RSA加密-防止自增id被遍历

最新推荐文章于 2024-05-12 21:02:09 发布

魔镜前的帅比

最新推荐文章于 2024-05-12 21:02:09 发布

阅读量1.6k

点赞数 2

分类专栏：小工具 Java 文章标签：安全 rsa json

本文链接：https://blog.youkuaiyun.com/qq_38895905/article/details/122084967

版权

Java 同时被 2 个专栏收录

25 篇文章

订阅专栏

小工具

8 篇文章

订阅专栏

文章目录

- 非对称加密

非对称加密

非对称加密需要两个密钥：公钥 (publickey) 和私钥 (privatekey)。公钥和私钥是一对，如果用公钥对数据加密，那么只能用对应的私钥解密。如果用私钥对数据加密，只能用对应的公钥进行解密。因为加密和解密用的是不同的密钥，所以称为非对称加密。

优点：

安全

缺点：

加密和解密花费时间长、速度慢,只适合对少量数据进行加密

RSA 算法

RSA算法是一种典型的非对称加密的算法

具体信息安利一篇博客
https://blog.youkuaiyun.com/u014294681/article/details/86705999

demo

import javax.crypto.Cipher;
import java.security.*;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.HashMap;
import java.util.Map;

import static com.ijpay.jdpay.util.RsaUtil.decryptBASE64;
import static com.ijpay.jdpay.util.RsaUtil.encryptBASE64;

/**
 * @Date 2021/12/21 10:02
 */
public class RSASecurityUtils {

    public static final String KEY_ALGORITHM = "RSA";

    public static final String SIGNATURE_ALGORITHM = "MD5withRSA";



    private static final String PUBLIC_KEY = "RSAPublicKey";

    private static final String PRIVATE_KEY = "RSAPrivateKey";

    /**
     * 用私钥对信息生成数字签名
     *
     * @param data
     *            加密数据
     * @param privateKey
     *            私钥
     *
     * @return
     * @throws Exception
     */public static String sign(byte[] data, String privateKey) throws Exception {

        // 解密由base64编码的私钥
        byte[] keyBytes = decryptBASE64(privateKey);
        // 构造PKCS8EncodedKeySpec对象
        PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);
        // KEY_ALGORITHM 指定的加密算法
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        // 取私钥匙对象
        PrivateKey priKey = keyFactory.generatePrivate(pkcs8KeySpec);
        // 用私钥对信息生成数字签名
        Signature signature = Signature.getInstance(SIGNATURE_ALGORITHM);
        signature.initSign(priKey);
        signature.update(data);
        return encryptBASE64(signature.sign());
    }



    /**
     * 校验数字签名
     *
     * @param data
     *            加密数据
     * @param publicKey
     *
     * @param sign
     *            数字签名
     *
     * @return 校验成功返回true 失败返回false
     * @throws Exception
     *
     */
    public static boolean verify(byte[] data, String publicKey, String sign) throws Exception {
        // 解密由base64编码的公钥
        byte[] keyBytes = decryptBASE64(publicKey);
        // 构造X509EncodedKeySpec对象
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);
        // KEY_ALGORITHM 指定的加密算法
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        // 取公钥匙对象
        PublicKey pubKey = keyFactory.generatePublic(keySpec);
        Signature signature = Signature.getInstance(SIGNATURE_ALGORITHM);
        signature.initVerify(pubKey);
        signature.update(data);
        // 验证签名是否正常
        return signature.verify(decryptBASE64(sign));
    }



    /**
     * 解密<br>
     * 用私钥解密
     *
     * @param data
     * @param key
     * @return
     * @throws Exception
     */
    public static byte[] decryptByPrivateKey(byte[] data, String key) throws Exception {
        // 对密钥解密
        byte[] keyBytes = decryptBASE64(key);
        // 取得私钥
        PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        Key privateKey = keyFactory.generatePrivate(pkcs8KeySpec);
        // 对数据解密
        Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());
        cipher.init(Cipher.DECRYPT_MODE, privateKey);
        return cipher.doFinal(data);

    }



    /**
     * 解密<br>
     * 用私钥解密
     *
     * @param data
     * @param key
     * @return
     * @throws Exception
     */
    public static byte[] decryptByPublicKey(byte[] data, String key) throws Exception {
        // 对密钥解密
        byte[] keyBytes = decryptBASE64(key);
        // 取得公钥
        X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(keyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        Key publicKey = keyFactory.generatePublic(x509KeySpec);
        // 对数据解密
        Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());
        cipher.init(Cipher.DECRYPT_MODE, publicKey);
        return cipher.doFinal(data);
    }

    /**
     * 加密<br>
     * 用公钥加密
     *
     * @param data
     * @param key
     * @return
     * @throws Exception
     */
    public static byte[] encryptByPublicKey(byte[] data, String key) throws Exception {
        // 对公钥解密
        byte[] keyBytes = decryptBASE64(key);
        // 取得公钥
        X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(keyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        Key publicKey = keyFactory.generatePublic(x509KeySpec);
        // 对数据加密
        Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());
        cipher.init(Cipher.ENCRYPT_MODE, publicKey);
        return cipher.doFinal(data);
    }



    /**
     * 加密<br>
     * 用私钥加密
     *
     * @param data
     * @param key
     * @return
     * @throws Exception
     */
    public static byte[] encryptByPrivateKey(byte[] data, String key) throws Exception {
        // 对密钥解密
        byte[] keyBytes = decryptBASE64(key);
        // 取得私钥
        PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        Key privateKey = keyFactory.generatePrivate(pkcs8KeySpec);
        // 对数据加密
        Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());
        cipher.init(Cipher.ENCRYPT_MODE, privateKey);
        return cipher.doFinal(data);
    }

    /**
     * 取得私钥
     *
     * @param keyMap
     * @return
     * @throws Exception
     */
    public static String getPrivateKey(Map<String, Object> keyMap) throws Exception {
        Key key = (Key) keyMap.get(PRIVATE_KEY);
        return encryptBASE64(key.getEncoded());
    }

    /*
     * 取得公钥
     *
     * @param keyMap
     * @return
     * @throws Exception
     */
    public static String getPublicKey(Map<String, Object> keyMap) throws Exception {
        Key key = (Key) keyMap.get(PUBLIC_KEY);
        return encryptBASE64(key.getEncoded());

    }



    /**

     * 初始化密钥

     *

     * @return

     * @throws Exception

     */

    public static Map<String, Object> initKey() throws Exception {

        KeyPairGenerator keyPairGen = KeyPairGenerator
                .getInstance(KEY_ALGORITHM);
        keyPairGen.initialize(1024);
        KeyPair keyPair = keyPairGen.generateKeyPair();
        // 公钥
        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
        // 私钥
        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
        Map<String, Object> keyMap = new HashMap<String, Object>(2);
        keyMap.put(PUBLIC_KEY, publicKey);
        keyMap.put(PRIVATE_KEY, privateKey);
        return keyMap;
    }
}

可以通过initKey 方法生成公钥私钥

@Getter
@Setter
@AllArgsConstructor
public class RSATestResponseId {

   @JsonSerialize(using = RSAIdJsonSerializer.class)
   private String id;
}

RSAIdJsonSerializer 是我们自定义的序列化后操作。

加密demo

public class RSAIdJsonSerializer extends JsonSerializer<String>{

  private String PublicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8+IWR+oDKnHTiblS9RPoNRy5fENdBRAolQkx5sd00Bx3Oj8b/7napSN410mmM9yib6aFqEM8F34B06F7WkhIXQ4liL7eFD7lc8zSk3f9HoVb2K4OjC+j/cHr6YhvZ24l6xS+Dz54d5EuH8X1/zNPmTEexNJbRFjuX8EAyj0Rj2QIDAQAB";

  @SneakyThrows
  @Override
  public void serialize(String s, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException {
      byte[] encodedData = RSASecurityUtils.encryptByPublicKey(s.getBytes(), PublicKey);
      jsonGenerator.writeNumber(new String(encodedData));
  }
}

入口

此时，返回值的自增id就可以被加密，防止被遍历。
demo：

    @PostMapping("/list")
    public List<RSATestResponseId> testListBack(){
        final List<RSATestResponseId> rSATestResponseIds = new ArrayList<>();
        final RSATestResponseId rsaTestResponseId1 = new RSATestResponseId("1");
        rSATestResponseIds.add(rsaTestResponseId1);
        return rSATestResponseIds;
    }

postman请求的结果为：

在这里插入图片描述
可以看到，一个简单的id就被加密完成了，可以有效防止外部遍历

解密demo

@Getter
@Setter
public class RSATestRequestId {
    @JsonDeserialize(using = RSAIdJsonDeserializer.class)
    private String id;
}

public class RSAIdJsonDeserializer extends JsonDeserializer<String> {

    private String privateKey = "MIICdAIBADANBgkqhkiG9w0BAQEFAASCAl4wggJaAgEAAoGBALz4hZH6gMqcdOJuVL1E+g1HLl8Q10FECiVCTHmx3TQHHc6Pxv/udqlI3jXSaYz3KJvpoWoQzwXfgHToXtaSEhdDiWIvt4UPuVzzNKTd/0ehVvYrg6ML6P9wevpiG9nbiXrFL4PPnh3kS4fxfX/M0+ZMR7E0ltEWO5fwQDKPRGPZAgMBAAECfxMxKl+pEWuCeFyG2BRg7QRsNklxbGs0fdNK6HlzlwOxtVVFRPC5R1PqEqdkt1OZxoYPNFWRX3U5PdKhxwAD1dJaFlOpd51kScQ7vGK1ggG0a19gw0K7lbGCtJmmtnFlzi8sBEYx2CCxumhym/zXHAQPZeOQkgMJZCUrYo1/IgECQQD1rInJzX7dNdi8c7yXY1KR4dtIdBYY5Vn8OOldPexgawkFIqA+sP7JCDQl5pV4qBtlKg34XHQi8c7GbRBr0IdhAkEAxOna3hiHle5EAJNtvc/80C9rpqbM/mHpcFSrC6HsZPstDNdD8ji3V8JSEFeNSV5wnh4jmirW+Sp0365763jHeQJBAJglSZQT0syWi2pyVsp+tWUpNc+SLRkv+OGOMWAQeHJh900Z25nXrYK8tOb//XOi0Ix/VfWI9Fer3z3dz3ylwSECQH96EWn0oVoLvNROnR3jlvxDpsJle5I3WsOQ3IaUVhBtlxWYCnG2C+NxdmUD+QCFdgy24D9++lqmBLGGKM0hDKkCQCWc4I97xUVEIt1TQjXOPFCMG/7CUXhC/KsbGuh39npTKI39sKex4OPG1NeML7MSSBcYA3nW5I9uHJ7aD7+BAFs=";

    @SneakyThrows
    @Override
    public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException, JsonProcessingException {
        byte[]  encodedData = p.getValueAsString().getBytes();

        byte[] decodedData = RSASecurityUtils.decryptByPrivateKey(encodedData,
                privateKey);
        //解密
        return new String(decodedData);
    }
}

虽然可以避免自增id被遍历，但是完全没用必要使用这边介绍的方法。这边只是介绍一种可能性。此处公钥私钥都在后端没有暴露，甚至于直接用对称加密就行。