golang生成公私钥java签名验签

最近在学习golang，决定用golang搭建一个支付中心的服务，客服端与服务器通信使用非对称rsa加签验签，来保证通信的可靠安全。客服端可以请求支付中心golang生成公私钥，支付中心提供sdk，sdk支持各主流语言。golang版本的rsa签名和验签都没问题，

在写java版本的sdk确出现了问题，先把golang版本的sdk贴上。

package sdk

import (
    "crypto"
    "crypto/md5"
    "crypto/rand"
    "crypto/rsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/base64"
    "encoding/hex"
    "encoding/pem"
    "errors"
    "log"
)

const (
    privateBlockType = "RSA PRIVATE KEY"
    publicBlockType  = "RSA PUBLIC KEY"
)

// Md5 to encode string of src,
// the return string length is 32
func Md5(src string) string {
    defer GetTimer("md5加密")()
    bs := md5.Sum([]byte(src))
    endCodeStr := hex.EncodeToString(bs[:])
    return endCodeStr
}

func GenRsaKeys(bits int) (priKey, pubKey, pkcs8Key string, err error) {
    defer GetTimer("生成rsa密钥对")()
    key, err := rsa.GenerateKey(rand.Reader, bits)
    if err != nil {
        return "", "", "", err
    }
    err = key.Validate()
    if err != nil {
        return "", "","", err
    }
    priBytes := x509.MarshalPKCS1PrivateKey(key)
    priKey = string(pem.EncodeToMemory(&pem.Block{Type: privateBlockType, Bytes: priBytes}))

    pubBytes, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
    if err != nil {
        panic(err)
    }
    pubKey = string(pem.EncodeToMemory(&pem.Block{Type: publicBlockType, Bytes: pubBytes}))

    pkcs8Bytes, err := x509.MarshalPKCS8PrivateKey(key)
    if err != nil {
        return "", "", "", err
    }
    pkcs8Key = string(pem.EncodeToMemory(&pem.Block{Type: privateBlockType, Bytes: pkcs8Bytes}))

    return priKey, pubKey, pkcs8Key, err
}

func decodePrivateKey(privateKey string) (*rsa.PrivateKey, error) {
    block, _ := pem.Decode([]byte(privateKey))
    if block == nil || block.Type != privateBlockType {
        return nil, errors.New("failed to decode PEM block containing private key")
    }
    return x509.ParsePKCS1PrivateKey(block.Bytes)
}

//私钥加签
func SignWithPrivateKey(privateKey string, src []byte) (string, error) {
    defer GetTimer("私钥加签")()
    key, err := decodePrivateKey(privateKey)
    if err != nil {
        return "", err
    }
    hashed := sha256.Sum256(src)
    log.Println("sha256:", base64.StdEncoding.EncodeToString(hashed[:]))
    signBytes, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, hashed[:])
    if err != nil {
        return "", err
    }
    return base64.StdEncoding.EncodeToString(signBytes), nil
}

func decodePublicKey(publicKey string) (*rsa.PublicKey, error) {
    block, _ := pem.Decode([]byte(publicKey))
    if block == nil {
        return nil, errors.New("failed to decode PEM block containing private key")
    }
    pub,err := x509.ParsePKIXPublicKey(block.Bytes)
    if err != nil {
        return nil, err
    }
    return pub.(*rsa.PublicKey), err
}

// VerifyWithPublicKey 公钥验签
func VerifyWithPublicKey(signData string, srcData []byte, publicKey string) error {
    defer GetTimer("公钥验签")()
    key, err := decodePublicKey(publicKey)
    if err != nil {
        return err
    }

    bytes, err := base64.StdEncoding.DecodeString(signData)
    if err != nil {
        return err
    }
    hashed := sha256.Sum256(srcData)
    err = rsa.VerifyPKCS1v15(key, crypto.SHA256, hashed[:], bytes)
    if err != nil {
        return err
    }
    return nil
}

//  DecryptWithPrivateKey私钥解密
func DecryptWithPrivateKey(privateKey string, encryptData string) ([]byte, error) {
    defer GetTimer("私钥解密")()
    key, err := decodePrivateKey(privateKey)
    if err != nil {
        return nil, err
    }
    encryptBytes, err := base64.StdEncoding.DecodeString(encryptData)
    if err != nil {
        return nil, err
    }
    return rsa.DecryptPKCS1v15(rand.Reader, key, encryptBytes)
}

//EncryptWithPublicKey 公钥加密
func EncryptWithPublicKey(publicKey string, bs []byte) (string, error) {
    defer GetTimer("公钥加密")()
    key, err := decodePublicKey(publicKey)
    if err != nil {
        return "", err
    }
    encryptBytes, err := rsa.EncryptPKCS1v15(rand.Reader, key, bs)
    if err != nil {
        return "", err
    }
    return base64.StdEncoding.EncodeToString(encryptBytes), nil

}

GenRsaKeys(int)参数是生成私钥字节大小,一般是1024或者2048,第一个返回值是cs1版本的私钥,第二个参数是公钥,第三个参数是pkcs8的私钥,java语言只能使用

pkcs8的私钥,cs1的会报错,另外java使用公钥私钥都要去掉开头和结尾的block type,不然会报错。这个函数生成的公私钥下面命令生成的等价

//生成cs1私钥
openssl genrsa -out rsa_private_key.pem 2048
//生成公钥
openssl rsa -in rsa_private_key.pem -pubout -out rsa_public_key.pem
//生成pkcs8私钥
openssl pkcs8 -topk8 -inform PEM -in rsa_private_key.pem -outform pem -nocrypt -out private_pkcs8.pem

 java版本的有公钥加密，pkcs8私钥解密，私钥加签，公钥验签

package com.zhqn.rsa.util;


import javax.crypto.Cipher;
import java.nio.charset.StandardCharsets;
import java.security.*;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Arrays;
import java.util.Base64;

/**
 * Date:     2022/1/27 18:10
 * Description:
 *
 * @author zhouquan3
 */
public class CryptoUtils {

    public static final String RSA_ALGORITHM = "rsa";


    /**
     * 非对称加密
     *
     * @param src       待加密字符串
     * @param publicKey 公钥
     * @return 解密后的字符串
     */
    public static String encryptWithPublicKey(String src, String publicKey) {
        try {

            byte[] publicKeyBytes = parseKey(publicKey);
            KeyFactory keyFactory = KeyFactory.getInstance(RSA_ALGORITHM);
            PublicKey key = keyFactory.generatePublic(new X509EncodedKeySpec(publicKeyBytes));
            Cipher cipher = Cipher.getInstance(RSA_ALGORITHM);
            cipher.init(Cipher.ENCRYPT_MODE, key);
            byte[] encodeBytes = cipher.doFinal(src.getBytes(StandardCharsets.UTF_8));
            return Base64.getEncoder().encodeToString(encodeBytes);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    /**
     * 去掉公钥或者私钥blockType
     * @param key 私钥或者公钥
     * @return bytes
     */
    private static byte[] parseKey(String key) {
        String newKey = Arrays.stream(key.split("\n")).filter(line -> line.length() > 0 && line.charAt(0) != '-').reduce(String::concat).orElse("");
        return Base64.getDecoder().decode(newKey.getBytes());
    }


    /**
     * 非对称解密
     *
     * @param src        待解密字符串
     * @param privateKey 符合pkcs8私钥
     * @return 解密后的字符串
     */
    public static String decryptWithPkcs8(String src, String privateKey) {
        try {
            byte[] srcBytes = Base64.getDecoder().decode(src);
            byte[] privateKeyBytes = parseKey(privateKey);
            KeyFactory keyFactory = KeyFactory.getInstance(RSA_ALGORITHM);
            PrivateKey key = keyFactory.generatePrivate(new PKCS8EncodedKeySpec(privateKeyBytes));
            Cipher cipher = Cipher.getInstance(RSA_ALGORITHM);
            cipher.init(Cipher.DECRYPT_MODE, key);
            byte[] decryptBytes = cipher.doFinal(srcBytes);
            return new String(decryptBytes);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    private static PublicKey getPublicKey(String publicKey) {
        byte[] keyBytes = parseKey(publicKey);
        try {
            KeyFactory keyFactory = KeyFactory.getInstance(RSA_ALGORITHM);
            return keyFactory.generatePublic(new X509EncodedKeySpec(keyBytes));
        } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
            throw new RuntimeException(e);
        }

    }

    /**
     * 用公钥验签
     * @param sign 签名
     * @param publicKey 公钥
     * @param plain 原文
     * @return true 通过 false 未通过
     */
    public static boolean verifySignWithPublicKey(String publicKey, String sign, String plain) {
        try {
            Signature signature = Signature.getInstance("SHA256WithRSA");
            signature.initVerify(getPublicKey(publicKey));
            signature.update(plain.getBytes(StandardCharsets.UTF_8));
            return signature.verify(Base64.getDecoder().decode(sign));
        } catch (Exception e ) {
            e.printStackTrace();
            return false;
        }
    }

    /**
     * 用pkcs8格式的私钥加签名
     * @param privateKey 私钥
     * @param plain 原文
     * @return base64
     */
    public static String signWithPkcs8(String privateKey, String plain) {
        try {
            Signature signature = Signature.getInstance("SHA256WithRSA");
            signature.initSign(getPrivateKey(privateKey));
            signature.update(plain.getBytes());
            byte[] bytes = signature.sign();
            return Base64.getEncoder().encodeToString(bytes);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    private static PrivateKey getPrivateKey(String privateKey) {
        byte[] privateKeyBytes = parseKey(privateKey);
        KeyFactory keyFactory = null;
        try {
            keyFactory = KeyFactory.getInstance(RSA_ALGORITHM);
            return keyFactory.generatePrivate(new PKCS8EncodedKeySpec(privateKeyBytes));
        } catch (Exception e) {
            throw new RuntimeException(e);
        }

    }
}

java加签流程：signWithPkcs8(pkcs8私钥，明文)得到签名sign，golang调用VerifyWithPublicKey(签名，原文，公钥)，验证通过

golang加签流程: SignWithPrivateKey(cs1版本的私钥,明文)得到签名sign，java调用verifySignWithPublicKey(公钥,签名,原文)

java加密流程: encryptWithPublicKey(公钥,原文)得到密文，golang调用DecryptWithPrivateKey(cs1版本的私钥,密文)得到原文

golang加密流程:EncryptWithPublicKey(公钥，原文)得到密文, java调用decryptWithPkcs8(密文,pkcs8密钥)得到原文

以上流程都充分测试，未发现问题，可以放心使用