1 起
项目中会存储用户手机号和银行卡号信息，数据需对称加密（加密＋解密）。
2 承
之前项目做过API网关，对加解密有所接触，JDK已经有基础设施，要做的仅是封装一个可用的Util类。
AESCryptoUtil.java：
import org.apache.commons.codec.binary.Base64;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
public class AESCryptoUtil {
// 加密算法
private static final String ALG = "AES";
// 字符编码
private static final String ENC = "UTF-8";
// 密钥正规化算法
private static final String SEC_NORMALIZE_ALG = "MD5";
// 加密
public static String encrypt(String secret, String data) throws Exception {
MessageDigest dig = MessageDigest.getInstance(SEC_NORMALIZE_ALG);
byte[] key = dig.digest(secret.getBytes(ENC));
SecretKeySpec secKey = new SecretKeySpec(key, ALG);
Cipher aesCipher = Cipher.getInstance(ALG);
byte[] byteText = data.getBytes(ENC);
aesCipher.init(Cipher.ENCRYPT_MODE, secKey);
byte[] byteCipherText = aesCipher.doFinal(byteText);
Base64 base64 = new Base64();
return new String(base64.encode(byteCipherText), ENC);
}
// 解密
public static String decrypt(String secret, String ciphertext) throws Exception {
MessageDigest dig = MessageDigest.getInstance(SEC_NORMALIZE_ALG);
byte[] key = dig.digest(secret.getBytes(ENC));
SecretKeySpec secKey = new SecretKeySpec(key, ALG);
Cipher aesCipher = Cipher.getInstance(ALG);
aesCipher.init(Cipher.DECRYPT_MODE, secKey);
Base64 base64 = new Base64();
byte[] cipherbytes = base64.decode(ciphertext.getBytes());
byte[] bytePlainText = aesCipher.doFinal(cipherbytes);
return new String(bytePlainText, ENC);
}
public static void main(String[] args) {
String secret = "PASSWORD";
String data = "MESSAGE";
try {
System.out.println("key=" + secret + ",original data=" + data);
long start = System.currentTimeMillis();
String encryptData = AESCryptoUtil.encrypt(secret, data);
System.out.println("encryptData=" + encryptData + ", cost=" + (System.currentTimeMillis() - start));
start = System.currentTimeMillis();
String decryptData = AESCryptoUtil.decrypt(secret, encryptData);
System.out.println("decryptData=" + decryptData + ", cost=" + (System.currentTimeMillis() - start));
} catch (Exception e) {
e.printStackTrace();
}
}
}
3 转
参考搜索引擎给的提示，又找到两个非常好的例子。
1 参考实例 AESEncrypter.java：
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;
import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.spec.KeySpec;
public class AESEncrypter {
private static final byte[] SALT = {
(byte) 0xA9, (byte) 0x9B, (byte) 0xC8, (byte) 0x32,
(byte) 0x56, (byte) 0x35, (byte) 0xE3, (byte) 0x03
};
private static final int ITERATION_COUNT = 65536;
private static final int KEY_LENGTH = 256;
private Cipher ecipher;
private Cipher dcipher;
AESEncrypter(String passPhrase) throws Exception {
SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
KeySpec spec = new PBEKeySpec(passPhrase.toCharArray(), SALT, ITERATION_COUNT, KEY_LENGTH);
SecretKey tmp = factory.generateSecret(spec);
SecretKey secret = new SecretKeySpec(tmp.getEncoded(), "AES");
ecipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
ecipher.init(Cipher.ENCRYPT_MODE, secret);
dcipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
byte[] iv = ecipher.getParameters().getParameterSpec(IvParameterSpec.class).getIV();
dcipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(iv));
}
public String encrypt(String encrypt) throws Exception {
byte[] bytes = encrypt.getBytes("UTF8");
byte[] encrypted = encrypt(bytes);
return new BASE64Encoder().encode(encrypted);
}
public byte[] encrypt(byte[] plain) throws Exception {
return ecipher.doFinal(plain);
}
public String decrypt(String encrypt) throws Exception {
byte[] bytes = new BASE64Decoder().decodeBuffer(encrypt);
byte[] decrypted = decrypt(bytes);
return new String(decrypted, "UTF8");
}
public byte[] decrypt(byte[] encrypt) throws Exception {
return dcipher.doFinal(encrypt);
}
public static void main(String[] args) throws Exception {
String message = "MESSAGE";
String password = "PASSWORD";
AESEncrypter encrypter = new AESEncrypter(password);
String encrypted = encrypter.encrypt(message);
String decrypted = encrypter.decrypt(encrypted);
System.out.println("Encrypt(\"" + message + "\", \"" + password + "\") = \"" + encrypted + "\"");
System.out.println("Decrypt(\"" + encrypted + "\", \"" + password + "\") = \"" + decrypted + "\"");
}
}
2 蛮不错的反面示例：
3-wrong-ways-to-store-a-password
写的真棒，由浅入深，最后给出最佳方案。
- 1 明文存储，2 简单Hash 如md5存储， 3加盐Hash。都有各自的问题，最后给出最优方案。
- 关键的关键还有各种代码的例子 :)
Java版：Pbkdf2Demo.java
// Java ships with PBKDF2 support
import java.util.UUID;
import java.security.SecureRandom;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import java.math.BigInteger;
class Pbkdf2Demo {
private static final int ITERATIONS = 1000;
private static final int KEY_LENGTH = 192; // bits
public static String hashPassword(String password, String salt) {
char[] passwordChars = password.toCharArray();
byte[] saltBytes = salt.getBytes();
PBEKeySpec spec = new PBEKeySpec(
passwordChars,
saltBytes,
ITERATIONS,
KEY_LENGTH
);
SecretKeyFactory key = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
byte[] hashedPassword = key.generateSecret(spec).getEncoded();
return String.format("%x", new BigInteger(hashedPassword));
}
public static void main(String[] args) throws Exception {
System.out.println(hashPassword("password", "salt"));
}
}
2017-04-28 继续添加一个不错的例子
参考链接
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;
/**
* AES 是一种可逆加密算法，对用户的敏感信息加密处理 对原始数据进行AES加密后，在进行Base64编码转化；
*/
public class AESOperator {
/*
* 加密用的Key 可以用26个字母和数字组成 此处使用AES-128-CBC加密模式，key需要为16位。
*/
private String sKey = "smkldospdosldaaa";//key，可自行修改
private String ivParameter = "0392039203920300";//偏移量,可自行修改
private static AESOperator instance = null;
private AESOperator() {
}
public static AESOperator getInstance() {
if (instance == null)
instance = new AESOperator();
return instance;
}
public static String Encrypt(String encData ,String secretKey,String vector) throws Exception {
if(secretKey == null) {
return null;
}
if(secretKey.length() != 16) {
return null;
}
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
byte[] raw = secretKey.getBytes();
SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
IvParameterSpec iv = new IvParameterSpec(vector.getBytes());// 使用CBC模式，需要一个向量iv，可增加加密算法的强度
cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);
byte[] encrypted = cipher.doFinal(encData.getBytes("utf-8"));
return new BASE64Encoder().encode(encrypted);// 此处使用BASE64做转码。
}
// 加密
public String encrypt(String sSrc) throws Exception {
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
byte[] raw = sKey.getBytes();
SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
IvParameterSpec iv = new IvParameterSpec(ivParameter.getBytes());// 使用CBC模式，需要一个向量iv，可增加加密算法的强度
cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);
byte[] encrypted = cipher.doFinal(sSrc.getBytes("utf-8"));
return new BASE64Encoder().encode(encrypted);// 此处使用BASE64做转码。
}
// 解密
public String decrypt(String sSrc) throws Exception {
try {
byte[] raw = sKey.getBytes("ASCII");
SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
IvParameterSpec iv = new IvParameterSpec(ivParameter.getBytes());
cipher.init(Cipher.DECRYPT_MODE, skeySpec, iv);
byte[] encrypted1 = new BASE64Decoder().decodeBuffer(sSrc);// 先用base64解密
byte[] original = cipher.doFinal(encrypted1);
String originalString = new String(original, "utf-8");
return originalString;
} catch (Exception ex) {
return null;
}
}
public String decrypt(String sSrc,String key,String ivs) throws Exception {
try {
byte[] raw = key.getBytes("ASCII");
SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
IvParameterSpec iv = new IvParameterSpec(ivs.getBytes());
cipher.init(Cipher.DECRYPT_MODE, skeySpec, iv);
byte[] encrypted1 = new BASE64Decoder().decodeBuffer(sSrc);// 先用base64解密
byte[] original = cipher.doFinal(encrypted1);
String originalString = new String(original, "utf-8");
return originalString;
} catch (Exception ex) {
return null;
}
}
public static String encodeBytes(byte[] bytes) {
StringBuffer strBuf = new StringBuffer();
for (int i = 0; i < bytes.length; i++) {
strBuf.append((char) (((bytes[i] >> 4) & 0xF) + ((int) 'a')));
strBuf.append((char) (((bytes[i]) & 0xF) + ((int) 'a')));
}
return strBuf.toString();
}
public static void main(String[] args) throws Exception {
// 需要加密的字串
String cSrc = "[{\"request_no\":\"1001\",\"service_code\":\"FS0001\",\"contract_id\":\"100002\",\"order_id\":\"0\",\"phone_id\":\"13913996922\",\"plat_offer_id\":\"100094\",\"channel_id\":\"1\",\"activity_id\":\"100045\"}]";
// 加密
long lStart = System.currentTimeMillis();
String enString = AESOperator.getInstance().encrypt(cSrc);
System.out.println("加密后的字串是：" + enString);
long lUseTime = System.currentTimeMillis() - lStart;
System.out.println("加密耗时：" + lUseTime + "毫秒");
// 解密
lStart = System.currentTimeMillis();
String DeString = AESOperator.getInstance().decrypt(enString);
System.out.println("解密后的字串是：" + DeString);
lUseTime = System.currentTimeMillis() - lStart;
System.out.println("解密耗时：" + lUseTime + "毫秒");
}
}
4 结
AESEncrypter、AESCryptoUtil、Pbkdf2Demo 三个类最终选择了 AESEncrypter。AESEncrypter 速度更快，代码更清晰。
后续
看下 AESEncrypter 每个类的说明；如项目时间有余，可看下源码。
