Question

我的应用在打开时会生成一个KeyPair。我可以用PublicKey加密文本，但是当我尝试用PrivateKey解密文本时，它会抛出InvalidKeyException。

一些Log.v调试：

(...) V/Aliases: The public key created is [android.security.keystore.AndroidKeyStoreRSAPublicKey@1840131a]
(...) V/Aliases: The private key created is [android.security.keystore.AndroidKeyStoreRSAPrivateKey@37ad0430]
(...) V/Aliases: The public key used is [android.security.keystore.AndroidKeyStoreRSAPublicKey@1840131a]
(...) V/Aliases: The private key used is [android.security.keystore.AndroidKeyStoreRSAPrivateKey@37ad0430]
(...) V/Aliases: The private key [android.security.keystore.AndroidKeyStoreRSAPrivateKey@37ad0430] is incorrect

KeyPair生成：

try {
    //Load KeyStore  
    keystore = KeyStore.getInstance("AndroidKeyStore");
    keystore.load(null);

} catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException e) {
        e.printStackTrace();
    }

    //KeyPair generation
    KeyPairGenerator kpg = null;
    try {
        kpg = KeyPairGenerator.getInstance("RSA", "AndroidKeyStore");
        kpg.initialize(new KeyGenParameterSpec.Builder("Test",KeyProperties.PURPOSE_DECRYPT | KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_SIGN)
                .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                .build());
        kp = kpg.generateKeyPair();
        Log.v("Aliases", "The public key created is [" + kp.getPublic() + "]");
        Log.v("Aliases", "The private key created is [" + kp.getPrivate()+ "]");

    } catch (NoSuchAlgorithmException | NoSuchProviderException | InvalidAlgorithmParameterException e) {
        e.printStackTrace();
    }

Encryption功能：

//Removed try/catch
KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry) keystore.getEntry("Test", null);
PublicKey publicKey = privateKeyEntry.getCertificate().getPublicKey();

Log.v("Aliases", "The public key used is [" + publicKey + "]");

Cipher cipher = Cipher.getInstance("RSA");
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
[] bytes = cipher.doFinal(edittext.getText().toString().getBytes());
edittext.setText(Base64.encodeToString(bytes, Base64.DEFAULT));

Decryption功能：

//Removed try/catch
KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry) keystore.getEntry("Test", null);
PrivateKey privateKey = privateKeyEntry.getPrivateKey();

Log.v("Aliases", "The private key used is [" + privateKey + "]");

Cipher cipher = Cipher.getInstance("RSA");
cipher.init(Cipher.DECRYPT_MODE, privateKey);
String decrypted = new String(cipher.doFinal(Base64.decode(edittext.getText().toString(), Base64.DEFAULT)));
edittext.setText(decrypted);

//Removed the "try" part. This gets executed when cipher.init returns InvalidKeyException
catch (InvalidKeyException e) {
            KeyStore.PrivateKeyEntry privateKeyEntry = null;
            privateKeyEntry = (KeyStore.PrivateKeyEntry) keystore.getEntry("Test", null);
            PrivateKey privateKey = privateKeyEntry.getPrivateKey();
            Log.v("Aliases", "The private key [" + privateKey + "] is incorrect");
            e.printStackTrace();
}

Answer 1

不要这样做：

Cipher cipher = Cipher.getInstance("RSA");

始终指定完整的“算法/模式/填充” 规范。例如，

Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA-256andMGF1Padding");

现在，您还需要告诉AndroidKeyStore您允许密钥使用哪种加密填充。因此，在您的通话链中为setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP)添加一个KeyGenParameterSpec.Builder(...)通话，即

kpg.initialize(new KeyGenParameterSpec.Builder("Test",
                KeyProperties.PURPOSE_DECRYPT | KeyProperties.PURPOSE_ENCRYPT |
                        KeyProperties.PURPOSE_SIGN)
                .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP)
                .build());

RSA私钥密钥库错误

1 个答案: