Question

我正在编写PGP服务器以为用户生成密钥。
我想用Bouncy Castle在Java中用我的私钥对任何生成的PGP公钥进行签名，以使其受到用户的信任。

生成密钥对没有问题-效果很好。

我试图通过gpg --sign-key命令行进行签名，并且效果很好。

但是我在Java中无法做到这一点。我尝试了许多这样的解决方案：java sign public pgp key with bouncycastle

和BC示例包中的DirectKeySignature类，但对我来说没有用。

密钥已签名，但gpg --check-sigs告知签名不正确：

gpg --check-sigs "Adrian (test) <al@p-c.pl>"
pub   4096R/9D5D4AB8 2018-06-20
sig-         E9798A8A 2018-08-04  Test (test) <test@sample.com>
uid                  Adrian (test) <al@p-c.pl>
sig!         9D5D4AB8 2018-06-20  Adrian (test) <al@p-c.pl>

1 incorrect signature

两个版本的源代码：

版本1：

public void signKey(String id, PGPSecretKey mySecretKey, PGPPublicKey publicKeyToBeSigned, char[] passPhrase, OutputStream out) throws PGPException, IOException {

    PGPPrivateKey pgpPrivKey = mySecretKey.extractPrivateKey(
            new JcePBESecretKeyDecryptorBuilder().setProvider(provider).build(passPhrase));

    PGPSignatureGenerator signatureGenerator = new PGPSignatureGenerator(
            new JcaPGPContentSignerBuilder(mySecretKey.getPublicKey().getAlgorithm(), PGPUtil.SHA1));

    signatureGenerator.init(PGPSignature.DIRECT_KEY, pgpPrivKey);

    PGPSignature signature = signatureGenerator.generateCertification(id, publicKeyToBeSigned);

    PGPPublicKey result = PGPPublicKey.addCertification(publicKeyToBeSigned, signature);

    out = new ArmoredOutputStream(out);

    result.encode(out);
    out.close();
}

版本2（基于org.bouncycastle.openpgp.examples.DirectKeySignature）：

public void signPublicKey(PGPSecretKey secretKey, String secretKeyPass, PGPPublicKey keyToBeSigned, String notationName, String notationValue, OutputStream out) throws Exception {

    PGPPrivateKey pgpPrivKey = secretKey.extractPrivateKey(
            new JcePBESecretKeyDecryptorBuilder().setProvider("BC").build(secretKeyPass.toCharArray()));

    PGPSignatureGenerator sGen = new PGPSignatureGenerator(
            new JcaPGPContentSignerBuilder(secretKey.getPublicKey().getAlgorithm(), PGPUtil.SHA1).setProvider("BC"));

    sGen.init(PGPSignature.DIRECT_KEY, pgpPrivKey);

    PGPSignatureSubpacketGenerator spGen = new PGPSignatureSubpacketGenerator();

    boolean isHumanReadable = true;

    spGen.setNotationData(true, isHumanReadable, notationName, notationValue);

    PGPSignatureSubpacketVector packetVector = spGen.generate();

    sGen.setHashedSubpackets(packetVector);

    PGPPublicKey result = PGPPublicKey.addCertification(keyToBeSigned, sGen.generate());

    out = new ArmoredOutputStream(out);

    result.encode(out);
    out.close();
}

测试：

@Test
public void signKey() throws Exception {

    FileInputStream in = new FileInputStream("src/test/resources/secret.dat");

    PgpServiceImpl pgp = new PgpServiceImpl();

    PGPSecretKey pgpSecretKey = pgp.readSecretKey(in, "..........".toCharArray());
    PGPPublicKey pubKey = pgp.readPublicKey(new FileInputStream("src/test/resources/pub_other.dat"));

    ByteArrayOutputStream res = new ByteArrayOutputStream();

    pgp.signPublicKey(pgpSecretKey, "..........", pubKey, "Test (test) <test@sample.com>", "Adrian (test) <al@p-c.pl>", res);

    System.out.println(new String(res.toByteArray()));
}

结果：

Answer 1

这很完美：

public void signPublicKey(PGPSecretKey secretKey, char[] passPhrase, PGPPublicKey keyToBeSigned, OutputStream out) throws PGPException, IOException {

        PGPPrivateKey pgpPrivKey = secretKey.extractPrivateKey(
                new JcePBESecretKeyDecryptorBuilder().setProvider( provider )
                        .build(passPhrase));

        PGPSignatureGenerator signatureGenerator = new PGPSignatureGenerator(
                new JcaPGPContentSignerBuilder( secretKey.getPublicKey().getAlgorithm(), PGPUtil.SHA1 ) );

        signatureGenerator.init( PGPSignature.DEFAULT_CERTIFICATION, pgpPrivKey );

        Iterator<String> ids = keyToBeSigned.getUserIDs();
        if(!ids.hasNext()) throw new IllegalArgumentException("klucz nie posiada żadnego User ID");
        String id = ids.next();

        PGPSignature signature = signatureGenerator.generateCertification(id, keyToBeSigned);
        PGPPublicKey newKey = PGPPublicKey.addCertification(keyToBeSigned, id, signature);

        out = new ArmoredOutputStream(out);

        newKey.encode(out);
        out.close();
    }

如何在Java中用Bouncy Castle签署公共PGP密钥

1 个答案: