C# 使用BouncyCastle进行AEAD_AES_256_GCM加解密

文章介绍了如何在C#中使用BouncyCastle库进行AEAD_AES_256_GCM加密和解密过程,涉及密钥、随机nonce、明文和附加数据的处理。

国家实名认证使用到的加密

C# 使用BouncyCastle进行AEAD_AES_256_GCM 加密

         /// <summary>
        /// 使用BouncyCastle进行AEAD_AES_256_GCM 加密
        /// </summary>
        /// <param name="key">key32位字符</param>
        /// <param name="nonce">随机串12位</param>
        /// <param name="plainData">明文</param>
        /// <param name="associatedData">附加数据可能null</param>
        /// <returns></returns>
        public static string AesGcmEncryptByBouncyCastleBy(string key, string nonce, string plainData, string associatedData)
        {
   
   
            var associatedBytes = associatedData == null ? null : Encoding.UTF8.GetBytes(associatedData);
            byte[] byteData = StrToHexByte(key);
            byte[] values = GetRandomBytes(12);
            var gcmBlockCipher = new GcmBlockCipher(new AesEngine());
            var parameters = new AeadParameters(
                new KeyParameter(byteData),
                128, //128 = 16 * 8 => (tag size * 8)
                Encoding.UTF8.GetBytes(nonce),
                associatedBytes);

            gcmBlockCipher.Init(true, parameters);

            var data = Encoding.UTF8.GetBytes
■Generation and parsing of PKCS#12 files. ■X.509: Generators and parsers for V1 and V3 certificates, V2 CRLs and attribute certificates. ■PBE algorithms supported by PBEUtil: PBEwithMD2andDES-CBC, PBEwithMD2andRC2-CBC, PBEwithMD5andDES-CBC, PBEwithMD5andRC2-CBC, PBEwithSHA1andDES-CBC, PBEwithSHA1andRC2-CBC, PBEwithSHA-1and128bitRC4, PBEwithSHA-1and40bitRC4, PBEwithSHA-1and3-keyDESEDE-CBC, PBEwithSHA-1and2-keyDESEDE-CBC, PBEwithSHA-1and128bitRC2-CBC, PBEwithSHA-1and40bitRC2-CBC, PBEwithHmacSHA-1, PBEwithHmacSHA-224, PBEwithHmacSHA-256, PBEwithHmacRIPEMD128, PBEwithHmacRIPEMD160, and PBEwithHmacRIPEMD256. ■Signature algorithms supported by SignerUtilities: MD2withRSA, MD4withRSA, MD5withRSA, RIPEMD128withRSA, RIPEMD160withRSA, RIPEMD256withRSA, SHA-1withRSA, SHA-224withRSA, SHA-256withRSAandMGF1, SHA-384withRSAandMGF1, SHA-512withRSAandMGF1, SHA-1withDSA, and SHA-1withECDSA. ■Symmetric key algorithms: AES, Blowfish, Camellia, CAST5, CAST6, DESede, DES, GOST28147, HC-128, HC-256, IDEA, NaccacheStern, RC2, RC4, RC5-32, RC5-64, RC6, Rijndael, Serpent, Skipjack, TEA/XTEA, Twofish, and VMPC. ■Symmetric key modes: CBC, CFB, CTS, GOFB, OFB, OpenPGPCFB, and SIC (or CTR). ■Symmetric key paddings: ISO10126d2, ISO7816d4, PKCS#5/7, TBC, X.923, and Zero Byte. ■Asymmetric key algorithms: RSA (with blinding), ElGamal, DSA, ECDSA. ■Asymmetric key paddings/encodings: ISO9796d1, OAEP, and PKCS#1. ■Digests: GOST3411, MD2, MD4, MD5, RIPEMD128, RIPEMD160, RIPEMD256, RIPEMD320, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, Tiger, and Whirlpool. ■Signer mechanisms: DSA, ECDSA, ECGOST3410, GOST3410, ISO9796d2, PSS, RSA. ■Key Agreement: Diffie-Hellman and EC-DH. ■Macs: CBCBlockCipher, CFBBlockCipher, GOST28147, HMac, and ISO9797 Alg. 3. ■PBE generators: PKCS#12, and PKCS#5 - schemes 1 and 2. ■OpenPGP (RFC 4880) ■Cryptographic Message Syntax (CMS, RFC 3852), including streaming API. ■Online Certificate Status Protocol (OCSP, RFC 2560). ■Time Stamp Protocol (TSP, RFC 3161). ■TLS/SSL Client with support for client side authentication.
2025-11-18 10:18:21.232 INFO 29456 --- [main] org.eclipse.jetty.util.ssl.SslContextFactory.processIncludeCipherSuites (SslContextFactory.java:1434) : No Cipher matching 'TLS_SM2_WITH_SM4_SM3' is supported 2025-11-18 10:18:21.232 INFO 29456 --- [main] org.eclipse.jetty.util.ssl.SslContextFactory.processIncludeCipherSuites (SslContextFactory.java:1434) : No Cipher matching 'TLS_ECDHE_SM2_WITH_SM4_SM3' is supported 2025-11-18 10:18:23.003 WARN 29456 --- [main] org.eclipse.jetty.util.ssl.SslContextFactory.selectCipherSuites (SslContextFactory.java:1405) : No supported ciphers from [TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] 还有有问题。 给的例子是不是有问题。 能给出完整一点的么,严谨一点
最新发布
11-19
<think> 我们面临的核心问题是:在JDK8环境下,由于默认不支持国密算法,导致Spring Boot内嵌的Jetty无法使用国密加密套件(如TLS_SM2_WITH_SM4_SM3)。解决思路如下: 1. 引入Bouncy Castle国密支持库,并注册为安全提供器。 2. 加载国密证书(通常需要转换为PKCS12格式)。 3. 在Jetty的SSL配置中强制指定国密加密套件,排除非国密套件。 根据用户引用[1][2][3]的内容,我们使用Bouncy Castle库来实现国密算法的支持。 完整代码示例: 步骤1:引入依赖(pom.xml) 步骤2:在应用启动类中注册Bouncy Castle提供器 步骤3:配置application.properties(或yml)中的SSL属性 步骤4:自定义Jetty的SSL配置,指定国密加密套件 详细代码: </think> ### 解决 Jetty 国密加密套件不支持问题的完整方案 在 JDK8 + Spring Boot + Jetty 环境下启用国密加密套件(`TLS_SM2_WITH_SM4_SM3` `TLS_ECDHE_SM2_WITH_SM4_SM3`)需突破 JDK 默认限制,以下是严谨代码实现: --- #### 一、依赖配置(`pom.xml`) ```xml <dependencies> <!-- Spring Boot + Jetty --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> <exclusions> <exclusion> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-tomcat</artifactId> </exclusion> </exclusions> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-jetty</artifactId> </dependency> <!-- 国密算法支持库 --> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk15on</artifactId> <version>1.70</version> </dependency> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-jdk15on</artifactId> <version>1.70</version> </dependency> </dependencies> ``` --- #### 二、主类注册国密提供器 ```java import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import java.security.Security; @SpringBootApplication public class Application { static { // 优先注册国密提供器(必须在所有安全操作前执行) Security.insertProviderAt(new BouncyCastleProvider(), 1); } public static void main(String[] args) { SpringApplication.run(Application.class, args); } } ``` --- #### 三、强制启用国密套件的 Jetty 配置 ```java import org.eclipse.jetty.server.*; import org.eclipse.jetty.util.ssl.SslContextFactory; import org.springframework.boot.web.embedded.jetty.JettyServerCustomizer; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @Configuration public class JettySSLConfig { @Bean public JettyServerCustomizer jettySSLConfigurer() { return server -> { for (Connector connector : server.getConnectors()) { if (connector instanceof ServerConnector) { ConnectionFactory factory = ((ServerConnector) connector) .getConnectionFactory("ssl"); if (factory instanceof SslConnectionFactory) { SslContextFactory ssl = ((SslConnectionFactory) factory) .getSslContextFactory(); // 强制指定国密套件(修复不支持问题) ssl.setIncludeCipherSuites( "TLS_SM2_WITH_SM4_SM3", "TLS_ECDHE_SM2_WITH_SM4_SM3" ); // 排除非国密套件 ssl.setExcludeCipherSuites(".*"); // 启用国密算法协议 ssl.setProtocol("TLSv1.2"); } } } }; } } ``` --- #### 四、国密证书配置(`application.properties`) ```properties # HTTPS 基础配置 server.port=8443 server.ssl.enabled=true server.ssl.protocol=TLSv1.2 # 国密证书路径 (PKCS12格式) server.ssl.key-store-type=PKCS12 server.ssl.key-store=classpath:sm2.p12 server.ssl.key-store-password=your_password server.ssl.key-alias=sm2-key # 强制使用国密提供器 server.ssl.provider=BC ``` --- #### 五、验证国密套件生效 ```java import org.eclipse.jetty.server.Server; import org.eclipse.jetty.util.ssl.SslContextFactory; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.CommandLineRunner; import org.springframework.stereotype.Component; @Component public class CipherChecker implements CommandLineRunner { @Autowired private Server jettyServer; @Override public void run(String... args) { for (Connector connector : jettyServer.getConnectors()) { if (connector instanceof ServerConnector) { SslConnectionFactory sslFactory = (SslConnectionFactory) ((ServerConnector) connector).getConnectionFactory("ssl"); SslContextFactory ssl = sslFactory.getSslContextFactory(); // 打印生效的国密套件 System.out.println("激活的国密套件: " + String.join(", ", ssl.getSelectedCipherSuites())); } } } } ``` **预期输出**: ``` 激活的国密套件: TLS_SM2_WITH_SM4_SM3, TLS_ECDHE_SM2_WITH_SM4_SM3 ``` --- ### 关键问题解决原理 1. **JDK8 限制突破** 通过 `Security.insertProviderAt(new BouncyCastleProvider(), 1)` 将国密提供器设为最高优先级,覆盖 JDK 默认实现[^2]。 2. **套件不支持问题修复** `setExcludeCipherSuites(".*")` 清空默认套件后,`setIncludeCipherSuites()` 强制启用国密套件。 3. **证书加载兼容性** `server.ssl.provider=BC` 声明使用 Bouncy Castle 加载 PKCS12 格式的国密证书。 4. **协议版本控制** 显式设置 `TLSv1.2` 协议(国密算法兼容版本)。 > 测试建议:使用 [gmssl](https://github.com/guanzhi/GmSSL) 工具验证服务: > ```bash > gmssl s_client -connect localhost:8443 -cipher "ECDHE-SM2-WITH-SM4-SM3" > ```
评论 1
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值