中            KeyPair keyPair = keyPairGen.generateKeyPair();            // 得到私钥            PrivateKey privateKey = keyPair.getPrivate();            // 得到公钥            PublicKey publicKey = keyPair.getPublic();            String publicKeyString = new String(Base64.getEncoder().encode(publicKey.getEncoded()));            // 得到私钥字符串            String privateKeyString = new String(Base64.getEncoder().encode((privateKey.getEncoded())));            System.out.println("随机生成的公钥为:" + publicKeyString);            System.out.println("随机生成的私钥为:" + privateKeyString);            publicKeyStr = publicKeyString;            privateKeyStr = privateKeyString;        } catch (NoSuchAlgorithmException e) {            throw new RuntimeException(e);        }    }}

参考资料

www.php1.cn/detail/Java_ShiYong_key_81410199.html

来源地址：https://blog.csdn.net/weixin_40240897/article/details/130241979