标签: bouncycastle

是充气城堡API线程安全的？特别,

org.bouncycastle.crypto.paddings.PaddedBufferedBlockCipher
org.bouncycastle.crypto.paddings.PKCS7Padding
org.bouncycastle.crypto.engines.AESFastEngine
org.bouncycastle.crypto.modes.CBCBlockCipher

我打算在我的应用程序中编写一个单独的Spring bean用于基本级加密支持.由于它是一个Web应用程序,因此多个线程一次访问此组件的可能性更大.因此,踏板安全至关重要.

如果您使用Bouncy Castle遇到过这种情况,请告诉我.

我一直在尝试理解用于Java的BouncyCastle加密API.不幸的是,我发现Java加密通常被服务提供者接口和术语所掩盖,以至于我无法理解实际做的事情.我已经尝试过反复阅读必要的文档,但它只是难以理解,引入了许多远远超出我认为应该需要的概念.

我真正想要的是一个执行以下操作的类:

public class KeyPair {
    public byte[] public;
    public byte[] private;
}

public class RSACrypto {
    public static KeyPair generateRSAKeyPair() { /*implementation*/}
    public static byte[] encrypt(byte[] data, byte[] publicKey) { /*impl*/}
    public static byte[] decrypt(byte[] encryptedData, byte[] privateKey) { /*impl*/ }
}

如果这是一个非常复杂的问题,请问"我真正想要的一切".关于在Java加密和BouncyCastle上阅读的地方的任何指示都是非常受欢迎的.任何有关Java加密系统实际布局的概述都非常受欢迎.

此单元测试失败:

    public void testDigest() throws NoSuchAlgorithmException {
    String hashExpected = "150a14ed5bea6cc731cf86c41566ac427a8db48ef1b9fd626664b3bfbb99071fa4c922f33dde38719b8c8354e2b7ab9d77e0e67fc12843920a712e73d558e197";
    MessageDigest md = new MessageDigest();
    String hashActual = new String(md.digest("hi"));
    Assert.assertEquals(hashExpected, hashActual);
}

下面是我的MessageDigest类的实现:

import java.io.IOException;
import java.io.InputStream;
import java.security.NoSuchAlgorithmException;
import java.security.Security;


import org.bouncycastle.crypto.Digest;
import org.bouncycastle.crypto.digests.SHA512Digest;
import org.bouncycastle.crypto.io.DigestInputStream;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

public class MessageDigest {
    private Digest messageDigest;

public MessageDigest() throws NoSuchAlgorithmException {
    Security.addProvider(new BouncyCastleProvider());
    messageDigest = new SHA512Digest();
}

public byte[] digest(String message) {
    byte[] retValue = new byte[messageDigest.getDigestSize()];
    messageDigest.update(message.getBytes(), 0, message.length());
    messageDigest.doFinal(retValue, 0);
    return retValue;
}
Run Code Online (Sandbox Code Playgroud)

}


测试失败,原因如下: …

我看过很多帖子,其中有很多教程,但似乎都没有.有时,他们会引用一些未找到的类.我是否可以指向一个可以获得简单教程的地方,该教程展示了如何加密和解密文件.

我对Pgp很新,欢迎任何帮助.

目前我正在编写一个java库来访问pointhq.com的REST API.

在开发Android客户端时,我意识到默认情况下不接受SSL证书,因此我编写了一个自定义TrustManager并添加了pointhq.com证书,如本文所述:使用HttpClient通过HTTPS信任所有证书

使用此Trustmanager和我导入的bks文件,我在尝试连接时收到以下错误: IssuerName(CN=GeoTrust Global CA, O=GeoTrust Inc., C=US) does not match SubjectName(CN=RapidSSL CA, O="GeoTrust, Inc.", C=US) of signing certificate.

那我做错了什么？我导入了pointhq.com,rapidssl.com,geotrust.com证书.但没有改变.是否有一种我必须注意的证书分类？我错过了根证书吗？

编辑:这是导入证书的列表:

类型:BKS提供者:BC条目:3

条目别名:geotrust global ca创建日期:19.10.2011 15:44:35 MESZ类型:可信证书证书:1

Certificate 1 of 1
Version: 3
Subject: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
Issuer: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
Serial Number: 0002 3456
Valid From: 21.05.2002 06:00:00
Valid Until: 21.05.2022 06:00:00
Public Key: RSA (2.048 bits)
Signature Algorithm: SHA1withRSA
SHA-1 Fingerprint: DE:28:F4:A4:FF:E5:B9:2F:A3:C5:03:D1:A3:49:A7:F9:96:2A:82:12
MD5 Fingerprint: F7:75:AB:29:FB:51:4E:B7:77:5E:FF:05:3C:99:8E:F5

输入别名:pointhq.com(rapidssl ca)创建日期:29.09.2011 18:55:12 MESZ类型:可信证书证书:1 …

我有一堆作为字节数组给出的根证书和中间证书,我也有最终用户证书.我想为给定的最终用户证书构建证书链.在.NET框架中,我可以这样做:

using System.Security.Cryptography.X509Certificates;

static IEnumerable<X509ChainElement>
    BuildCertificateChain(byte[] primaryCertificate, IEnumerable<byte[]> additionalCertificates)
{
    X509Chain chain = new X509Chain();
    foreach (var cert in additionalCertificates.Select(x => new X509Certificate2(x)))
    {
        chain.ChainPolicy.ExtraStore.Add(cert);
    }

    // You can alter how the chain is built/validated.
    chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
    chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreWrongUsage;

    // Do the preliminary validation.
    var primaryCert = new X509Certificate2(primaryCertificate);
    if (!chain.Build(primaryCert))
        throw new Exception("Unable to build certificate chain");

    return chain.ChainElements.Cast<X509ChainElement>();
}

如何在BouncyCastle中做到这一点？我试过下面的代码,但我得到PkixCertPathBuilderException: No certificate found matching targetContraints:

using Org.BouncyCastle;
using Org.BouncyCastle.Pkix;
using Org.BouncyCastle.Utilities.Collections;
using Org.BouncyCastle.X509;
using …

Hy Guys!我正在尝试使用bouncycastle创建x.509证书,该证书应该由另一个证书签名并存储它PEM base 64格式.

我已经拥有自签名证书(公钥和私钥).现在我想创建一个新的并使用现有的自签名证书进行签名.

KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", "BC");
keyPairGenerator.initialize(1024, new SecureRandom());
KeyPair keyPair = keyPairGenerator.generateKeyPair();

X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
X500Principal dnName = new X500Principal("CN=Sergey");
certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
certGen.setSubjectDN(dnName);
certGen.setIssuerDN(caCert.getSubjectX500Principal());
certGen.setNotBefore(validityBeginDate);
certGen.setNotAfter(validityEndDate);
certGen.setPublicKey(keyPair.getPublic());
certGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(caCert));
certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false, new SubjectKeyIdentifierStructure(keyPair.getPublic()));

X509Certificate cert = certGen.generate(caCertPrivateKey, "BC");

验证通过没有例外,这意味着从我的观点来看,它已被caCert成功签署:

cert.verify(caCert.getPublicKey());

然后我将它解码到PEM base 64:

PEMWriter pemWriter = new PEMWriter(new PrintWriter(System.out));
pemWriter.writeObject(cert);
pemWriter.flush();

我在输出中得到这样的东西:

-----开始证书-----

MIIDDjCCAnegAwIBAgIBFDAN ........

-----结束证书-----

当我打开它时,我看到下一个:

如果caCert成功签署,为什么没有认证链？

在我的代码中需要更改哪些内容才能看到我预期的认证链？

我们有一个创建PDFs unsing jasperreports的应用程序.
它还在创建后使用iText操纵所述PDF.

我们最近开始在某些PDF上使用加密.这意味着在应用程序创建后可以处理PDF之前,必须对其进行解密.尝试使用iText时,PdfReader(String path, byte[] password)我得到以下异常:

java.lang.VerifyError: class org.bouncycastle.asn1.ASN1Primitive overrides final method equals.(Ljava/lang/Object;)Z
    at java.lang.ClassLoader.defineClass1(Native Method)
    at java.lang.ClassLoader.defineClassCond(Unknown Source)
    at java.lang.ClassLoader.defineClass(Unknown Source)
    at com.simontuffs.onejar.JarClassLoader.defineClass(JarClassLoader.java:561)
    at com.simontuffs.onejar.JarClassLoader.findClass(JarClassLoader.java:475)
    at java.lang.ClassLoader.loadClass(Unknown Source)
    at java.lang.ClassLoader.loadClass(Unknown Source)
    at com.itextpdf.text.pdf.PdfEncryption.<init>(PdfEncryption.java:148)
    at com.itextpdf.text.pdf.PdfReader.readDecryptedDocObj(PdfReader.java:914)
    at com.itextpdf.text.pdf.PdfReader.readDocObj(PdfReader.java:1294)
    at com.itextpdf.text.pdf.PdfReader.readPdf(PdfReader.java:643)
    at com.itextpdf.text.pdf.PdfReader.<init>(PdfReader.java:187)
    at com.itextpdf.text.pdf.PdfReader.<init>(PdfReader.java:212)
    at com.itextpdf.text.pdf.PdfReader.<init>(PdfReader.java:202)

该项目使用Maven构建为可运行的.jar,并使用以下依赖项:
iText 5.4.2
bouncycastle 1.48

我应该提一下,jasperreports有自己的iText和bouncycastle依赖:
iText 2.1.7
bouncycastle 1.38

我无法弄清楚发生了什么,需要帮助.

我试图使用gpg加密加密文件,然后在我的jruby项目中发送它.但是我找不到足够的资源.我尝试使用ruby-gpgme,但jruby不支持C库.我试过阅读Bouncy Castle,但我被课程文档所震撼,并没有找到加密文件的简单文章.

Vivek在这个问题上的答案接近我的解决方案,但只有解密文件的解决方案.我目前正在关注这篇文章并试图在jruby中连接java代码无济于事.我认为encryptFile功能是我需要的,如下所示:

public static void encryptFile(
        OutputStream out,
        String fileName,
        PGPPublicKey encKey,
        boolean armor,
        boolean withIntegrityCheck)
        throws IOException, NoSuchProviderException, PGPException
    {
        Security.addProvider(new BouncyCastleProvider());

        if (armor) {
            out = new ArmoredOutputStream(out);
        }

        ByteArrayOutputStream bOut = new ByteArrayOutputStream();
        PGPCompressedDataGenerator comData = new PGPCompressedDataGenerator(PGPCompressedData.ZIP);

        PGPUtil.writeFileToLiteralData(
                comData.open(bOut),
                PGPLiteralData.BINARY,
                new File(fileName) );

        comData.close();

        BcPGPDataEncryptorBuilder dataEncryptor = new BcPGPDataEncryptorBuilder(PGPEncryptedData.TRIPLE_DES);
        dataEncryptor.setWithIntegrityPacket(withIntegrityCheck);
        dataEncryptor.setSecureRandom(new SecureRandom());

        PGPEncryptedDataGenerator encryptedDataGenerator = new PGPEncryptedDataGenerator(dataEncryptor);
        encryptedDataGenerator.addMethod(new BcPublicKeyKeyEncryptionMethodGenerator(encKey));

        byte[] bytes = bOut.toByteArray();
        OutputStream cOut …

我正在使用Bouncy Castle库在C＃中生成签名，如下所示：

var privateKeyBase64 = "MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgg8/MbvGGTDMDpfje8lQBZ8st+l3SK7jRl7OWlyUl/VagCgYIKoZIzj0DAQehRANCAARkQIUpkKbxmJJicvG450JH900JjmJOGdlMCZl3BIXvPBBKkaTMsQc6l3O4vJA6Yc23nr3Ox/KwFUl6gdo5iTqV";
var publicKeyBase64 = "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZECFKZCm8ZiSYnLxuOdCR/dNCY5iThnZTAmZdwSF7zwQSpGkzLEHOpdzuLyQOmHNt569zsfysBVJeoHaOYk6lQ==";

var plainText = "aaa";
var plainTextBytes = Encoding.UTF8.GetBytes(plainText);

// Sign
var privateKey = PrivateKeyFactory.CreateKey(Convert.FromBase64String(privateKeyBase64));
var signer = SignerUtilities.GetSigner(X9ObjectIdentifiers.ECDsaWithSha512.Id);
signer.Init(true, privateKey);
signer.BlockUpdate(plainTextBytes, 0, plainTextBytes.Length);

var signature = signer.GenerateSignature();
var signatureBase64 = Convert.ToBase64String(signature);

Console.WriteLine("Signature base64: {0}", signatureBase64);

// Verify
Console.WriteLine("-------------------- Verifying signature ");
Console.WriteLine("Public key base64: {0}", publicKeyBase64);

var publicKey = PublicKeyFactory.CreateKey(Convert.FromBase64String(publicKeyBase64));
var verifier = SignerUtilities.GetSigner(X9ObjectIdentifiers.ECDsaWithSha512.Id);
verifier.Init(false, publicKey);
verifier.BlockUpdate(plainTextBytes, 0, plainTextBytes.Length);
Console.WriteLine("Signature valid?: {0}", verifier.VerifySignature(Convert.FromBase64String(signatureBase64)));

// Prints: MEUCIBEcfv2o3UwqwV72CVuYi7HbjcoiuSQOULY5d+DuGt3UAiEAtoNrdNWvjfdz/vR6nPiD+RveKN5znBtYaIrRDp2K7Ks=

在node.js应用程序上，我正在使用jsrsasign验证在相同有效负载上生成的签名，如下所示：

let …