Question

我已生成私钥并使用密码对其进行加密。现在我想将它加载到EncryptedPrivateKeyInfo，以便我可以构造并将其导出为PEM格式文件。以下是我使用的代码，

final CertAndKeyGen keypair = new CertAndKeyGen("RSA", "SHA1WithRSA", null);
final X500Name x500Name =
    new X500Name("IN", "AP", "HYD", "TEST", "TEST_ORG", "test@xyz.com");
keypair.generate(1024);
final PrivateKey privKey = keypair.getPrivateKey();
final X509Certificate[] chain = new X509Certificate[1];
long validity = 123;
chain[0] = keypair.getSelfCertificate(x500Name, new Date(), 
    validity * 24 * 60 * 60);
Key key =  new SecretKeySpec(password.getBytes(), ALGO);
Cipher c = Cipher.getInstance(ALGO);
c.init(Cipher.ENCRYPT_MODE, key);
byte[] encVal = c.doFinal(privKey.getEncoded());
AlgorithmParameters params = AlgorithmParameters.getInstance("DES");
params.init(encVal); // <--- exception thrown here
EncryptedPrivateKeyInfo encinfo = new EncryptedPrivateKeyInfo(params, encVal);

// displaying encrypting value
String encryptedValue = Base64.encodeBase64String(encinfo.getEncoded());
System.out.println(encryptedValue);

但是在执行上面的代码时，我得到了以下异常

java.io.IOException: DER input not an octet string
  at sun.security.util.DerInputStream.getOctetString(DerInputStream.java:233)
  at com.sun.crypto.provider.SunJCE_t.a(DashoA13*..)
  at com.sun.crypto.provider.DESParameters.engineInit(DashoA13*..)
  at java.security.AlgorithmParameters.init(AlgorithmParameters.java:260)

在params.init(encVal);行中。我不知道异常会出现什么问题。任何帮助或建议将非常感激。提前谢谢。

Answer 1

包含加密私钥的PKCS＃8文件具有以下ASN.1结构：

EncryptedPrivateKeyInfo ::= SEQUENCE {
  encryptionAlgorithm EncryptionAlgorithmIdentifier,
  encryptedData EncryptedData }

请注意加密数据只是整个数据包的一部分。您需要将此数据与加密算法标识符一起包含在序列中。上面的代码只生成encryptedData部分。

我建议你考虑使用BouncyCastle。看起来他们可能有improved support for PKCS#8 recently。这是一些示例代码：

KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
KeyPair keyPair = generator.generateKeyPair();

final PrivateKey privKey = keyPair.getPrivate();

JceOpenSSLPKCS8EncryptorBuilder builder =
    new JceOpenSSLPKCS8EncryptorBuilder(PKCS8Generator.PBE_SHA1_3DES);

builder.setIterationCount(10000);
builder.setPasssword("Hello, World!".toCharArray());

OutputEncryptor outputEncryptor = builder.build();    
PKCS8Generator pkcs8Generator =
    new JcaPKCS8Generator(privKey, outputEncryptor);

try (PemWriter writer = new PemWriter(new PrintWriter(System.out))) {
  writer.writeObject(pkcs8Generator);
}

这将输出加密的私钥：

构造EncryptedPrivateKeyInfo时的异常

1 个答案: