Java加密编程指南：JCA与JCE详解

4星 · 超过85%的资源需积分: 14 163 浏览量更新于2024-07-28 1 收藏 1.47MB PDF 举报

《Java Cryptography》是一本深入讲解Java编程中的加密技术的专业书籍，专为那些在处理敏感数据的IT专业人士设计。作者Jonathan B. Knudsen于1998年5月出版了第一版，该书共362页，提供了详尽的指导，帮助读者掌握Java的安全工具。书中核心内容包括以下几个方面： 1. **Java安全体系**：首先介绍了Java的安全系统，强调了在编写安全程序时的必要性，特别是对于处理加密操作。Java的安全架构（Java Cryptography Architecture, JCA）是Java 1.1和1.2版本提供的强大支持，它定义了一套优雅的接口和组件，用于实现加密和解密等操作。 2. **Java Cryptography Extension (JCE)**：JCE作为JCA的扩展，提供了额外的加密功能。本书详细探讨了如何利用JCE，包括如何使用安全提供者（security providers）以及如何实现自定义的安全服务提供商。 3. **密码学概念**：涵盖了加密的基本概念，如保密性（confidentiality）、完整性（integrity）和认证（authentication）。此外，书中还讨论了随机数生成器（Random Numbers），这是许多加密算法的基础。 4. **加密算法与架构**：通过实例解析Java中的加密算法架构，包括API和SPI（Service Provider Interface）的使用，工厂方法（Factory Methods）的应用，以及标准名称（Standard Names）的管理。 5. **密钥管理**：关键部分之一，书中深入讲解了密钥的管理，包括密钥生成器（KeyGenerators）、密钥翻译器（KeyTranslators）以及密钥协商（KeyAgreement）。这对于保护数据安全至关重要。 6. **实际应用示例**：书中包含一个安全的Talk应用，展示了如何加密网络传输的数据，使读者能够理解如何将理论知识应用到实际场景中。如果你的工作涉及敏感数据处理，这本书将是你不可或缺的参考资料，因为它不仅教你如何利用Java的加密工具，还为你提供了一个坚实的加密编程基础。无论是初学者还是经验丰富的开发人员，都能从中受益匪浅。

Java Cryptography

age 11

String base64 = encoder.encode(raw);

System.out.println(base64);

}

else if (args[0].indexOf("d") != -1) {

cipher.init(Cipher.DECRYPT_MODE, key);

BASE64Decoder decoder = new BASE64Decoder();

byte[] raw = decoder.decodeBuffer(args[1]);

byte[] stringBytes = cipher.doFinal(raw);

String result = new String(stringBytes, "UTF8");

System.out.println(result);

}

SecretWriting has to generate a key the first time you use it. This can take a few seconds, so be

prepared to wait.

In the meantime, let's look at the steps in this program:

1. Check command-line arguments. We expect an option, either

-e or -d, and a string.

2. Next we need a key to use the cipher. We first attempt to deserialize the key from a file named

SecretKey.ser. If this fails, we need to create a new key. A

KeyGenerator object creates keys.

We obtain a

KeyGenerator by using a factory method, in just the same way that we obtained a

MessageDigest in the Masher example. In this case, we ask for a key for the DES (Data

Encryption Standard) cipher algorithm:

KeyGenerator generator = KeyGenerator.getInstance("DES");

The key generator must be initialized with a random number to produce a random new key. It

takes a few seconds to initialize the

SecureRandom, so be patient.

generator.init(new SecureRandom());

This done, we are set to generate a key. We serialize the key to the SecretKey.ser file so that

we can use the same key the next time we run the program.

3. Having obtained our key, we obtain a cipher in much the same way:

Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding");

This specifies the DES algorithm and some other parameters the Cipher needs. We'll talk

about these in detail in Chapter 7.

4. Finally, we encrypt or decrypt the input data. The

Cipher is created in an uninitialized state; it

must be initialized, with a key, to either encryption mode or decryption mode. This is

accomplished by calling

init(). When encrypting, we take all of the command-line

arguments after the

-e option and concatenate them into one string, amalgam.

Then we get a byte array from this string and encrypt it in the call to

Cipher's doFinal()

method:

byte[] stringBytes = amalgam.getBytes("UTF8");

byte[] raw = cipher.doFinal(stringBytes);

Finally, as in the Masher example, we convert the raw encrypted bytes to base64 and display

them.

Decrypting is the same process in reverse. We convert the command-line argument from

base64 to an array of bytes. We then use our

Cipher object to decrypt this:

byte[] stringBytes = cipher.doFinal(raw);

We create a new String from the resulting byte array and display it. Note that we specify an

encoding for converting between a

String and a byte array. If we just used the default

encoding (by calling

getBytes() with no argument), then the ciphertext produced by this

program might not be portable from one machine to another. We use UTF8 as a standard

encoding because it can express all Unicode characters. For more information on UTF8, see

http://www.stonehand.com/unicode/standard/wg2n1036.html. You don't really have to

understand how UTF8 works; just think of it as a standard way to convert from a string to a

byte array and back.

Java Cryptography

age 13

Chapter 2. Concepts

At the application programming level, there are many options for making a program secure.

Cryptography is the biggest, baddest tool in the application programmer's arsenal. But it is important

to realize that a cryptographically enabled program is not necessarily a secure one. Without a carefully

planned and constantly scrutinized security strategy, cryptography won't do you much good.

Correctly used, cryptography provides these standard security features:

• Confidentiality assures you that data cannot be viewed by unauthorized people.

• Integrity assures you that data has not been changed without your knowledge.

• Authentication assures you that people you deal with are not imposters.

Random numbers are used in many cryptographic algorithms. I'll talk a little bit about computer-

generated random numbers at the end of the chapter. I'll wrap up by discussing the cryptographic

algorithms used in this book.

2.1 Confidentiality

Most of us don't want other people to read our mail, which is why we use letters instead of postcards.

Almost all information on the Internet is transmitted on the equivalent of postcards. Even if nobody is

deliberately spying on you, electronic mail is frequently misdelivered. If you mistype a recipient's

address, your mail might get sent to a system administrator somewhere. It's surprisingly easy for

information you thought was confidential to be available to hundreds of thousands of people on the

Internet.

Even data on your computer's hard disk is surprisingly available to your coworkers, the people who

clean your office, and anyone else who might have physical access to your computer. If you are

considering leaving your current job, you probably wouldn't feel comfortable leaving a copy of your

résumé on your office computer; someone might find it.

To protect your information from prying or curious eyes, you need to take extra precautions. A

common way to protect information is to encrypt it at the sending end and decrypt it at the receiving

end. Encryption is the process of taking data, called plaintext , and mathematically transforming it

into an unreadable mess, called ciphertext . Decryption takes the ciphertext and transforms it back

into plaintext. The mathematical algorithm that performs the transformations is called a cipher .

Figure 2.1 shows how this works.

Figure 2.1. Operation of a cipher

To protect data on a hard disk, you would encrypt it before writing it on the disk. You could decrypt

the ciphertext whenever you wanted to look at the information (or to print copies of your résumé).

A trivial cipher is rot13 . The algorithm for rot13 simply rotates each character of a text message

through 13 positions. One application of rot13 transforms plaintext to ciphertext, and a second

application of rot13 transforms the ciphertext to plaintext. Rot13 was originally developed to render

potentially offensive jokes unreadable in Internet newsgroups. Anyone who inadvertently stumbled

upon one of these jokes would just see a jumble of rot13 ciphertext. Those who really wanted to see the

jokes had to decrypt them first.

Java Cryptography

age 14

Rot13 is not very secure; anyone with the rot13 algorithm can decrypt rot13 ciphertext. Let's say that

Maid Marian wants to send a secret message to Robin Hood, and she encrypts it with rot13. If the

Sheriff of Nottingham can intercept the message, he can decrypt it, as shown in Figure 2.2.

Figure 2.2. Intercepting a rot13 message

The Sheriff doesn't even have to know that he's intercepting rot13 ciphertext. If he's an amateur

cryptanalyst, he should be able to decrypt the ciphertext without knowing the algorithm used. The

rot13 algorithm is a variation on the Caeser cipher, which, as its name implies, was hot stuff about

2000 years ago. Cryptograms are another variation on this type of cipher, where each letter in a

message is replaced with another. Modern ciphers use much more complicated transformations than

rot13.

Useful ciphers use keys to encrypt and decrypt data. A key is a secret value, like a password or a bank

card code. It is not human-readable, the way a password is, and it is longer than a bank card code. You

can think of it as a sequence of bytes. It can be stored in memory or on a disk drive. If you encrypt the

same plaintext using different keys, you will get different ciphertexts. Similarly, ciphertext can only be

decrypted to the original plaintext using the proper key.

2.1.1 Symmetric Ciphers

A symmetric cipher uses the same key at the sending and receiving end, as shown in Figure 2.3.

Symmetric ciphers are also called private key or secret key ciphers.

Figure 2.3. Operation of a symmetric cipher

Using a symmetric cipher can be awkward. You have to keep the key a secret, and you have to trust

your recipient to keep the key a secret also. If someone else obtains the key, you and your recipient

have to agree on a new key in a secure manner. For example, let's say Maid Marian and Robin Hood

are using a symmetric cipher to exchange messages. If the Sheriff of Nottingham somehow obtains

Robin Hood's copy of the private key, then Marian needs to generate a new private key. Then she has

to figure out how to get a copy of the private key to Robin Hood without letting anyone else find out

about it.

You could run into the same problem with the server and client parts of an application. If you want to

keep people from snooping on the data that passes between the client and server, you could use a

symmetric cipher. But both the client and the server need to know the private key. If the key is

discovered, your entire system is suddenly insecure. To avoid this problem, you could program each

client with a different private key, but this would quickly become a distribution headache.

Java Cryptography

age 1

2.1.2 Asymmetric Ciphers

The shortcomings of symmetric ciphers are addressed by asymmetric ciphers, also called public key

ciphers. These ciphers actually involve a public key, which can be freely distributed, and a private key,

which is secret. These keys are always generated in matching pairs. Public keys really are public; you

can publish them in a newspaper or write them in the sky. No one can violate your privacy or

impersonate you without your private key. The mechanism for distributing public keys, however, is a

big challenge. I'll talk more about this in the section on certificates, later in this chapter.

Data encrypted using the public key can be decrypted using the private key. No other key will decrypt

the data, and the private key will decrypt only data that was encrypted using the matching public key.

In some cases, the reverse of the process also works; data encrypted with the private key can be

decrypted with the public key. If Marian wants to send a message to Robin Hood, she can encrypt it

using Robin Hood's public key. Only the matching private key, which should be known only to Robin

Hood, can be used to decrypt the message. Figure 2.4 shows how this works.

Figure 2.4. Operation of an asymmetric cipher

The Sheriff can intercept this message, but it doesn't do him any good because the message can be

decrypted only with Robin Hood's private key. And as long as Robin Hood keeps his private key secret,

he can give his public key to anyone who wants it, even the Sheriff. With the public key, the Sheriff can

send Robin messages (if he wants), but can't decode anything that others send. In particular, he can't

use the public key to compute Robin's private key, at least not without spending the entire Gross

National Product of mediaeval England on state-of-the-art computers.

Asymmetric ciphers are much slower than symmetric ciphers, so they are not usually used to encrypt

long messages. I'll talk more about this later.

So What Is a Key, Anyway?

It's easiest to think of keys in a conceptual way. First, visualize a cipher as a machine. To

run the machine, you need to stick a key in it. You can stuff plaintext in one side and get

ciphertext out the other side. You can run the cipher in reverse to convert ciphertext to

plaintext.

In practice, the cipher is a mathematical formula. A key is just a special number, or a few

special numbers, that are used in the formula. A public key for an ElGamal cipher, for

example, consists of three numbers, called p, g, and y. When you use an ElGamal cipher to

encrypt data, the p, g, and y values are used mathematically to transform the plaintext into

ciphertext. (For more on ElGamal, see Chapter 9).

There are many ways to store keys. You could just write the key's values out to a file, or you

might add a header with additional information about the key. In the

SecretWriting

example in Chapter 1, we serialize a key to a file. If your filesystem isn't protected from

intrusion, you'll have to be careful about writing private keys to files. One solution is to

encrypt the keys themselves, perhaps with a passphrase, before writing them out. (See

Chapter 7, for more information on this.) Another solution for storing private keys is to put

them on removable media, like floppy disks or smart cards.

剩余253页未读，继续阅读

renpingan

粉丝: 0
资源: 6

Java加密编程指南：JCA与JCE详解

Java Cryptography Extension (JCE)

Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files

Java Cryptography with Examples

java cryptography: tools and techniques

jce(java cryptography extension)

Java非对称加密框架

java根据加密key工具类

java.lang.IllegalArgumentException: java.security.InvalidKeyException: Illegal key size

crypto-js java平替

java.security.Provider

最新资源