• Java簽名工具類

 
 
 

  
  
  
/*
  
  
  
 * Copyright (C) 2020 Baidu, Inc. All Rights Reserved.
  
  
  
 */
  
  
  
package com.baidu.*;
  
  
  

  
  
  
import static org.springframework.util.Assert.isTrue;
  
  
  
import static org.springframework.util.Assert.notNull;
  
  
  

  
  
  
import java.io.UnsupportedEncodingException;
  
  
  
import java.net.URLEncoder;
  
  
  
import java.security.KeyFactory;
  
  
  
import java.security.NoSuchAlgorithmException;
  
  
  
import java.security.PrivateKey;
  
  
  
import java.security.PublicKey;
  
  
  
import java.security.Signature;
  
  
  
import java.security.spec.InvalidKeySpecException;
  
  
  
import java.security.spec.PKCS8EncodedKeySpec;
  
  
  
import java.security.spec.X509EncodedKeySpec;
  
  
  
import java.util.Base64;
  
  
  
import java.util.Comparator;
  
  
  
import java.util.Map;
  
  
  
import java.util.TreeMap;
  
  
  

  
  
  
import org.springframework.util.CollectionUtils;
  
  
  
import org.springframework.util.StringUtils;
  
  
  

  
  
  
// 百度收銀臺雙向RSA簽名工具，JDK版本要求：1.8+
  
  
  
public class RSASign {
  
  
  

  
  
  
 private static final String CHARSET = "UTF-8";
  
  
  
 private static final String SIGN_TYPE_RSA = "RSA";
  
  
  
 private static final String SIGN_ALGORITHMS = "SHA1WithRSA";
  
  
  
 private static final String SIGN_KEY = "rsaSign";
  
  
  

  
  
  
 /**
  
  
  
 * 使用私鑰生成簽名字符串
  
  
  
 *
  
  
  
 * @param params 待簽名參數(shù)集合
  
  
  
 * @param privateKey 私鑰原始字符串
  
  
  
 *
  
  
  
 * @return 簽名結(jié)果字符串
  
  
  
 *
  
  
  
 * @throws Exception
  
  
  
 */
  
  
  
 public static String sign(Map params, String privateKey) throws Exception {
  
  
  
 isTrue(!CollectionUtils.isEmpty(params), "params is required");
  
  
  
 notNull(privateKey, "privateKey is required");
  
  
  

  
  
  
 String signContent = signContent(params);
  
  
  

  
  
  
 Signature signature = Signature.getInstance(SIGN_ALGORITHMS);
  
  
  
 signature.initSign(getPrivateKeyPKCS8(privateKey));
  
  
  
 signature.update(signContent.getBytes(CHARSET));
  
  
  
 byte[] signed = signature.sign();
  
  
  

  
  
  
 return new String(Base64.getEncoder().encode(signed));
  
  
  
 }
  
  
  

  
  
  
 /**
  
  
  
 * 使用公鑰校驗簽名
  
  
  
 *
  
  
  
 * @param params 入?yún)?shù)據(jù)，簽名屬性名固定為rsaSign
  
  
  
 * @param publicKey 公鑰原始字符串
  
  
  
 *
  
  
  
 * @return true 驗簽通過 | false 驗簽不通過
  
  
  
 *
  
  
  
 * @throws Exception
  
  
  
 */
  
  
  
 public static boolean checkSign(Map params, String publicKey) throws Exception {
  
  
  
 isTrue(!CollectionUtils.isEmpty(params), "params is required");
  
  
  
 notNull(publicKey, "publicKey is required");
  
  
  

  
  
  
 // sign & content
  
  
  
 String content = signContent(params);
  
  
  
 String rsaSign = params.get(SIGN_KEY).toString();
  
  
  

  
  
  
 // verify
  
  
  
 Signature signature = Signature.getInstance(SIGN_ALGORITHMS);
  
  
  
 signature.initVerify(getPublicKeyX509(publicKey));
  
  
  
 signature.update(content.getBytes(CHARSET));
  
  
  

  
  
  
 return signature.verify(Base64.getDecoder().decode(rsaSign.getBytes(CHARSET)));
  
  
  
 }
  
  
  

  
  
  
 /**
  
  
  
 * 對輸入?yún)?shù)進(jìn)行key過濾排序和字符串拼接
  
  
  
 *
  
  
  
 * @param params 待簽名參數(shù)集合
  
  
  
 *
  
  
  
 * @return 待簽名內(nèi)容
  
  
  
 *
  
  
  
 * @throws UnsupportedEncodingException
  
  
  
 */
  
  
  
 private static String signContent(Map params) throws UnsupportedEncodingException {
  
  
  
 Map sortedParams = new TreeMap<>(Comparator.naturalOrder());
  
  
  
 for (Map.Entry entry : params.entrySet()) {
  
  
  
 String key = entry.getKey();
  
  
  
 if (legalKey(key)) {
  
  
  
 String value =
  
  
  
 entry.getValue() == null ? null : URLEncoder.encode(entry.getValue().toString(), CHARSET);
  
  
  
 sortedParams.put(key, value);
  
  
  
 }
  
  
  
 }
  
  
  

  
  
  
 StringBuilder builder = new StringBuilder();
  
  
  
 if (!CollectionUtils.isEmpty(sortedParams)) {
  
  
  
 for (Map.Entry entry : sortedParams.entrySet()) {
  
  
  
 builder.append(entry.getKey());
  
  
  
 builder.append("=");
  
  
  
 builder.append(entry.getValue());
  
  
  
 builder.append("&");
  
  
  
 }
  
  
  
 builder.deleteCharAt(builder.length() - 1);
  
  
  
 }
  
  
  
 return builder.toString();
  
  
  
 }
  
  
  

  
  
  
 /**
  
  
  
 * 將公鑰字符串進(jìn)行Base64 decode之后，生成X509標(biāo)準(zhǔn)公鑰
  
  
  
 *
  
  
  
 * @param publicKey 公鑰原始字符串
  
  
  
 *
  
  
  
 * @return X509標(biāo)準(zhǔn)公鑰
  
  
  
 *
  
  
  
 * @throws InvalidKeySpecException
  
  
  
 * @throws NoSuchAlgorithmException
  
  
  
 */
  
  
  
 private static PublicKey getPublicKeyX509(String publicKey) throws InvalidKeySpecException,
  
  
  
 NoSuchAlgorithmException, UnsupportedEncodingException {
  
  
  
 if (StringUtils.isEmpty(publicKey)) {
  
  
  
 return null;
  
  
  
 }
  
  
  
 KeyFactory keyFactory = KeyFactory.getInstance(SIGN_TYPE_RSA);
  
  
  
 byte[] decodedKey = Base64.getDecoder().decode(publicKey.getBytes(CHARSET));
  
  
  
 return keyFactory.generatePublic(new X509EncodedKeySpec(decodedKey));
  
  
  
 }
  
  
  

  
  
  
 /**
  
  
  
 * 將私鑰字符串進(jìn)行Base64 decode之后，生成PKCS #8標(biāo)準(zhǔn)的私鑰
  
  
  
 *
  
  
  
 * @param privateKey 私鑰原始字符串
  
  
  
 *
  
  
  
 * @return PKCS #8標(biāo)準(zhǔn)的私鑰
  
  
  
 *
  
  
  
 * @throws Exception
  
  
  
 */
  
  
  
 private static PrivateKey getPrivateKeyPKCS8(String privateKey) throws Exception {
  
  
  
 if (StringUtils.isEmpty(privateKey)) {
  
  
  
 return null;
  
  
  
 }
  
  
  
 KeyFactory keyFactory = KeyFactory.getInstance(SIGN_TYPE_RSA);
  
  
  
 byte[] decodedKey = Base64.getDecoder().decode(privateKey.getBytes(CHARSET));
  
  
  
 return keyFactory.generatePrivate(new PKCS8EncodedKeySpec(decodedKey));
  
  
  
 }
  
  
  

  
  
  
 /**
  
  
  
 * 有效的待簽名參數(shù)key值
  
  
  
 * 非空、且非簽名字段
  
  
  
 *
  
  
  
 * @param key 待簽名參數(shù)key值
  
  
  
 *
  
  
  
 * @return true | false
  
  
  
 */
  
  
  
 private static boolean legalKey(String key) {
  
  
  
 return StringUtils.hasText(key) && !SIGN_KEY.equalsIgnoreCase(key);
  
  
  
 }
  
  
  

  
  
  
}
 
 
 

驗證

加簽邏輯驗證

開發(fā)者實現(xiàn)加簽邏輯之后，使用計算示例中步驟 1 的初始請求參數(shù)作為輸入，結(jié)合密鑰生成中的示例私鑰，進(jìn)行 RSA 簽名的生成，如果結(jié)果與步驟 3 中最終簽名串一致，說明加簽邏輯正確。

驗簽邏輯驗證

使用計算示例中步驟 4 完整請求參數(shù)作為輸入，結(jié)合密鑰生成中的示例公鑰，進(jìn)行 RSA 簽名的 check ，返回 true 則說明驗簽邏輯正確。