目錄
一、對(duì)稱(chēng)加密
?1、對(duì)稱(chēng)加密是什么
?2、對(duì)稱(chēng)加密的優(yōu)點(diǎn)
?3、對(duì)稱(chēng)加密的問(wèn)題
?4、對(duì)稱(chēng)加密的應(yīng)用場(chǎng)景
?5、對(duì)稱(chēng)加密AES的代碼
二、非對(duì)稱(chēng)加密
?1、非對(duì)稱(chēng)加密是什么
?2、非對(duì)稱(chēng)加密的優(yōu)點(diǎn)
?3、非對(duì)稱(chēng)加密的問(wèn)題
?4、非對(duì)稱(chēng)加密的應(yīng)用場(chǎng)景
?5、非對(duì)稱(chēng)加密RSA的代碼
一、對(duì)稱(chēng)加密
1、對(duì)稱(chēng)加密是什么
對(duì)稱(chēng)加密是指加密和解密用的是同一個(gè)密鑰的加密方式。
2、對(duì)稱(chēng)加密的優(yōu)點(diǎn)
對(duì)稱(chēng)加密的特點(diǎn)是加密計(jì)算量小、速度快。
3、對(duì)稱(chēng)加密的問(wèn)題
對(duì)稱(chēng)加密的問(wèn)題是密鑰傳輸問(wèn)題，因?yàn)閷?duì)稱(chēng)加密的做法一般是解密方生成密鑰傳輸給加密方，加密方對(duì)明文加密，然后把密文發(fā)送給解密方，解密方使用密鑰對(duì)密文解密，得到明文，而密鑰在傳輸過(guò)程中很可能被攻擊者截獲，因此對(duì)稱(chēng)加密的安全性就不僅僅取決于加密算法本身的強(qiáng)度，更取決于密鑰是否被安全地傳輸。
4、對(duì)稱(chēng)加密的應(yīng)用場(chǎng)景
對(duì)稱(chēng)加密適用于對(duì)大量數(shù)據(jù)進(jìn)行加密的場(chǎng)景。
5、對(duì)稱(chēng)加密AES的代碼
AES（Advanced Encryption Standard），高級(jí)加密標(biāo)準(zhǔn)，是對(duì)稱(chēng)加密的一種，用來(lái)代替DES、3DES。AES采用分組密碼體制，密鑰長(zhǎng)度可以是128位16個(gè)字節(jié)、192位或256位，一共有四種加密模式。
分組密碼體制：所謂分組密碼體制是指AES會(huì)首先把明文切成一段一段的，每段的長(zhǎng)度必須是128位16個(gè)字節(jié)，如果最后一段不夠16個(gè)字節(jié)了，就要用Padding來(lái)把這段數(shù)據(jù)填滿(mǎn)16個(gè)字節(jié)，然后分別對(duì)每段數(shù)據(jù)進(jìn)行加密，最后再把每段加密數(shù)據(jù)拼接起來(lái)形成最終的密文。而Padding也有三種模式PKCS5、PKCS7和NOPADDING，PKCS5和PKCS7是指分組數(shù)據(jù)缺少幾個(gè)字節(jié)，就在數(shù)據(jù)的末尾填充幾個(gè)字節(jié)的幾，比如缺少5個(gè)字節(jié)，就在末尾填充5個(gè)字節(jié)的5；NoPadding是指不需要填充，也就是說(shuō)數(shù)據(jù)的發(fā)送方肯定會(huì)保證最后一段數(shù)據(jù)也正好是16個(gè)字節(jié)。那如果在PKCS5模式下，最后一段數(shù)據(jù)的內(nèi)容剛好就是16個(gè)16怎么辦？那解密端就不知道這一段數(shù)據(jù)到底是有效數(shù)據(jù)還是填充數(shù)據(jù)了，因此對(duì)于這種情況，PKCS5模式會(huì)自動(dòng)幫我們?cè)谧詈笠欢螖?shù)據(jù)后再添加16個(gè)字節(jié)的數(shù)據(jù)，而且填充數(shù)據(jù)也是16個(gè)16，這樣解密段就能知道誰(shuí)是有效數(shù)據(jù)誰(shuí)是填充數(shù)據(jù)了。解密方需要使用和加密方同樣的Padding模式，才能準(zhǔn)確的識(shí)別有效數(shù)據(jù)和填充數(shù)據(jù)，我們開(kāi)發(fā)通常采用PKCS7 Padding模式。
密鑰：AES要求密鑰長(zhǎng)度可以是128位16個(gè)字節(jié)、192位或者256位，位數(shù)越高，加密強(qiáng)度自然越大，但是加密的效率自然會(huì)低一些。我們開(kāi)發(fā)通常采用128位16個(gè)字節(jié)的密鑰，密鑰來(lái)源為服務(wù)端隨機(jī)生成、然后發(fā)送給客戶(hù)端，解密方需要使用和加密方同樣的密鑰。
加密模式：AES一共有四種加密模式，分別是ECB（電子密碼本模式）、CBC（密碼分組鏈接模式）、CFB、OFB，我們通常采用CBC加密模式，解密方需要使用和加密方同樣的加密模式。
ECB模式：最基本的加密模式，即僅僅使用明文和密鑰來(lái)加密數(shù)據(jù)，相同的明文塊會(huì)被加密成相同的密文塊，這樣明文和密文的結(jié)構(gòu)將是完全一樣的，就會(huì)更容易被破解，相對(duì)來(lái)說(shuō)不是那么安全，因此很少使用。
CBC模式：比ECB模式多了一個(gè)初始向量IV，加密的時(shí)候，第一個(gè)明文塊會(huì)首先和初始向量IV做異或操作，然后再經(jīng)過(guò)密鑰加密，然后第一個(gè)密文塊又會(huì)作為第二個(gè)明文塊的加密向量來(lái)異或，依次類(lèi)推下去，這樣相同的明文塊加密出的密文塊就是不同的，明文的結(jié)構(gòu)和密文的結(jié)構(gòu)也將是不同的，因此更加安全，我們常用的就是CBC加密模式。
//
// EncryptUtil.h
//
#import <Foundation/Foundation.h>
@interface EncryptUtil : NSObject
/**
* AES128加密，輸出Base64編碼
*
* @param plainText 明文
* @param secretKey 密鑰
*
* @return 密文
*/
+ (NSString *)aes128CiphertextFromString:(NSString *)plainText secretKey:(NSString *)secretKey iv:(NSString *)iv;
/**
* AES128解密，輸入Base64編碼
*
* @param ciphertext 密文
* @param secretKey 密鑰
*
* @return 明文
*/
+ (NSString *)aes128PlainTextFromString:(NSString *)ciphertext secretKey:(NSString *)secretKey iv:(NSString *)iv;
@end
//
// EncryptUtil.m
//
#import "EncryptUtil.h"
#import <CommonCrypto/CommonCryptor.h>
@implementation EncryptUtil
+ (NSString *)aes128CiphertextFromString:(NSString *)plainText secretKey:(NSString *)secretKey {
char keyPtr[kCCKeySizeAES128 + 1];
memset(keyPtr, 0, sizeof(keyPtr));
[secretKey getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];
NSData *data = [plainText dataUsingEncoding:NSUTF8StringEncoding];
NSUInteger dataLength = [data length];
int diff = kCCKeySizeAES128 - (dataLength % kCCKeySizeAES128);
NSUInteger newSize = 0;
if(diff > 0) {
newSize = dataLength + diff;
}
char dataPtr[newSize];
memcpy(dataPtr, [data bytes], [data length]);
for(int i = 0; i < diff; i ++) {
dataPtr[i + dataLength] = 0x00;
}
size_t bufferSize = newSize + kCCBlockSizeAES128;
void *buffer = malloc(bufferSize);
memset(buffer, 0, bufferSize);
size_t numBytesCrypted = 0;
CCCryptorStatus cryptStatus = CCCrypt(kCCEncrypt, // 加密
kCCAlgorithmAES128, // AES128加密
kCCOptionPKCS7Padding, // PKCS7 Padding模式，默認(rèn)CBC加密模式
keyPtr, // 密鑰
kCCKeySizeAES128, // 密鑰長(zhǎng)度
NULL, // 初始向量
dataPtr,
sizeof(dataPtr),
buffer,
bufferSize,
&numBytesCrypted);
if (cryptStatus == kCCSuccess) {
NSData *resultData = [NSData dataWithBytesNoCopy:buffer length:numBytesCrypted];
// 轉(zhuǎn)換成Base64并返回
return [resultData base64EncodedStringWithOptions:NSDataBase64EncodingEndLineWithLineFeed];
}
free(buffer);
return nil;
}
+ (NSString *)aes128PlainTextFromString:(NSString *)ciphertext secretKey:(NSString *)secretKey {
char keyPtr[kCCKeySizeAES128 + 1];
memset(keyPtr, 0, sizeof(keyPtr));
[secretKey getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];
NSData *data = [[NSData alloc] initWithBase64EncodedData:[ciphertext dataUsingEncoding:NSUTF8StringEncoding] options:NSDataBase64DecodingIgnoreUnknownCharacters];
NSUInteger dataLength = [data length];
size_t bufferSize = dataLength + kCCBlockSizeAES128;
void *buffer = malloc(bufferSize);
size_t numBytesCrypted = 0;
CCCryptorStatus cryptStatus = CCCrypt(kCCDecrypt, // 解密
kCCAlgorithmAES128,
kCCOptionPKCS7Padding,
keyPtr,
kCCBlockSizeAES128,
NULL,
[data bytes],
dataLength,
buffer,
bufferSize,
&numBytesCrypted);
if (cryptStatus == kCCSuccess) {
NSData *resultData = [NSData dataWithBytesNoCopy:buffer length:numBytesCrypted];
// 轉(zhuǎn)換成普通字符串并返回
return [[NSString alloc] initWithData:resultData encoding:NSUTF8StringEncoding];
}
free(buffer);
return nil;
}
@end
二、非對(duì)稱(chēng)加密
1、非對(duì)稱(chēng)加密是什么
非對(duì)稱(chēng)加密是指加密和解密用的不是同一個(gè)密鑰的加密方式。
2、非對(duì)稱(chēng)加密的優(yōu)點(diǎn)
非對(duì)稱(chēng)加密的特點(diǎn)是不存在密鑰傳輸問(wèn)題，因?yàn)榉菍?duì)稱(chēng)加密的做法一般是解密方生成一對(duì)兒公私鑰，自己保留私鑰，把公鑰公開(kāi)，加密方拿到公鑰對(duì)明文加密，然后把密文發(fā)送給解密方，解密方使用私鑰對(duì)密文解密，得到明文，所以公鑰是隨便你什么人來(lái)拿都行、反正也是用來(lái)加密的、又不是用來(lái)解密的——即就算被截獲了也不怕，只要保管好私鑰就可以了。
3、非對(duì)稱(chēng)加密的問(wèn)題
非對(duì)稱(chēng)加密的問(wèn)題是加密計(jì)算量大、速度慢。
4、非對(duì)稱(chēng)加密的應(yīng)用場(chǎng)景
非對(duì)稱(chēng)加密適用于對(duì)少量數(shù)據(jù)進(jìn)行加密的場(chǎng)景。
5、非對(duì)稱(chēng)加密RSA的代碼
RSA加密是非對(duì)稱(chēng)加密的一種，密鑰長(zhǎng)度一般是1024位或2048位。iOS中使用RSA加密解密，需要用到.der文件和.p12文件。其中.der文件存放的是公鑰、用于加密，.p12文件存放的是私鑰、用于解密。首先我們需要生成這些必要的文件（openssl是SSL/TLS協(xié)議的開(kāi)源實(shí)現(xiàn)，可以用來(lái)生成公鑰私鑰、自簽名證書(shū)等）：
// 1、指定文件的存儲(chǔ)路徑
打開(kāi)終端，cd一個(gè)文件夾
// 2、生成模長(zhǎng)為1024位的私鑰文件private_key.pem
openssl genrsa -out private_key.pem 1024
// 3、生成證書(shū)請(qǐng)求文件rsaCertReq.csr
// 注意：這一步會(huì)提示輸入國(guó)家、省份、郵箱等信息，可以根據(jù)實(shí)際情況選擇性填寫(xiě)
openssl req -new -key private_key.pem -out rsaCerReq.csr
// 4、生成證書(shū)rsaCert.crt，并設(shè)置有效時(shí)間為10年
openssl x509 -req -days 3650 -in rsaCerReq.csr -signkey private_key.pem -out rsaCert.crt
// 5、生成供iOS使用的公鑰文件public_key.der
openssl x509 -outform der -in rsaCert.crt -out public_key.der
// 6、生成供iOS使用的私鑰文件private_key.p12
// 注意：這一步會(huì)提示給私鑰文件設(shè)置密碼，保存下來(lái)。iOS代碼里在解密時(shí)，private_key.p12文件需要和這里設(shè)置的密碼配合使用
openssl pkcs12 -export -out private_key.p12 -inkey private_key.pem -in rsaCert.crt
// 7、生成供Java使用的公鑰rsa_public_key.pem
openssl rsa -in private_key.pem -out rsa_public_key.pem -pubout
// 8、生成供Java使用的私鑰pkcs8_private_key.pem
openssl pkcs8 -topk8 -in private_key.pem -out pkcs8_private_key.pem -nocrypt
// 9、使用文件
這時(shí)到指定的文件夾下就可以看到七個(gè)文件，
其中public_key.der和private_key.p12這對(duì)兒公私鑰是供iOS使用的，拖到項(xiàng)目里，
rsa_public_key.pem和pkcs8_private_key.pem這對(duì)兒公私鑰是供Java使用的，發(fā)給他們
它們的根源都來(lái)自一個(gè)私鑰private_key.pem，所以iOS端加密的數(shù)據(jù)后臺(tái)可以解密，反過(guò)來(lái)同理。
//
// WYRSAEncryptTools.h
// WYEncryptDemo
//
// Created by Mac mini on 16/8/23.
// Copyright ? 2016年 yiyi. All rights reserved.
//
#import <Foundation/Foundation.h>
@interface WYRSAEncryptTools : NSObject
// 當(dāng)我們使用 openssl 生成公鑰和私鑰之后, 把我們前端需要持有那對(duì)文件拖進(jìn)工程里, 然后使用這個(gè)工具類(lèi)里的幾個(gè)方法操作起來(lái)就 ok 了
#pragma mark - 加載公鑰和私鑰
/**
* 加載公鑰
*
* @param string 公鑰文件路徑
*/
+ (void)loadPublicKeyWithFilePathString:(NSString *)string;
/**
* 加載私鑰
*
* @param string 私鑰文件路徑
* @param string 創(chuàng)建私鑰時(shí)的密碼
*/
+ (void)loadPrivateKeyWithFilePathString:(NSString *)string
password:(NSString*)password;
#pragma mark - 公鑰加密
/**
* 用來(lái)加密字符串
*
* @param string 明文
*
* return 密文, base64 碼
*/
+ (NSString *)rsaEncryptSourceString:(NSString *)string;
/**
* 用來(lái)加密二進(jìn)制數(shù)據(jù)
*
* @param string 明文
*
* return 密文
*/
+ (NSData *)rsaEncryptSourceData:(NSData *)data;
#pragma mark - 私鑰解密
/**
* 用來(lái)解密字符串密文
*
* @param string 密文
*
* return 明文
*/
+ (NSString *)rsaDecryptDecryptString:(NSString *)string;
/**
* 用來(lái)解密二進(jìn)制數(shù)據(jù)密文
*
* @param data 密文
*
* return 明文
*/
+ (NSData *)rsaDecryptDecryptData:(NSData *)data;
@end
//
// WYRSAEncryptTools.m
// WYEncryptDemo
//
// Created by Mac mini on 16/8/23.
// Copyright ? 2016年 yiyi. All rights reserved.
//
#import "WYRSAEncryptTools.h"
#import <Security/Security.h>
static SecKeyRef publicKeyRef = nil;
static SecKeyRef privateKeyRef = nil;
@implementation WYRSAEncryptTools
+ (void)loadPublicKeyWithFilePathString:(NSString *)string {
NSData *derData = [[NSData alloc] initWithContentsOfFile:string];
[WYRSAEncryptTools getPublicKeyRefrenceFromeData:derData];
}
+ (void)loadPrivateKeyWithFilePathString:(NSString *)string
password:(NSString*)password {
NSData *p12Data = [NSData dataWithContentsOfFile:string];
[WYRSAEncryptTools getPrivateKeyRefrenceFromData:p12Data password:password];
}
+ (NSString *)rsaEncryptSourceString:(NSString *)string {
NSData *data = [WYRSAEncryptTools rsaEncryptSourceData:[string dataUsingEncoding:NSUTF8StringEncoding]];
NSString *encryptString = base64_encode_data(data);
return encryptString;
}
+ (NSData *)rsaEncryptSourceData:(NSData *)data {
if (!data){
return nil;
}
if (!publicKeyRef) {
return nil;
}
return [WYRSAEncryptTools encryptData:data withKeyRef:publicKeyRef];
}
+ (NSString *)rsaDecryptDecryptString:(NSString *)string {
NSData *data = [[NSData alloc] initWithBase64EncodedString:string options:NSDataBase64DecodingIgnoreUnknownCharacters];
data = [WYRSAEncryptTools rsaDecryptDecryptData:data];
NSString *decryptString = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
return decryptString;
}
+ (NSData *)rsaDecryptDecryptData:(NSData *)data {
if (!data){
return nil;
}
if (!privateKeyRef) {
return nil;
}
return [WYRSAEncryptTools decryptData:data withKeyRef:privateKeyRef];
}
+ (NSString *)rsaVerifyDecryptString:(NSString *)string {
NSData *data = [[NSData alloc] initWithBase64EncodedString:string options:NSDataBase64DecodingIgnoreUnknownCharacters];
data = [WYRSAEncryptTools rsaVerifyDecryptData:data];
NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
return ret;
}
+ (NSData *)rsaVerifyDecryptData:(NSData *)data {
if (!data) {
return nil;
}
if (!publicKeyRef) {
return nil;
}
return [WYRSAEncryptTools decryptData:data withKeyRef:publicKeyRef];
}
//static NSString *base64_encode(NSString *str){
// NSData* data = [str dataUsingEncoding:NSUTF8StringEncoding];
// if(!data){
// return nil;
// }
// return base64_encode_data(data);
//}
static NSString *base64_encode_data(NSData *data){
data = [data base64EncodedDataWithOptions:0];
NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
return ret;
}
static NSData *base64_decode(NSString *str){
NSData *data = [[NSData alloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters];
return data;
}
+ (NSData *)stripPublicKeyHeader:(NSData *)d_key{
// Skip ASN.1 public key header
if (d_key == nil) return(nil);
unsigned long len = [d_key length];
if (!len) return(nil);
unsigned char *c_key = (unsigned char *)[d_key bytes];
unsigned int idx = 0;
if (c_key[idx++] != 0x30) return(nil);
if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
else idx++;
// PKCS #1 rsaEncryption szOID_RSA_RSA
static unsigned char seqiod[] =
{ 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
0x01, 0x05, 0x00 };
if (memcmp(&c_key[idx], seqiod, 15)) return(nil);
idx += 15;
if (c_key[idx++] != 0x03) return(nil);
if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
else idx++;
if (c_key[idx++] != '\0') return(nil);
// Now make a new NSData from this buffer
return([NSData dataWithBytes:&c_key[idx] length:len - idx]);
}
//credit: http://hg.mozilla.org/services/fx-home/file/tip/Sources/NetworkAndStorage/CryptoUtils.m#l1036
+ (NSData *)stripPrivateKeyHeader:(NSData *)d_key{
// Skip ASN.1 private key header
if (d_key == nil) return(nil);
unsigned long len = [d_key length];
if (!len) return(nil);
unsigned char *c_key = (unsigned char *)[d_key bytes];
unsigned int idx = 22; //magic byte at offset 22
if (0x04 != c_key[idx++]) return nil;
//calculate length of the key
unsigned int c_len = c_key[idx++];
int det = c_len & 0x80;
if (!det) {
c_len = c_len & 0x7f;
} else {
int byteCount = c_len & 0x7f;
if (byteCount + idx > len) {
//rsa length field longer than buffer
return nil;
}
unsigned int accum = 0;
unsigned char *ptr = &c_key[idx];
idx += byteCount;
while (byteCount) {
accum = (accum << 8) + *ptr;
ptr++;
byteCount--;
}
c_len = accum;
}
// Now make a new NSData from this buffer
return [d_key subdataWithRange:NSMakeRange(idx, c_len)];
}
+ (SecKeyRef)addPublicKey:(NSString *)key{
NSRange spos = [key rangeOfString:@"-----BEGIN PUBLIC KEY-----"];
NSRange epos = [key rangeOfString:@"-----END PUBLIC KEY-----"];
if(spos.location != NSNotFound && epos.location != NSNotFound){
NSUInteger s = spos.location + spos.length;
NSUInteger e = epos.location;
NSRange range = NSMakeRange(s, e-s);
key = [key substringWithRange:range];
}
key = [key stringByReplacingOccurrencesOfString:@"\r" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@"\n" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@"\t" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@" " withString:@""];
// This will be base64 encoded, decode it.
NSData *data = base64_decode(key);
data = [WYRSAEncryptTools stripPublicKeyHeader:data];
if(!data){
return nil;
}
//a tag to read/write keychain storage
NSString *tag = @"WYRSAEncryptTools_PubKey";
NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];
// Delete any old lingering key with the same tag
NSMutableDictionary *publicKey = [[NSMutableDictionary alloc] init];
[publicKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
[publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
[publicKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
SecItemDelete((__bridge CFDictionaryRef)publicKey);
// Add persistent version of the key to system keychain
[publicKey setObject:data forKey:(__bridge id)kSecValueData];
[publicKey setObject:(__bridge id) kSecAttrKeyClassPublic forKey:(__bridge id)
kSecAttrKeyClass];
[publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)
kSecReturnPersistentRef];
CFTypeRef persistKey = nil;
OSStatus status = SecItemAdd((__bridge CFDictionaryRef)publicKey, &persistKey);
if (persistKey != nil){
CFRelease(persistKey);
}
if ((status != noErr) && (status != errSecDuplicateItem)) {
return nil;
}
[publicKey removeObjectForKey:(__bridge id)kSecValueData];
[publicKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
[publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
[publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
// Now fetch the SecKeyRef version of the key
SecKeyRef keyRef = nil;
status = SecItemCopyMatching((__bridge CFDictionaryRef)publicKey, (CFTypeRef *)&keyRef);
if(status != noErr){
return nil;
}
return keyRef;
}
+ (SecKeyRef)addPrivateKey:(NSString *)key{
NSRange spos = [key rangeOfString:@"-----BEGIN RSA PRIVATE KEY-----"];
NSRange epos = [key rangeOfString:@"-----END RSA PRIVATE KEY-----"];
if(spos.location != NSNotFound && epos.location != NSNotFound){
NSUInteger s = spos.location + spos.length;
NSUInteger e = epos.location;
NSRange range = NSMakeRange(s, e-s);
key = [key substringWithRange:range];
}
key = [key stringByReplacingOccurrencesOfString:@"\r" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@"\n" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@"\t" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@" " withString:@""];
// This will be base64 encoded, decode it.
NSData *data = base64_decode(key);
data = [WYRSAEncryptTools stripPrivateKeyHeader:data];
if(!data){
return nil;
}
//a tag to read/write keychain storage
NSString *tag = @"WYRSAEncryptTools_PrivKey";
NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];
// Delete any old lingering key with the same tag
NSMutableDictionary *privateKey = [[NSMutableDictionary alloc] init];
[privateKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
[privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
[privateKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
SecItemDelete((__bridge CFDictionaryRef)privateKey);
// Add persistent version of the key to system keychain
[privateKey setObject:data forKey:(__bridge id)kSecValueData];
[privateKey setObject:(__bridge id) kSecAttrKeyClassPrivate forKey:(__bridge id)
kSecAttrKeyClass];
[privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)
kSecReturnPersistentRef];
CFTypeRef persistKey = nil;
OSStatus status = SecItemAdd((__bridge CFDictionaryRef)privateKey, &persistKey);
if (persistKey != nil){
CFRelease(persistKey);
}
if ((status != noErr) && (status != errSecDuplicateItem)) {
return nil;
}
[privateKey removeObjectForKey:(__bridge id)kSecValueData];
[privateKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
[privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
[privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
// Now fetch the SecKeyRef version of the key
SecKeyRef keyRef = nil;
status = SecItemCopyMatching((__bridge CFDictionaryRef)privateKey, (CFTypeRef *)&keyRef);
if(status != noErr){
return nil;
}
return keyRef;
}
/* START: Encryption & Decryption with RSA private key */
+ (NSData *)encryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef{
const uint8_t *srcbuf = (const uint8_t *)[data bytes];
size_t srclen = (size_t)data.length;
size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
void *outbuf = malloc(block_size);
size_t src_block_size = block_size - 11;
NSMutableData *ret = [[NSMutableData alloc] init];
for(int idx=0; idx<srclen; idx+=src_block_size){
//NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
size_t data_len = srclen - idx;
if(data_len > src_block_size){
data_len = src_block_size;
}
size_t outlen = block_size;
OSStatus status = noErr;
status = SecKeyEncrypt(keyRef,
kSecPaddingPKCS1,
srcbuf + idx,
data_len,
outbuf,
&outlen
);
if (status != 0) {
NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
ret = nil;
break;
}else{
[ret appendBytes:outbuf length:outlen];
}
}
free(outbuf);
CFRelease(keyRef);
return ret;
}
+ (NSString *)encryptString:(NSString *)str privateKey:(NSString *)privKey{
NSData *data = [WYRSAEncryptTools encryptData:[str dataUsingEncoding:NSUTF8StringEncoding] privateKey:privKey];
NSString *ret = base64_encode_data(data);
return ret;
}
+ (NSData *)encryptData:(NSData *)data privateKey:(NSString *)privKey{
if(!data || !privKey){
return nil;
}
SecKeyRef keyRef = [WYRSAEncryptTools addPrivateKey:privKey];
if(!keyRef){
return nil;
}
return [WYRSAEncryptTools encryptData:data withKeyRef:keyRef];
}
+ (NSData *)decryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef{
const uint8_t *srcbuf = (const uint8_t *)[data bytes];
size_t srclen = (size_t)data.length;
size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
UInt8 *outbuf = malloc(block_size);
size_t src_block_size = block_size;
NSMutableData *ret = [[NSMutableData alloc] init];
for(int idx=0; idx<srclen; idx+=src_block_size){
//NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
size_t data_len = srclen - idx;
if(data_len > src_block_size){
data_len = src_block_size;
}
size_t outlen = block_size;
OSStatus status = noErr;
status = SecKeyDecrypt(keyRef,
kSecPaddingNone,
srcbuf + idx,
data_len,
outbuf,
&outlen
);
if (status != 0) {
NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
ret = nil;
break;
}else{
//the actual decrypted data is in the middle, locate it!
int idxFirstZero = -1;
int idxNextZero = (int)outlen;
for ( int i = 0; i < outlen; i++ ) {
if ( outbuf[i] == 0 ) {
if ( idxFirstZero < 0 ) {
idxFirstZero = I;
} else {
idxNextZero = I;
break;
}
}
}
[ret appendBytes:&outbuf[idxFirstZero+1] length:idxNextZero-idxFirstZero-1];
}
}
free(outbuf);
CFRelease(keyRef);
return ret;
}
+ (void)getPublicKeyRefrenceFromeData:(NSData*)derData {
SecCertificateRef myCertificate = SecCertificateCreateWithData(kCFAllocatorDefault, (__bridge CFDataRef)derData);
SecPolicyRef myPolicy = SecPolicyCreateBasicX509();
SecTrustRef myTrust;
OSStatus status = SecTrustCreateWithCertificates(myCertificate,myPolicy,&myTrust);
SecTrustResultType trustResult;
if (status == noErr) {
status = SecTrustEvaluate(myTrust, &trustResult);
}
SecKeyRef securityKey = SecTrustCopyPublicKey(myTrust);
CFRelease(myCertificate);
CFRelease(myPolicy);
CFRelease(myTrust);
publicKeyRef = securityKey;
}
+ (void) getPrivateKeyRefrenceFromData: (NSData*)p12Data password:(NSString*)password{
SecKeyRef securityKey = NULL;
NSMutableDictionary * options = [[NSMutableDictionary alloc] init];
[options setObject: password forKey:(__bridge id)kSecImportExportPassphrase];
CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
OSStatus securityError = SecPKCS12Import((__bridge CFDataRef) p12Data, (__bridge CFDictionaryRef)options, &items);
if (securityError == noErr && CFArrayGetCount(items) > 0) {
CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items, 0);
SecIdentityRef identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
securityError = SecIdentityCopyPrivateKey(identityApp, &securityKey);
if (securityError != noErr) {
securityKey = NULL;
}
}
CFRelease(items);
privateKeyRef = securityKey;
}
@end
參考
1、AES加密原理：十分鐘讀懂AES加密算法
2、RSA加密原理：RSA加密算法原理（一）、RSA加密算法原理（二）
