错误的 RSA PrivateKey KeyStore答案

【问题标题】：Wrong RSA PrivateKey KeyStore错误的 RSA PrivateKey KeyStore
【发布时间】：2018-12-09 23:46:19
【问题描述】：

我的应用在打开时会生成一个KeyPair。我可以使用PublicKey 加密文本，但是当我尝试使用PrivateKey 对其进行解密时，它会抛出InvalidKeyException。

一些Log.v调试：

(...) V/Aliases: The public key created is [android.security.keystore.AndroidKeyStoreRSAPublicKey@1840131a]
(...) V/Aliases: The private key created is [android.security.keystore.AndroidKeyStoreRSAPrivateKey@37ad0430]
(...) V/Aliases: The public key used is [android.security.keystore.AndroidKeyStoreRSAPublicKey@1840131a]
(...) V/Aliases: The private key used is [android.security.keystore.AndroidKeyStoreRSAPrivateKey@37ad0430]
(...) V/Aliases: The private key [android.security.keystore.AndroidKeyStoreRSAPrivateKey@37ad0430] is incorrect

KeyPair代：

try {
    //Load KeyStore  
    keystore = KeyStore.getInstance("AndroidKeyStore");
    keystore.load(null);

} catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException e) {
        e.printStackTrace();
    }

    //KeyPair generation
    KeyPairGenerator kpg = null;
    try {
        kpg = KeyPairGenerator.getInstance("RSA", "AndroidKeyStore");
        kpg.initialize(new KeyGenParameterSpec.Builder("Test",KeyProperties.PURPOSE_DECRYPT | KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_SIGN)
                .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                .build());
        kp = kpg.generateKeyPair();
        Log.v("Aliases", "The public key created is [" + kp.getPublic() + "]");
        Log.v("Aliases", "The private key created is [" + kp.getPrivate()+ "]");

    } catch (NoSuchAlgorithmException | NoSuchProviderException | InvalidAlgorithmParameterException e) {
        e.printStackTrace();
    }

Encryption函数：

//Removed try/catch
KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry) keystore.getEntry("Test", null);
PublicKey publicKey = privateKeyEntry.getCertificate().getPublicKey();

Log.v("Aliases", "The public key used is [" + publicKey + "]");

Cipher cipher = Cipher.getInstance("RSA");
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
[] bytes = cipher.doFinal(edittext.getText().toString().getBytes());
edittext.setText(Base64.encodeToString(bytes, Base64.DEFAULT));

Decryption函数：

//Removed try/catch
KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry) keystore.getEntry("Test", null);
PrivateKey privateKey = privateKeyEntry.getPrivateKey();

Log.v("Aliases", "The private key used is [" + privateKey + "]");

Cipher cipher = Cipher.getInstance("RSA");
cipher.init(Cipher.DECRYPT_MODE, privateKey);
String decrypted = new String(cipher.doFinal(Base64.decode(edittext.getText().toString(), Base64.DEFAULT)));
edittext.setText(decrypted);

//Removed the "try" part. This gets executed when cipher.init returns InvalidKeyException
catch (InvalidKeyException e) {
            KeyStore.PrivateKeyEntry privateKeyEntry = null;
            privateKeyEntry = (KeyStore.PrivateKeyEntry) keystore.getEntry("Test", null);
            PrivateKey privateKey = privateKeyEntry.getPrivateKey();
            Log.v("Aliases", "The private key [" + privateKey + "] is incorrect");
            e.printStackTrace();
}

【问题讨论】：

标签： android rsa private-key public-key android-keystore

【解决方案1】：

不要这样做：

Cipher cipher = Cipher.getInstance("RSA");

始终指定完整的“算法/模式/填充”规范。例如，

Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPwithSHA-256andMGF1Padding");

现在您还需要告诉 AndroidKeyStore 您允许密钥使用哪些加密填充。所以在你的调用链中为KeyGenParameterSpec.Builder(...)添加一个setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP)调用，即

kpg.initialize(new KeyGenParameterSpec.Builder("Test",
                KeyProperties.PURPOSE_DECRYPT | KeyProperties.PURPOSE_ENCRYPT |
                        KeyProperties.PURPOSE_SIGN)
                .setDigests(KeyProperties.DIGEST_SHA256, KeyProperties.DIGEST_SHA512)
                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_RSA_OAEP)
                .build());

【讨论】：