0、說明：只能讀取PKCS8格式的加密私鑰

1、解密使用的依賴：

        <!-- RAS私鑰解密相關(guān) -->
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk15on</artifactId>
            <version>1.68</version>
        </dependency>
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcpkix-jdk15on</artifactId>
            <version>1.68</version>
        </dependency>
        <!-- 工具 -->
        <dependency>
            <groupId>cn.hutool</groupId>
            <artifactId>hutool-all</artifactId>
            <version>5.7.22</version>
        </dependency>

JAVA版本：1.8.0_261

SpringBoot版本：2.6.4

2、代碼：

讀取PKCS8格式的秘鑰

    private static final String PRIVATE_KEY_FILE = "prikey.pem";

    /**
     * 讀取帶密碼保護(hù)的私鑰文件
     * @param passwd 保護(hù)密碼
     * @return 私鑰的byte數(shù)組，可以通過Base64編碼轉(zhuǎn)為字符串
     */
    public static byte[] readPrivateKeyFromPem(String passwd) throws Exception {
        File file = ResourceUtils.getFile("classpath:".concat(PRIVATE_KEY_FILE));
        String encrypted = FileUtil.readString(file, StandardCharsets.UTF_8);
        // 讀取帶密碼保護(hù)的私鑰：https://cloud.tencent.com/developer/article/2186682?from=15425
        PrivateKeyInfo pki;
        try (PEMParser pemParser = new PEMParser(new StringReader(encrypted))) {
            Object o = pemParser.readObject();
            PKCS8EncryptedPrivateKeyInfo epki = (PKCS8EncryptedPrivateKeyInfo) o;
            // 手動添加BC的安全模式：https://blog.csdn.net/Roy_70/article/details/70842322
            Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
            JcePKCSPBEInputDecryptorProviderBuilder builder =
                    new JcePKCSPBEInputDecryptorProviderBuilder().setProvider("BC");
            InputDecryptorProvider idp = builder.build(passwd.toCharArray());
            pki = epki.decryptPrivateKeyInfo(idp);
            JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
            return converter.getPrivateKey(pki).getEncoded();
        }
     }

秘鑰文件放置在模塊的resource目錄下，也可以自行更改文件讀取方式

3、另外附上自己寫的完整的RSA分段加解密

import cn.hutool.core.codec.Base64Decoder;
import cn.hutool.core.io.FileUtil;
import cn.hutool.crypto.asymmetric.KeyType;
import cn.hutool.crypto.asymmetric.RSA;
import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
import org.bouncycastle.operator.InputDecryptorProvider;
import org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo;

import org.bouncycastle.pkcs.jcajce.JcePKCSPBEInputDecryptorProviderBuilder;
import org.springframework.util.ResourceUtils;

import java.io.File;
import java.io.StringReader;
import java.nio.ByteBuffer;
import java.nio.charset.StandardCharsets;
import java.security.Security;
import java.util.Arrays;

public class RsaBigDataUtil {

    private static final String PUBLIC_KEY_FILE = "pubkey.pem";
    private static final String PRIVATE_KEY_FILE = "prikey.pem";

    /**
     * 私鑰分段解密
     *
     * @param privateKey 私鑰
     * @param context    密文
     * @param len        公鑰長度
     * @return 解密后的明文比特流
     */
    public static byte[] decrypt(byte[] privateKey, byte[] context, int len) {
        RSA rsa = new RSA(privateKey, null);
        ByteBuffer srcByteBuffer = ByteBuffer.wrap(context);
        int splitCount = (int) Math.ceil((double) context.length / (double) (len * 2));        // 向上取整得分段數(shù)
        ByteBuffer resByteBuffer = ByteBuffer.allocate(splitCount * len);
        int splitIndex = 1;
        int length = 0;
        while (splitIndex <= splitCount) {
            // 當(dāng)本次被解密數(shù)據(jù)的最后一位長度擴(kuò)張后會超過緩沖區(qū)長度的時候減小數(shù)據(jù)容器的長度
            byte[] temp_mi = new byte[srcByteBuffer.limit() < splitIndex * len * 2 ? len : len * 2];
            srcByteBuffer.get(temp_mi, 0, temp_mi.length);
            byte[] temp_min = rsa.decrypt(temp_mi, KeyType.PrivateKey);
            resByteBuffer.put(temp_min, 0, temp_min.length);
            length += temp_min.length;
            splitIndex++;
        }
        return Arrays.copyOfRange(resByteBuffer.array(), 0, length);
    }

    /**
     * 公鑰分段加密
     *
     * @param publicKey 公鑰
     * @param context   明文
     * @param len       公鑰長度
     * @return 加密后的密文比特?cái)?shù)組
     */
    public static byte[] encrypt(byte[] publicKey, byte[] context, int len) {
        RSA rsa = new RSA(null, publicKey);
        ByteBuffer srcByteBuffer = ByteBuffer.wrap(context);
        int splitCount = (int) Math.ceil((double) context.length / (double) len);
        // 由于加密后密文會膨脹，但最大大小是切片數(shù)*兩倍的塊大小
        ByteBuffer resByteBuffer = ByteBuffer.allocate(splitCount * len * 2);
        int splitIndex = 1;
        int length = 0;
        while (splitIndex <= splitCount) {
            byte[] temp_min = new byte[splitCount == splitIndex ? (context.length - (splitCount - 1) * len) : len];
            srcByteBuffer.get(temp_min, 0, temp_min.length);
            byte[] temp_mi = rsa.encrypt(temp_min, KeyType.PublicKey);
            resByteBuffer.put(temp_mi, 0, temp_mi.length);
            length += temp_mi.length;
            splitIndex++;
        }
        return Arrays.copyOfRange(resByteBuffer.array(), 0, length);
    }

    /**
     * 讀取公鑰文件
     * @return 公鑰的byte數(shù)組，可以通過Base64編碼轉(zhuǎn)為字符串
     * */
    public static byte[] readPublicKeyFromPem() throws Exception {
        File file = ResourceUtils.getFile("classpath:".concat(PUBLIC_KEY_FILE));
        String encrypted = FileUtil.readString(file, StandardCharsets.UTF_8);
        encrypted = encrypted.replace("-----BEGIN PUBLIC KEY-----","");
        encrypted = encrypted.replace("-----END PUBLIC KEY-----","");
        return Base64Decoder.decode(encrypted);
    }

    /**
     * 讀取帶密碼保護(hù)的私鑰文件
     * @param passwd 保護(hù)密碼
     * @return 私鑰的byte數(shù)組，可以通過Base64編碼轉(zhuǎn)為字符串
     */
    public static byte[] readPrivateKeyFromPem(String passwd) throws Exception {
        File file = ResourceUtils.getFile("classpath:".concat(PRIVATE_KEY_FILE));
        String encrypted = FileUtil.readString(file, StandardCharsets.UTF_8);
        // 讀取帶密碼保護(hù)的私鑰：https://cloud.tencent.com/developer/article/2186682?from=15425
        PrivateKeyInfo pki;
        try (PEMParser pemParser = new PEMParser(new StringReader(encrypted))) {
            Object o = pemParser.readObject();
            PKCS8EncryptedPrivateKeyInfo epki = (PKCS8EncryptedPrivateKeyInfo) o;
            // 手動添加BC的安全模式：https://blog.csdn.net/Roy_70/article/details/70842322
            Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
            JcePKCSPBEInputDecryptorProviderBuilder builder =
                    new JcePKCSPBEInputDecryptorProviderBuilder().setProvider("BC");
            InputDecryptorProvider idp = builder.build(passwd.toCharArray());
            pki = epki.decryptPrivateKeyInfo(idp);
            JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
            return converter.getPrivateKey(pki).getEncoded();
        }
    }
}

代碼只實(shí)現(xiàn)了基礎(chǔ)功能，還有很多不足，歡迎各位大佬指正

4、附上一個基礎(chǔ)的使用案例

    void encrypt() throws Exception {
        String content = "114514";
        System.out.println("原文："+content);
        byte[] mi = RsaBigDataUtil.encrypt(RsaBigDataUtil.readPublicKeyFromPem(), content.getBytes(StandardCharsets.UTF_8), 256);
        String base64 = Base64Encoder.encode(mi);
        System.out.println("加密："+base64);
        byte[] min = RsaBigDataUtil.decrypt(RsaBigDataUtil.readPrivateKeyFromPem("yourPasswd"),mi,256);
        System.out.println("解密："+new String(min, StandardCharsets.UTF_8));
    }

測試用的密鑰對可以在RSA加密/解密 - 在線工具 (try8.cn)在線生成

下載好的秘鑰放置在項(xiàng)目的resource目錄下（或者自己重寫文件讀取方法）

記得將代碼中的文件名替換為自己的?

文章來源地址http://www.zghlxwxcb.cn/news/detail-459948.html

到了這里，關(guān)于JAVA 解密被密碼保護(hù)的pem私鑰文件的文章就介紹完了。如果您還想了解更多內(nèi)容，請?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！