在Java密钥库中存储PGP(公共)密钥 - Bouncycastle

Question

我在实施SSO时使用bouncycastle(JAVA)进行签名,加密,解密和签名验证.我有原始的PGP公钥和私钥,我需要将它们存储在Java密钥库中.这些PGP公钥没有证书.

据我所知,对于公钥(根据Keystore的javadoc:http://docs.oracle.com/javase/6/docs/api/java/security/KeyStore.html),我必须创建证书.创建证书后,我可以将其作为KeyStore.TrustedCertificateEntry导入密钥库.但是,我无法为类型org.bouncycastle.openpgp.PGPPublicKey创建证书条目.

我在网上搜索过但找不到任何有效的例子:

1. Bouncycastle文档:http://www.bouncycastle.org/wiki/display/JA1/X.509+Public+Key+Certificate+and+Certification+Request+Generation 为X.509密钥生成证书 -

2. Bouncycastle示例 - org.bouncycastle.openpgp.examples.DirectKeySignature:将证书(PGPSignature类型的对象)直接添加到PGPPublicKey.总而言之 - 我签署了(认证的)PGPPublicKey但我无法将这种类型的密钥存储到java密钥库中.

   OutputStream out = new ByteArrayOutputStream();
   
   if (armor)
   {
       out = new ArmoredOutputStream(out);
   }
   
   PGPPrivateKey pgpPrivKey = secretKey.extractPrivateKey(secretKeyPass.toCharArray(), "BC");
   
   PGPSignatureGenerator       sGen = new PGPSignatureGenerator(secretKey.getPublicKey().getAlgorithm(), PGPUtil.SHA1, "BC");
   
   sGen.initSign(PGPSignature.DIRECT_KEY, pgpPrivKey);
   
   BCPGOutputStream            bOut = new BCPGOutputStream(out);
   
   sGen.generateOnePassVersion(false).encode(bOut);
   
   PGPSignatureSubpacketGenerator spGen = new PGPSignatureSubpacketGenerator();
   
   boolean isHumanReadable = true;
   
   spGen.setNotationData(true, isHumanReadable, notationName, notationValue);
   
   PGPSignatureSubpacketVector packetVector = spGen.generate();
   sGen.setHashedSubpackets(packetVector);
   
   bOut.flush();
   
   return PGPPublicKey.addCertification(keyToBeSigned, sGen.generate()).getEncoded();
   

我主要对编程解决方案(java源代码)感兴趣,但使用某些工具的示例也会有所帮助.

谢谢!

Answer 1

java.security.PublicKey我认为您应该从您的文件中提取 aPGPPublicKey并使用它来构建X509Certificate可以存储在密钥库中的 a 。

JcaPGPKeyConverter c = new JcaPGPKeyConverter();
PublicKey publicKey = c.getPublicKey(pgpPublicKey);
// ... Use Bouncy's X509V3CertificateGenerator or X509v3CertificateBuilder
// ... to construct a self-signed cert
X509Certificate x509Certificate = // ...
// ... add cert to KeyStore

要创建一个，X509Certificate请参阅PublicKey：生成随机证书。