详解Android端与JavaWeb传输加密（DES+RSA）

一、加密介绍

本文采用对称式加密算法des和非对称式加密算法rsa结合做数据传输加密的方式。

先说一下对称式加密 des:对称式加密即使用单钥密码加密的方法，信息的加密和解密使用同一个秘钥，这种方式也称为单秘钥加密。所谓对称就是指加密和解密使用的是同一个秘钥！

常用的对称加密有：des、idea、rc2、rc4、skipjack、rc5、aes算法等。

与对称加密算法不同，非对称加密算法需要两个密钥：公开密钥（publickey）和私有密钥 （privatekey）。公开密钥与私有密钥是一对，如果用公开密钥对数据进行加密，只有用对应的私有密钥才能解密；如果用私有密钥对数据进行加密，那么只有用对应的公开密钥才能解密。因为加密和解密使用的是两个不同的密钥，所以这种算法叫作非对称加密算法。

rsa 公钥加密算法是1977年由ron rivest、adi shamirh和lenadleman在（美国麻省理工学院）开发的。rsa取名来自开发他们三者的名字。rsa是目前最有影响力的公钥加密算法，它能够抵抗到目前为止已知的所有密码攻击，已被iso推荐为公钥数据加密标准。 rsa算法基于一个十分简单的数论事实：将两个大素数相乘十分容易，但那时想要对其乘积进行因式分解却极其困难，因此可以将乘积公开作为加密密钥。

二、ｒｓａ密钥生成

rsa密钥采用openssl协议进行生成，本文仅简单生成公钥和私钥，如有其它需要可以通过ｃａ证书进行密钥的生成

１、openssl安装

http://slproweb.com/products/win32openssl.html

请自行选择32位64位进行下载安装

２、打开工作空间

打开openssl安装目录下的bin，运行openssl.exe进入openssl工作空间

３、密钥生成

①、私钥生成（生成位置位于bin目录下）

genrsa -out rsa_private_key.pem 1024

openssl随机生成了一份私钥，加密长度是1024位。加密长度是指理论上最大允许”被加密的信息“长度的限制，也就是明文的长度限制。随着这个参数的增大（比方说2048），允许的明文长度也会增加，但同时也会造成计算复杂度的极速增长。一般推荐的长度就是1024位（128字节）

java需要使用的私钥需要经过pkcs#8编码，php程序不需要

当前私钥格式需要转换为pkcs#8的格式，命令为：

pkcs8 -topk8 -inform pem -in pkcs8_rsa_private_key.pem -outform pem -nocrypt

②、公钥生成

rsa -in rsa_private_key.pem -out rsa_public_key.pem -pubout

至此，rsa+des相关前期准备工作完成

三、android端配置

本文主要针对数据传输过程进行加密，采取加密json字符串完成整个加密过程，由此，需要统一传输参数为"data=********&sign="*******************"的格式，如有其它需求请自行更改。

由于本项目网络框架采用retrofit+okhttp的实现方式，所以对参数进行加密的过程由okhttp拦截器来实现

public class encryptioninterceptor implements interceptor {

private context mcontext;

public encryptioninterceptor(context context) {
 this.mcontext = context;
}

@override
public response intercept(@nonnull chain chain) throws ioexception {
 request request = chain.request();
 requestbody oldbody = request.body();
 buffer buffer = new buffer();
 if (oldbody != null) {
  oldbody.writeto(buffer);
 }
 string stroldbody = buffer.readutf8();
 map<string, string> map = new hashmap<>();
 string databyte = urldecoder.decode(stroldbody.substring(5), "utf-8");
 try {
  //获取des的key
  byte[] deskey = descoder.initkey();
  //des加密数据
  byte[] encrypt = descoder.encrypt(databyte.getbytes(), deskey);
  map.put("data", parsebyte2hexstr(encrypt));
  //rsa加密
  rsaencrypt rsaencrypt = new rsaencrypt();
  inputstream inputstream =  mcontext.getresources().getassets().open("rsa_public_key.pem");
  //rsa设置公钥
  rsaencrypt.loadpublickey(inputstream);
  //rsa加密des的key
  byte[] rsadata = rsaencrypt.encrypt(rsaencrypt.getpublickey(), deskey);
  map.put("sign", parsebyte2hexstr(rsadata));
 } catch (exception e) {
  e.printstacktrace();
 }

 formbody body = new formbody.builder().add("data", map.get("data")).add("sign", map.get("sign")).build();
 request = request.newbuilder().header("content-type", body.contenttype().type()).header("content-length", string.valueof(body.contentlength())).method(request.method(), body).build();
 return chain.proceed(request);
}

/**
 * 将二进制转换成16进制
 *
 * @since v1.0
 */
private static string parsebyte2hexstr(byte buf[]) {
 stringbuilder sb = new stringbuilder();
 for (byte abuf : buf) {
  string hex = integer.tohexstring(abuf & 0xff);
  if (hex.length() == 1) {
   hex = '0' + hex;
  }
  sb.append(hex.touppercase());
 }
 return sb.tostring();
}

/**
 * 按照key排序得到参数列表字符串
 *
 * @param paramvalues 参数map对象
 * @return 参数列表字符串
 */
public static string getparamsorderbykey(map<string, string> paramvalues) {
 string params = "";
 list<string> paramnames = new arraylist<>(paramvalues.size());
 paramnames.addall(paramvalues.keyset());
 collections.sort(paramnames);
 for (string paramname : paramnames) {

  if (params.equals("")) {
   params += paramname + "=" + paramvalues.get(paramname);
  } else {
   params += "&" + paramname + "=" + paramvalues.get(paramname);
  }
 }

 return params;
}

/**
 * 将16进制转换为二进制
 *
 * @since v1.0
 */
public byte[] parsehexstr2byte(string hexstr) {
 if (hexstr.length() < 1)
  return null;
 byte[] result = new byte[hexstr.length() / 2];
 for (int i = 0; i < hexstr.length() / 2; i++) {
  int high = integer.parseint(hexstr.substring(i * 2, i * 2 + 1), 16);
  int low = integer.parseint(hexstr.substring(i * 2 + 1, i * 2 + 2), 16);
  result[i] = (byte) (high * 16 + low);
 }
 return result;
}

}

添加okhttp拦截器

new okhttpclient.builder()
    .addinterceptor(new encryptioninterceptor(this))
    .build();

rsa工具类实现

public class rsaencrypt {
public static final string default_public_key =
  "migfma0gcsqgsib3dqebaquaa4gnadcbiqkbgqc1qcf1zvouhsefxvo6+fnvveps" + "\r" + "uvczg6ox+hjmnksiidwcnkbphfznapdtgoby2xf0r8hghbrt53lnvkj7umci48tq" + "\r" + "k+b4ydjhe9sgjvdccicellgtf/ev206qj/xgkgrlfd+vmmjib8gqckzvy/dxhef1" + "\r" + "aamoz5tdjhovdxt7qwidaqab" + "\r";

public static final string default_private_key =
  "miicdgibadanbgkqhkig9w0baqefaascamawggjcageaaogbalvbx/xnu66gx4xg" + "\r" +
    "+jr4wdw8q+xs9zodqhf4emw2sykinzw2rs8d/odo8o2cgfjbexrhwcydutpncs2+" + "\r" +
    "sptqxwjjy2or4hhh0kd71kalumikjx4ssa1/96/btqon9eaqcssup68yamghybak" + "\r" +
    "rm/l93ger/vocajpm10me5v3fptdagmbaaecgyaf1heahhnhss0muzmqv+q3ftzt" + "\r" +
    "snm+6hzbjxpalamgapo3+nsrfmxqxp9mseqw0lgniflocdrb03o3pv98nocizch7" + "\r" +
    "phsu2ghxj04qro+wkhk358326knxcjjqvibg0xmbjxvhjm2/jjfocxfpe5id7h53" + "\r" +
    "c+gvdguvduayo4i1gqjbao21n2aizqv3mscs1o8brv+9cmhadbvhqbetrob3kj2u" + "\r" +
    "piflktnofwwmta5a8skt8wcoz7lsb2swcp9jnvatxa8cqqddncmfo6eix9e5f11k" + "\r" +
    "rf8srin7xgdzlkkzlmqan0utxdtp4an9cuzrwnntwkysxr/zlntylgyn9rdrohbd" + "\r" +
    "9rgnakboesog7iuqcscfqcmoin29psss0oartnbtvniadyrlzuhp0cebgaaord9t" + "\r" +
    "cyfwoxrxg3jarkwdvxqcmqstbq0nakb8flcrhilsqsundype5vfxpixy9jirako8" + "\r" +
    "our6lexfqjoihcevr+l+1oa4hda8fa2thxak7h4wfmxmmmr8fn69akeaur0yu9my" + "\r" +
    "snzwldwyr5snp90phydsl/htzhbnebd+jlaywoyrfyt+txw0/pemv2b3thygpeiz" + "\r" +
    "khkd/telivbxgg==" + "\r";

/**
 * 私钥
 */
private rsaprivatekey privatekey;

/**
 * 公钥
 */
private rsapublickey publickey;

/**
 * 字节数据转字符串专用集合
 */
private static final char[] hex_char = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};


/**
 * 获取私钥
 *
 * @return 当前的私钥对象
 */
public rsaprivatekey getprivatekey() {
 return privatekey;
}

/**
 * 获取公钥
 *
 * @return 当前的公钥对象
 */
public rsapublickey getpublickey() {
 return publickey;
}

/**
 * 随机生成密钥对
 */
public void genkeypair() {
 keypairgenerator keypairgen = null;
 try {
  keypairgen = keypairgenerator.getinstance("rsa");
 } catch (nosuchalgorithmexception e) {
  e.printstacktrace();
 }
 keypairgen.initialize(1024, new securerandom());
 keypair keypair = keypairgen.generatekeypair();
 this.privatekey = (rsaprivatekey) keypair.getprivate();
 this.publickey = (rsapublickey) keypair.getpublic();
}

/**
 * 从文件中输入流中加载公钥
 *
 * @param in 公钥输入流
 * @throws exception 加载公钥时产生的异常
 */
public void loadpublickey(inputstream in) throws exception {
 try {
  bufferedreader br = new bufferedreader(new inputstreamreader(in));
  string readline = null;
  stringbuilder sb = new stringbuilder();
  while ((readline = br.readline()) != null) {
   if (readline.charat(0) == '-') {
    continue;
   } else {
    sb.append(readline);
    sb.append('\r');
   }
  }
  loadpublickey(sb.tostring());
 } catch (ioexception e) {
  throw new exception("公钥数据流读取错误");
 } catch (nullpointerexception e) {
  throw new exception("公钥输入流为空");
 }
}


/**
 * 从字符串中加载公钥
 *
 * @param publickeystr 公钥数据字符串
 * @throws exception 加载公钥时产生的异常
 */
public void loadpublickey(string publickeystr) throws exception {
 try {
 // byte[] buffer = base64.decode(publickeystr.getbytes(), base64.default);
  base64decoder base64decoder= new base64decoder();
  byte[] buffer= base64decoder.decodebuffer(publickeystr);
  keyfactory keyfactory = keyfactory.getinstance("rsa");
  x509encodedkeyspec keyspec = new x509encodedkeyspec(buffer);
  this.publickey = (rsapublickey) keyfactory.generatepublic(keyspec);
 } catch (nosuchalgorithmexception e) {
  throw new exception("无此算法");
 } catch (invalidkeyspecexception e) {
  throw new exception("公钥非法");
 } catch (nullpointerexception e) {
  throw new exception("公钥数据为空");
 }
}

/**
 * 从文件中加载私钥
 *
 * @return 是否成功
 * @throws exception
 */
public void loadprivatekey(inputstream in) throws exception {
 try {
  bufferedreader br = new bufferedreader(new inputstreamreader(in));
  string readline = null;
  stringbuilder sb = new stringbuilder();
  while ((readline = br.readline()) != null) {
   if (readline.charat(0) == '-') {
    continue;
   } else {
    sb.append(readline);
    sb.append('\r');
   }
  }
  loadprivatekey(sb.tostring());
 } catch (ioexception e) {
  throw new exception("私钥数据读取错误");
 } catch (nullpointerexception e) {
  throw new exception("私钥输入流为空");
 }
}

public void loadprivatekey(string privatekeystr) throws exception {
 try {
  //byte[] buffer = base64.encode(privatekeystr.getbytes(), base64.default);
  base64decoder base64decoder= new base64decoder();
  byte[] buffer= base64decoder.decodebuffer(privatekeystr);
  pkcs8encodedkeyspec keyspec = new pkcs8encodedkeyspec(buffer);
  keyfactory keyfactory = keyfactory.getinstance("rsa");
  this.privatekey = (rsaprivatekey) keyfactory.generateprivate(keyspec);
 } catch (nosuchalgorithmexception e) {
  throw new exception("无此算法");
 } catch (invalidkeyspecexception e) {
  throw new exception("私钥非法");
 } catch (nullpointerexception e) {
  throw new exception("私钥数据为空");
 }
}

/**
 * 加密过程
 *
 * @param publickey  公钥
 * @param plaintextdata 明文数据
 * @return
 * @throws exception 加密过程中的异常信息
 */
public byte[] encrypt(rsapublickey publickey, byte[] plaintextdata) throws exception {
 if (publickey == null) {
  throw new exception("加密公钥为空, 请设置");
 }
 cipher cipher = null;
 try {
  
  cipher = cipher.getinstance("rsa");
  //android端无需添加此加密提供者，已默认实现
  //cipher = cipher.getinstance("rsa", new bouncycastleprovider());
  cipher.init(cipher.encrypt_mode, publickey);
  return cipher.dofinal(plaintextdata);
 } catch (nosuchalgorithmexception e) {
  throw new exception("无此加密算法");
 } catch (nosuchpaddingexception e) {
  e.printstacktrace();
  return null;
 } catch (invalidkeyexception e) {
  throw new exception("加密公钥非法,请检查");
 } catch (illegalblocksizeexception e) {
  throw new exception("明文长度非法");
 } catch (badpaddingexception e) {
  throw new exception("明文数据已损坏");
 }
}

/**
 * 解密过程
 *
 * @param privatekey 私钥
 * @param cipherdata 密文数据
 * @return 明文
 * @throws exception 解密过程中的异常信息
 */
public byte[] decrypt(rsaprivatekey privatekey, byte[] cipherdata) throws exception {
 if (privatekey == null) {
  throw new exception("解密私钥为空, 请设置");
 }
 cipher cipher = null;
 try {
  cipher = cipher.getinstance("rsa");
  //android端无需添加此加密提供者，已默认实现
  //cipher = cipher.getinstance("rsa", new bouncycastleprovider());
  cipher.init(cipher.decrypt_mode, privatekey);
  byte[] output = cipher.dofinal(cipherdata);
  return output;
 } catch (nosuchalgorithmexception e) {
  throw new exception("无此解密算法");
 } catch (nosuchpaddingexception e) {
  e.printstacktrace();
  return null;
 } catch (invalidkeyexception e) {
  throw new exception("解密私钥非法,请检查");
 } catch (illegalblocksizeexception e) {
  throw new exception("密文长度非法");
 } catch (badpaddingexception e) {
  throw new exception("密文数据已损坏");
 }
}


/**
 * 字节数据转十六进制字符串
 *
 * @param data 输入数据
 * @return 十六进制内容
 */
public static string bytearraytostring(byte[] data) {
 stringbuilder stringbuilder = new stringbuilder();
 for (int i = 0; i < data.length; i++) {
  //取出字节的高四位 作为索引得到相应的十六进制标识符 注意无符号右移 
  stringbuilder.append(hex_char[(data[i] & 0xf0) >>> 4]);
  //取出字节的低四位 作为索引得到相应的十六进制标识符 
  stringbuilder.append(hex_char[(data[i] & 0x0f)]);
  if (i < data.length - 1) {
   stringbuilder.append(' ');
  }
 }
 return stringbuilder.tostring();
}


public static void main(string[] args) {
 rsaencrypt rsaencrypt = new rsaencrypt();

 //加载公钥
 try {
  rsaencrypt.loadpublickey(rsaencrypt.default_public_key);
  system.out.println("加载公钥成功");
 } catch (exception e) {
  system.err.println(e.getmessage());
  system.err.println("加载公钥失败");
 }
 /*try {
  rsaencrypt.loadpublickey(rsaencrypt.default_public_key);
  system.out.println("加载公钥成功");
 } catch (exception e) {
  system.err.println(e.getmessage());
  system.err.println("加载公钥失败");
 }
 //加载私钥
 try {
  rsaencrypt.loadprivatekey(rsaencrypt.default_private_key);
  system.out.println("加载私钥成功");
 } catch (exception e) {
  system.err.println(e.getmessage());
  system.err.println("加载私钥失败");
 }
 try {
  securerandom sr = new securerandom();
  keygenerator kg = keygenerator.getinstance("des");
  kg.init(56, sr);
  secretkey generatekey = kg.generatekey();
  string encodehexstring = hex.tohexstring(generatekey.getencoded());
  system.out.println(encodehexstring);
 } catch (nosuchalgorithmexception e) {
  e.printstacktrace();
 }
 //测试字符串
 string encryptstr= "test string chaijunkun";

 try {
  //加密
  long encryptstart = system.currenttimemillis();
  byte[] cipher = rsaencrypt.encrypt(rsaencrypt.getpublickey(), encryptstr.getbytes());
  long encryptend = system.currenttimemillis();
  system.out.println("密文长度:"+ cipher.length);
  system.out.println(rsaencrypt.bytearraytostring(cipher));
  system.out.println("加密时间"+ (encryptend-encryptstart));

  //解密
  long decryptstart = system.currenttimemillis();
  byte[] plaintext = rsaencrypt.decrypt(rsaencrypt.getprivatekey(), cipher);
  long decryptend = system.currenttimemillis();
  system.out.println("明文长度:"+ plaintext.length);
  system.out.println(rsaencrypt.bytearraytostring(plaintext));
  system.out.println("解密时间"+ (decryptend-decryptstart));

  system.out.println(new string(plaintext));
 } catch (exception e) {
  system.err.println(e.getmessage());
 }*/ 
  }
} 

des工具类实现

public class descoder {
/**
 * 密钥算法
 * java 7只支持56位密钥
 * bouncy castle 支持64位密钥
 */
public static final string key_algorithm = "des";
/**
 * 加密/解密算法 /工作模式/填充方式
 */
public static final string cipher_algorithm = "des/ecb/pkcs5padding";
/**
 * 转换密钥
 * @param key 二进制密钥
 * @return key 密钥
 * @throws exception
 */
private static key tokey(byte[] key) throws exception{
 //实例化des密钥材料
 deskeyspec dks = new deskeyspec(key);
 //实例化密钥工厂
 secretkeyfactory keyfactory = secretkeyfactory.getinstance(key_algorithm);
 //生产密钥
 secretkey secretkey = keyfactory.generatesecret(dks);
 return secretkey;
}
/**
 * 解密
 * @param data 待解密数据
 * @param key 密钥
 * @return byte[] 解密数据
 * @throws exception
 */
public static byte[] decrypt(byte[] data,byte[] key) throws exception{
 //还原密钥
 key k = tokey(key);
 //实例化 
 cipher cipher = cipher.getinstance(cipher_algorithm);
 //初始化，设置为解密模式
 cipher.init(cipher.decrypt_mode, k);
 //执行操作
 return cipher.dofinal(data);
}
/**
 * 加密
 * @param data 待加密数据
 * @param key 密钥
 * @return byte[] 加密数据
 * @throws exception
 */
public static byte[] encrypt(byte[] data,byte[] key) throws exception{
 //还原密钥
 key k = tokey(key);
 //实例化
 cipher cipher = cipher.getinstance(cipher_algorithm,new bouncycastleprovider());
 //初始化，设置为加密模式
 cipher.init(cipher.encrypt_mode,k);
 //执行操作
 return cipher.dofinal(data);
}
/**
 * 生产密钥
 * java 7只支持56位 密钥
 * bouncy castle 支持64位密钥
 * @return byte[] 二进制密钥
 * @throws exception
 */
public static byte[] initkey() throws exception{
 /*
  * 实例化密钥生成器
  * 若要使用64位密钥注意替换
  * 讲下述代码中的
  * keygenerator.getinstance(key_algorithm);
  * 替换为
  * keygenerator.getinstance(key_algorithm，"bc");
  */
 keygenerator kg = keygenerator.getinstance(key_algorithm,new bouncycastleprovider());

 kg.init(64);
 //生成密钥
 secretkey secretkey = kg.generatekey();
 //获得密钥的二进制编码形式
 return secretkey.getencoded();
}
}

四、javaweb端配置

web后端只需要在controller中添加以下代码，接受服务端传递的data和sign，并完成接收的json字符串转换为实体类即可

/**
 * 解密所需数据
 *
 * @param data 接受客户端上传的json格式的数据
 * @param sign 接受客户端上传的解密数据的key值
 */
public <t> t convertjson(string data, string sign,class<t> clazz) {
 system.out.println(data);
 system.out.println(sign);
 t tclass = null;
 try {
  //rsa加密
  rsaencrypt rsaencrypt = new rsaencrypt();
  //加载rsa私钥
  inputstream in = new fileinputstream(new file("c:\\openssl-win64\\bin\\pkcs8_rsa_private_key.pem"));
  rsaencrypt.loadprivatekey(in);
  //获取rsa加密的key的数据，并把该16进制的sign转成byte[],(客户端采用将byte[]转成16进制进行数据上传)
  byte[] keybytes = parsehexstr2byte(sign);
  //通过rsa解密des的key值
  byte[] rsakey = rsaencrypt.decrypt(rsaencrypt.getprivatekey(), keybytes);

  //通过des的key值解密需要的json数据
  byte[] desdata = descoder.decrypt(parsehexstr2byte(data), rsakey);
  system.out.println(arrays.tostring(desdata));
  system.out.println(new string(desdata));
  tclass = json.parseobject(new string(desdata), clazz);
 } catch (exception e) {
  e.printstacktrace();
 }
 return tclass;
}

五、备注

后续会上传相关demo到github

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持。