RSA签名和验签Util

目录：

• 1、DigitalSign类
• 2、CryptException异常类
• 3、加签示例
• 4、验签示例

1、DigitalSign类

import org.apache.commons.codec.binary.Base64;

import javax.crypto.Cipher;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.security.KeyStore;
import java.security.Signature;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPublicKey;
import java.util.Enumeration;
import java.util.Map;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;

/**
 * 证书加解密/签名/验签类
 */
public class DigitalSign {
    
    private static DigitalSign single=null;

    /** 编码 格式*/
    private static String encoding = "UTF-8";
    /** 算法 */
    private String arithmetic = "SHA1withRSA";

    /**私钥缓存**/
    private ConcurrentHashMap<String, RSAPrivateCrtKey> map = new ConcurrentHashMap<String, RSAPrivateCrtKey>();

    private DigitalSign(String encoding){
    }

    private DigitalSign(){

    }
    
    /**
     * 初始化 实例
     */
    public static synchronized void init() {  
        if (single == null) {    
            single = new DigitalSign(encoding); 
        }    
    }

    /**
     * 初始化 实例
     */
    public static synchronized void init(String charset) {
        if (single == null) {
            single = new DigitalSign();
            encoding = charset;
        }
    }

    //静态工厂方法   
    public static DigitalSign getInstance() {
        if (single == null) {    
            init(); //为空的时候同步实例
        }    
        return single;  
    }

    //静态工厂方法
    public static DigitalSign getInstance(String charset) {
        if (single == null) {
            init(charset); //为空的时候同步实例
        }
        return single;
    }
    
    /**
     * 私钥签名  
     * @param tobeSigned
     * @param priKeyPath classpath 下路径
     * @param password
     * @return
     * @throws CryptException
     */
    public String SignMsgByRelativePath(final String tobeSigned, final String priKeyPath, final String password) throws CryptException {
        RSAPrivateCrtKey priKey = getPriKeyByRelativePath(priKeyPath, password);
        return sign(priKey, tobeSigned);
    }
    
    
    /**
     * 私钥签名
     * @param tobeSigned
     * @param priKeyStream 私钥文件流
     * @param password
     * @return
     * @throws CryptException
     */
    public String SignMsgByInputStream(String tobeSigned,InputStream priKeyStream,String password) throws CryptException{
        RSAPrivateCrtKey priKey = getPriKeyByInputStream(priKeyStream, password);
        return sign(priKey, tobeSigned);
    }
    
    /**
     * 私钥签名
     * @param tobeSigned
     * @param priKeyPath 私钥绝对路径
     * @param password
     * @return
     * @throws CryptException
     */
    public String signMsgByAbsolutePath(String tobeSigned,String priKeyPath,String password) throws CryptException{
        RSAPrivateCrtKey priKey = map.get(priKeyPath);
        if(priKey == null){
            priKey = getPriKeyByAbsolutePath(priKeyPath, password);
        }
        return sign(priKey, tobeSigned);
    }


    /**
     * 私钥签名
     * @param tobeSigned
     * @param priKeyPath 私钥绝对路径
     * @param password
     * @return
     * @throws CryptException
     */
    public String signMsgByAbsolutePath(Map<String, Object> tobeSigned,String priKeyPath,String password) throws CryptException{
        RSAPrivateCrtKey priKey = map.get(priKeyPath);
        if(priKey == null){
            priKey = getPriKeyByAbsolutePath(priKeyPath, password);
        }
        return sign(priKey, tobeSigned);
    }
    
    /**
     * 公钥验签 
     * @param tobeVerfied
     * @param plainText
     * @param pubKey 文件输入流
     * @return
     * @throws CryptException
     */
    public boolean verifyMsgByInputSteam(String tobeVerfied,String plainText,InputStream pubKey) throws CryptException{
        //获取公钥
        RSAPublicKey pubkey = getPubKeyByInputSteam(pubKey);
        return verify(pubkey, tobeVerfied, plainText);
    }
    
    /**
     * 通过公钥验签
     * @param tobeVerified
     * @param plainText
     * @param pubkeyPath 公钥绝对路径
     * @return
     * @throws CryptException
     */
    public boolean verifyMsgByAbsolutePath(String tobeVerified,String plainText,String pubkeyPath) throws CryptException{
        RSAPublicKey pubkey = getPubKeyByAbsolutePath(pubkeyPath);
        return verify(pubkey, tobeVerified, plainText);
    }


    /**
     * 通过公钥验签
     * @param tobeVerified
     * @param map
     * @param pubkeyPath 公钥绝对路径
     * @return
     * @throws CryptException
     */
    public boolean verifyMsgByAbsolutePath(String tobeVerified,Map<String, Object> map,String pubkeyPath) throws CryptException{
        RSAPublicKey pubkey = getPubKeyByAbsolutePath(pubkeyPath);
        return verify(pubkey, tobeVerified, map);
    }
    
    /**
     * 公钥验签
     * @param tobeVerfied
     * @param plainText
     * @param CertFile 文件classpath下路径
     * @return
     * @throws CryptException
     */
    public boolean verifyMsgByRelativePath(String tobeVerfied, String plainText, String CertFile) throws CryptException {
        RSAPublicKey pubkey = getPubKeyByRelativePath(CertFile);
        return verify(pubkey, tobeVerfied, plainText);
    }

    /**
     * 使用公钥对数据加密
     * @param TobeEncryptMsg 待加密的明文字符串
     * @param certFile 公钥路径[相对地址 classpath下]
     * @return 加密后的字符串
     * @throws CryptException 错误信息
     */
    public String encryptMsg(String TobeEncryptMsg, String certFile) throws CryptException {
        //获取公钥
        RSAPublicKey pubKey = getPubKeyByRelativePath(certFile);
        Cipher instance;
        try {
            instance = Cipher.getInstance(pubKey.getAlgorithm());
            instance.init(Cipher.ENCRYPT_MODE, pubKey);
            String encryMsg = Base64.encodeBase64String(instance.doFinal(Base64.encodeBase64(TobeEncryptMsg.getBytes(encoding))));
            return encryMsg;
        } catch (Exception e) {
            throw new CryptException("加密失败",e);
        }
    }   
    
    /**
     * 私钥解密
     * @param TobeDecodeMsg 待解密的加密字符串
     * @param priFile 私钥路径[相对路径 classpath下]
     * @param passWord 私钥密码
     * @return 解密后的明文字符串
     * @throws CryptException 错误信息
     */
    public String decodeMsg(String TobeDecodeMsg, String priFile,
            String passWord) throws CryptException{
        RSAPrivateCrtKey priKey = getPriKeyByRelativePath(priFile, passWord);
        Cipher instance;
        try {
            instance = Cipher.getInstance(priKey.getAlgorithm());
            instance.init(Cipher.DECRYPT_MODE, priKey);
            String string = new String(Base64.decodeBase64(instance.doFinal(Base64.decodeBase64(TobeDecodeMsg))), encoding);
            return string;
        } catch (Exception e) {
            throw new CryptException("解密失败",e);
        }
    }

    /**
     * 获取私钥 文件流
     * @param keyfileStream
     * @param password
     * @return
     * @throws CryptException
     */
    private RSAPrivateCrtKey getPriKeyByInputStream(InputStream keyfileStream,String password) throws CryptException{
        return getPriKey(keyfileStream, password);      
    }
    
    /**
     * 通过文件绝对路径加载私钥
     * @param priKeyPath 绝对路径
     * @param password
     * @return
     * @throws CryptException
     */
    private RSAPrivateCrtKey getPriKeyByAbsolutePath(String priKeyPath,String password) throws CryptException{
        FileInputStream file;
        try {
            file = new FileInputStream(priKeyPath);
        } catch (FileNotFoundException e) {
            throw new CryptException("秘钥路径不正确",e);
        }
        RSAPrivateCrtKey priKey = getPriKey(file, password);
        map.put(priKeyPath, priKey);
        return priKey;
    }
    
    /**
     * 获取私钥 [classpath]
     * @param KeyFile
     * @param passWord
     * @return
     */
    private RSAPrivateCrtKey getPriKeyByRelativePath(String KeyFile,String passWord) throws CryptException{
        //获取项目 相对路径
        ClassLoader cl = DigitalSign.class.getClassLoader();
        InputStream fiKeyFile = cl.getResourceAsStream(KeyFile);
        return getPriKey(fiKeyFile, passWord);
    }
    
    /**
     * 获取公钥 [文件输入流]
     * @param pubKey
     * @return
     * @throws CryptException
     */
    private RSAPublicKey getPubKeyByInputSteam(InputStream pubKey) throws CryptException{
        return getPublicKey(pubKey);
    }

    
    /**
     * 获取公钥 [classpath下]
     * @param CertFile
     * @return
     */
    private RSAPublicKey getPubKeyByRelativePath(String CertFile) throws CryptException{
        //读取公钥文件
        ClassLoader cl = DigitalSign.class.getClassLoader();
        InputStream certfile = cl.getResourceAsStream(CertFile);
        //获取公钥
        return getPublicKey(certfile);
    }
    
    /**
     * 获取公钥 通过绝对路径
     * @param pubKeyPath
     * @return
     * @throws CryptException
     */
    private RSAPublicKey getPubKeyByAbsolutePath(String pubKeyPath) throws CryptException{
        try{
            FileInputStream pubKey = new FileInputStream(pubKeyPath);
            return getPublicKey(pubKey);
        }catch(Exception e){
            throw new CryptException("文件读取失败",e);
        }
    }
    
    /**
     * 获取公钥
     * @param pubKey 公钥流
     * @return
     * @throws CryptException
     */
    private RSAPublicKey getPublicKey(InputStream pubKey) throws CryptException{
        X509Certificate x509cert = null;
        try {
            //实例化 x509
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            x509cert = (X509Certificate) cf.generateCertificate(pubKey);
        } catch (CertificateException e) {
            if (pubKey != null){
                try {
                    pubKey.close();
                } catch (IOException e1) {
                    throw new CryptException("文件流关闭异常",e1);
                }
            }           
            throw new CryptException("初始化公钥异常",e);
        }
        //读取公钥
        RSAPublicKey pubkey = (RSAPublicKey) x509cert.getPublicKey();       
        return pubkey;
    }
    
    /**
     * 获取私钥
     * @param priKey
     * @param keyPassword
     * @return
     * @throws CryptException
     */
    private RSAPrivateCrtKey getPriKey(InputStream priKey,String keyPassword) throws CryptException{
        String keyAlias = null;
        RSAPrivateCrtKey prikey = null;     
        try {
            KeyStore ks = KeyStore.getInstance("PKCS12");
            ks.load(priKey, keyPassword.toCharArray());
            
            Enumeration<?> myEnum = ks.aliases();
            while (myEnum.hasMoreElements()) {
                keyAlias = (String) myEnum.nextElement();
                if (ks.isKeyEntry(keyAlias)) {
                    prikey = (RSAPrivateCrtKey) ks.getKey(keyAlias, keyPassword.toCharArray());
                    break;
                }
            }           
        } catch (Exception e) {
            if (priKey != null){
                try {
                    priKey.close();
                } catch (IOException e1) {
                    throw new CryptException("流关闭异常",e1);
                }
            }
            throw new CryptException("加载私钥失败",e);
        }
        
        if(prikey == null){
            throw new CryptException("私钥不存在");
        }
        
        return prikey;      
    }
    
    /**
     * 签名
     * @param priKey 私钥
     * @param tobeSigned 待签字符串
     * @return 签名结果
     * @throws CryptException
     */
    private String sign(RSAPrivateCrtKey priKey,String tobeSigned) throws CryptException{
        try {
            Signature sign = Signature.getInstance(arithmetic);
            sign.initSign(priKey);  
            sign.update(tobeSigned.getBytes(encoding)); 
            byte signed[] = sign.sign();
//          byte sign_asc[] = new byte[signed.length * 2];  
//          Hex2Ascii(signed.length, signed, sign_asc);
            
//          return new String(signed,encoding); 
            return Base64.encodeBase64String(signed).replaceAll("\\+", "%2B");
        } catch (Exception e) {
            throw new CryptException("签名失败",e);
        }       
    }

    /**
     * 签名
     * @param priKey 私钥
     * @param map 待签字符串
     * @return 签名结果
     * @throws CryptException
     */
    private String sign(RSAPrivateCrtKey priKey,Map<String, Object> map) throws CryptException{
        try {
            String tobeSigned = appendMap(map);
            Signature sign = Signature.getInstance(arithmetic);
            sign.initSign(priKey);
            sign.update(tobeSigned.getBytes(encoding));
            byte signed[] = sign.sign();
//          byte sign_asc[] = new byte[signed.length * 2];
//          Hex2Ascii(signed.length, signed, sign_asc);

//          return new String(signed,encoding);
            return Base64.encodeBase64String(signed).replaceAll("\\+", "%2B");
        } catch (Exception e) {
            throw new CryptException("签名失败",e);
        }
    }


    /**
     * 连接参数
     * @param map
     * @return
     */
    private static String appendMap(Map<String, Object> map){
        Set<String> keySet = map.keySet();
        StringBuilder sb = new StringBuilder();
        for (String mapKey : keySet){
            String value = (String)map.get(mapKey);
            sb.append(mapKey).append("=").append(value).append("&");
        }
        return  sb.toString();
    }
    
    /**
     * 验证签名
     * @param pubkey 公钥
     * @param tobeVerfied 已签名字符串
     * @param plainText 待校验字符串
     * @return true || false
     * @throws CryptException
     */
    private boolean verify(RSAPublicKey pubkey,String tobeVerfied,String plainText) throws CryptException{
        try {
            Signature verify = Signature.getInstance(arithmetic);
            verify.initVerify(pubkey);
//          byte signeddata[] = new byte[tobeVerfied.length() / 2];
//          Ascii2Hex(tobeVerfied.length(), tobeVerfied.getBytes(encoding), signeddata);    
            verify.update(plainText.getBytes(encoding));    
            
            return verify.verify(Base64.decodeBase64(tobeVerfied.replaceAll("%2B", "\\+")));
        } catch (Exception e) {
            throw new CryptException("验签失败",e);
        }       
    }


    /**
     * 验证签名
     * @param pubkey 公钥
     * @param tobeVerfied 已经签名的map
     * @param map 待校验的map
     * @return true || false
     * @throws CryptException
     */
    private boolean verify(RSAPublicKey pubkey,String tobeVerfied,Map<String, Object> map) throws CryptException{
        try {
            String plainText =  appendMap(map);
            Signature verify = Signature.getInstance(arithmetic);
            verify.initVerify(pubkey);
//          byte signeddata[] = new byte[tobeVerfied.length() / 2];
//          Ascii2Hex(tobeVerfied.length(), tobeVerfied.getBytes(encoding), signeddata);
            verify.update(plainText.getBytes(encoding));

            return verify.verify(Base64.decodeBase64(tobeVerfied.replaceAll("%2B", "\\+")));
        } catch (Exception e) {
            throw new CryptException("验签失败",e);
        }
    }
}

2、CryptException异常类

/**
 * 密钥异常类
 */
public class CryptException extends Exception{

    private static final long serialVersionUID = 2843021655596315128L;

    public CryptException(String message){
        super(message);
    }

    public CryptException(String message, Throwable cause) {
        super(message, cause);
    }

    public CryptException(Throwable cause) {
        super(cause);
    }
}

3、加签示例

Map<String, String> map = new TreeMap<String, String>();
//....省略map put值...
String sign = DigitalSign.getInstance().signMsgByAbsolutePath(map, path, 
password);
map.put("sign", sign);

4、验签示例

map.remove("sign");
DigitalSign digitalSign = DigitalSign.getInstance();
boolean result = digitalSign.verifyMsgByAbsolutePath(sign, params, merchCertPath);