Java实现数字签名

例子：

package rmd_intl_app.Test;

import java.security.KeyFactory;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.PrivateKey;

import java.security.PublicKey;

import java.security.Signature;

import java.security.interfaces.RSAPrivateKey;

import java.security.interfaces.RSAPublicKey;

import java.security.spec.PKCS8EncodedKeySpec;

import java.security.spec.X509EncodedKeySpec;

import org.apache.commons.codec.binary.Hex;

public class ImoocRSA {

private static String src = "imooc security rsa";

public static void main(String[] args) {

jdkRSA();

}

public static void jdkRSA() {

try {

//1.初始化密钥

KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");

keyPairGenerator.initialize(512);

KeyPair keyPair = keyPairGenerator.generateKeyPair();

RSAPublicKey rsaPublicKey = (RSAPublicKey)keyPair.getPublic();

RSAPrivateKey rsaPrivateKey = (RSAPrivateKey)keyPair.getPrivate();

//2.执行签名

PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(rsaPrivateKey.getEncoded());

KeyFactory keyFactory = KeyFactory.getInstance("RSA");

PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);

Signature signature = Signature.getInstance("MD5withRSA");

signature.initSign(privateKey);

signature.update(src.getBytes());

byte[] result = signature.sign();

System.out.println("jdk rsa sign : " + Hex.encodeHexString(result));

//3.验证签名

X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(rsaPublicKey.getEncoded());

keyFactory = KeyFactory.getInstance("RSA");

PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);

signature = Signature.getInstance("MD5withRSA");

signature.initVerify(publicKey);

signature.update(src.getBytes());

boolean bool = signature.verify(result);

System.out.println("jdk rsa verify : " + bool);

} catch (Exception e) {

e.printStackTrace();

}

}

}

三、数字签名算法—DSA

DSA是Schnorr和ElGamal签名算法的变种，被美国NIST作为DSfS(DigitalSignature Standard)。

DSA是基于整数有限域离散对数难题的，其安全性与RSA相比差不多。DSA的一个重要特点是两个素数公开，这样，当使用别人的p和q时，即使不知道私钥，你也能确认它们是否是随机产生的，还是作了手脚。RSA却做不到。

DSA仅包含数字签名

具体算法如下图：

例子：

package com.imooc.security.dsa;

import java.security.KeyFactory;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.PrivateKey;

import java.security.PublicKey;

import java.security.Signature;

import java.security.interfaces.DSAPrivateKey;

import java.security.interfaces.DSAPublicKey;

import java.security.spec.PKCS8EncodedKeySpec;

import java.security.spec.X509EncodedKeySpec;

import org.apache.commons.codec.binary.Hex;

public class ImoocDSA {

private static String src = "imooc security dsa";

public static void main(String[] args) {

jdkDSA();

}

public static void jdkDSA() {

try {

//1.初始化密钥

KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("DSA");

keyPairGenerator.initialize(512);

KeyPair keyPair = keyPairGenerator.generateKeyPair();

DSAPublicKey dsaPublicKey = (DSAPublicKey) keyPair.getPublic();

DSAPrivateKey dsaPrivateKey = (DSAPrivateKey)keyPair.getPrivate();

//2.执行签名

PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(dsaPrivateKey.getEncoded());

KeyFactory keyFactory = KeyFactory.getInstance("DSA");

PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);

Signature signature = Signature.getInstance("SHA1withDSA");

signature.initSign(privateKey);

signature.update(src.getBytes());

byte[] result = signature.sign();

System.out.println("jdk dsa sign : " + Hex.encodeHexString(result));

//3.验证签名

X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(dsaPublicKey.getEncoded());

keyFactory = KeyFactory.getInstance("DSA");

PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);

signature = Signature.getInstance("SHA1withDSA");

signature.initVerify(publicKey);

signature.update(src.getBytes());

boolean bool = signature.verify(result);

System.out.println("jdk dsa verify : " + bool);

} catch (Exception e) {

e.printStackTrace();

}

}

}

四、数字签名算法—ECDSA

ECDSA: 椭圆曲线数字签名算法（Elliptic Curve Digital Signatrue Algorithm）

特点：速度快，强度高，签名短

具体算法如下图：

例子：

package com.imooc.security.ecdsa;

import java.security.KeyFactory;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.NoSuchAlgorithmException;

import java.security.PrivateKey;

import java.security.PublicKey;

import java.security.Signature;

import java.security.interfaces.ECPrivateKey;

import java.security.interfaces.ECPublicKey;

import java.security.spec.PKCS8EncodedKeySpec;

import java.security.spec.X509EncodedKeySpec;

import org.apache.commons.codec.binary.Hex;

public class ImoocECDSA {

private static String src = "imooc security ecdsa";

public static void main(String[] args) {

jdkECDSA();

}

public static void jdkECDSA() {

try {

//1.初始化密钥

KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");

keyPairGenerator.initialize(256);

KeyPair keyPair = keyPairGenerator.generateKeyPair();

ECPublicKey ecPublicKey = (ECPublicKey)keyPair.getPublic();

ECPrivateKey ecPrivateKey = (ECPrivateKey)keyPair.getPrivate();

//2.执行签名

PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(ecPrivateKey.getEncoded());

KeyFactory keyFactory = KeyFactory.getInstance("EC");

PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);

Signature signature = Signature.getInstance("SHA1withECDSA");

signature.initSign(privateKey);

signature.update(src.getBytes());

byte[] result = signature.sign();

System.out.println("jdk ecdsa sign : " + Hex.encodeHexString(result));

//3.验证签名

X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(ecPublicKey.getEncoded());

keyFactory = KeyFactory.getInstance("EC");

PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);

signature = Signature.getInstance("SHA1withECDSA");

signature.initVerify(publicKey);