前面讲了理论和操作，现在看下最关键的代码实现，不废话，直接代码说明。本文最要介绍通过JCE及默认实现开发的一个RSA的工具类，主要包括两部分：加解密，签名验签和公私钥的各做加载方法。

公私钥的加载

作为一个工具类，会在各做场景和情况使用，所有要考虑比较全的公私加载方法，主要包括以下几种常见情况：

• 从秘钥文件加载(*.pem格式)
• 从二进制数据加载
• 从base64数据加载
• 从hex字符串数据加载
• 从证书文件加载
• 从keystore文件加载（jks和pfx）

公钥的加载

• 秘钥数据加载 公钥秘钥数据的形态，常见的一般是二进制byte数组，base64，秘钥文件，hex字符串数据几种方式。其本质都是byte数组加载。代码如下：

/*** 加载公钥（byte数组）** @param publicKeyBytes*            公钥bytes* @param keyAlgorithm*            算法，如：RSA* @param providerName*            可为空* @return 公钥对象*/public static PublicKey loadPublicKey(byte[] publicKeyBytes, String keyAlgorithm, String providerName) {String algorithm = Strings.isBlankDefault(keyAlgorithm, DEFAULT_KEY_ALGO);try {// KEY_ALGORITHM 指定的加密算法KeyFactory keyFactory = null;if (Strings.isBlank(providerName)) {keyFactory = KeyFactory.getInstance(algorithm);} else {keyFactory = KeyFactory.getInstance(algorithm, providerName);}X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKeyBytes);return keyFactory.generatePublic(keySpec);} catch (Exception e) {throw new RuntimeException("load publicKey fail. " + e.getMessage());}}/*** 加载公钥（base64）** @param publicKeyBase64*            秘钥为BASE64编码* @param keyAlgorithm*            如：RSA* @param providerName*            可以为空，如：BC* @return*/public static PublicKey loadPublicKey(String publicKeyBase64, String keyAlgorithm, String providerName) {byte[] publicKeyBytes = Encodes.decodeBase64(publicKeyBase64);return loadPublicKey(publicKeyBytes, keyAlgorithm, providerName);}/*** 加载公钥(文件pem)** @param publicKeyFile*            公钥秘钥文件，内容为BASE64编码* @param keyAlgorithm*            如：RSA* @param providerName*            可以为空，如：BC* @return*/public static PublicKey loadPublicKey(File publicKeyFile, String keyAlgorithm, String providerName) {byte[] publicKeyBytes = null;try {publicKeyBytes = Encodes.decodeBase64(FileUtils.readFileToString(publicKeyFile));} catch (Exception e) {throw new RuntimeException("加载公钥文件内容失败:" + e.getMessage());}return loadPublicKey(publicKeyBytes, keyAlgorithm, providerName);}    ```  * 通过证书或keystore加载```java/*** 证书文件加载* * @param springResourceUri* @return*/public static PublicKey loadPublicKeyFromCert(String springResourceUri) {InputStream in = null;try {Resource resource = new DefaultResourceLoader().getResource(springResourceUri);in = resource.getInputStream();CertificateFactory cf = CertificateFactory.getInstance("X.509");X509Certificate x509 = (X509Certificate) cf.generateCertificate(in);return x509.getPublicKey();} catch (Exception e) {throw new RuntimeException("加载公钥文件内容失败:" + e.getMessage());} finally {IOUtils.closeQuietly(in);}}/*** 证书pem格式加载* * @param pemCert* @return*/public static PublicKey loadPublicKeyFromCertWithPem(String pemCert) {InputStream in = null;try {CertificateFactory cf = CertificateFactory.getInstance("X.509");in = new ByteArrayInputStream(Encodes.decodeBase64(pemCert));X509Certificate x509 = (X509Certificate) cf.generateCertificate(in);return x509.getPublicKey();} catch (Exception e) {throw new RuntimeException("加载公钥文件内容失败:" + e.getMessage());} finally {IOUtils.closeQuietly(in);}}/*** 从keystore加载公钥* * @param keystoreUri* @param keystoreType* @param keystorePassword* @return*/public static PublicKey loadPublicKeyFromKeyStore(String keystoreUri, String keystoreType,String keystorePassword) {InputStream in = null;try {KeyStore keyStore = KeyStore.getInstance(keystoreType);Resource resource = new DefaultResourceLoader().getResource(keystoreUri);in = resource.getInputStream();keyStore.load(in, keystorePassword.toCharArray());Enumeration<String> enumas = keyStore.aliases();String keyAlias = null;if (enumas.hasMoreElements()) {keyAlias = enumas.nextElement();}return keyStore.getCertificate(keyAlias).getPublicKey();} catch (Exception e) {throw new RuntimeException("通过keystore加载证书公钥失败:" + e.getMessage());} finally {IOUtils.closeQuietly(in);}}

私钥的加载

私钥的加载默认同公钥，这里不在贴代码，从公钥稍微调整下就OK

加密和解密

这里以RSA算法作为介绍，在JAVA实现中，需要注意几点：

• 不管明文长度是多少，RSA 生成的密文长度总是固定的。
• 明文长度不能超过密钥长度。比如 Java 默认的RSA加密实现不允许明文长度超过密钥长度减去 11(单位是字节，也就是 byte)。也就是说，如果我们定义的密钥(我们可以通过 java.security.KeyPairGenerator.initialize(int keysize) 来定义密钥长度)长度为1024(单位是位，也就是 bit)，生成的密钥长度就是 1024位 / 8位/字节 = 128字节，那么我们需要加密的明文长度不能超过 128字节 - 11 字节 = 117字节。也就是说，我们最大能将 117 字节长度的明文进行加密，否则会出问题(抛诸如 javax.crypto.IllegalBlockSizeException: Data must not be longer than 53 bytes 的异常)
• 如果采用其他Provider，每段长度可能不同，如BC(Provider --> Security.addProvider(new BouncyCastleProvider());) 提供的加密算法能够支持到的 RSA 明文长度最长为密钥长度。

特别说明：一般来说Cipher的创建时初始化会比较慢（在我imac下，150ms左右），在性能要求的场景，有同学会担心性能问题，所以会采用ThreadLocal做内存缓存，我开始也这样做了，但是实际测试后发现，其他JCE的默认Provider已做了，而且做得很彻底（不是在ThreadLocal中缓存Cipher实例，而是缓存了Cipher实例初始化的较为耗时的操作和资源，kao~，NB），所以，针对非对称加密场景，不用考虑Cipher 的线程缓存~

公钥加密

/*** 公钥加密** @param plainBytes*            明文bytes* @param publicKey*            公钥* @return 密文bytes*/public static byte[] encryptByPublicKey(byte[] plainBytes, PublicKey publicKey) {ByteArrayOutputStream out = null;try {// Cipher在非对称加密场景，没有必要自己做thread cache，JCE实现的provider默认做了~Cipher cipher = Cipher.getInstance(publicKey.getAlgorithm());cipher.init(Cipher.ENCRYPT_MODE, publicKey);int inputLen = plainBytes.length;out = new ByteArrayOutputStream();int offSet = 0;byte[] cache;int i = 0;// 对数据分段解密int keyLength = ((RSAPublicKey) publicKey).getModulus().bitLength() / 8;int plainLength = keyLength - 11;while (inputLen - offSet > 0) {if (inputLen - offSet > plainLength) {cache = cipher.doFinal(plainBytes, offSet, plainLength);} else {cache = cipher.doFinal(plainBytes, offSet, inputLen - offSet);}out.write(cache, 0, cache.length);i++;offSet = i * plainLength;}byte[] encryptedData = out.toByteArray();return encryptedData;} catch (Exception e) {throw new RuntimeException("publicKey encrypt fail:" + e.getMessage());} finally {IOUtils.closeQuietly(out);}}public static String encryptByPublicKeyBase64(String plainText, PublicKey publicKey, String charset) {return Encodes.encodeBase64(encryptByPublicKey(getBytes(plainText, charset), publicKey));}public static String encryptByPublicKeyBase64(String plainText, PublicKey publicKey) {return encryptByPublicKeyBase64(plainText, publicKey, DEFAULT_CHARSET);}public static String encryptByPublicKeyHex(String plainText, PublicKey publicKey, String charset) {return Encodes.encodeHex(encryptByPublicKey(getBytes(plainText, charset), publicKey));}public static String encryptByPublicKeyHex(String plainText, PublicKey publicKey) {return encryptByPublicKeyHex(plainText, publicKey, DEFAULT_CHARSET);}

私钥解密

/*** 私钥解密** @param encryptedBytes*            密文数据bytes* @param privateKey*            私钥* @return 明文数据bytes*/public static byte[] decryptByPrivateKey(byte[] encryptedBytes, PrivateKey privateKey) {ByteArrayOutputStream out = null;try {Cipher cipher = Cipher.getInstance(privateKey.getAlgorithm());cipher.init(Cipher.DECRYPT_MODE, privateKey);int inputLen = encryptedBytes.length;out = new ByteArrayOutputStream();int offSet = 0;byte[] cache;int i = 0;// 对数据分段解密int keyLength = ((RSAPrivateKey) privateKey).getModulus().bitLength() / 8;while (inputLen - offSet > 0) {if (inputLen - offSet > keyLength) {cache = cipher.doFinal(encryptedBytes, offSet, keyLength);} else {cache = cipher.doFinal(encryptedBytes, offSet, inputLen - offSet);}out.write(cache, 0, cache.length);i++;offSet = i * keyLength;}byte[] decryptedData = out.toByteArray();return decryptedData;} catch (Exception e) {throw new RuntimeException("privateKey decrypt fail:" + e.getMessage());} finally {IOUtils.closeQuietly(out);}}public static String decryptByPrivateKeyBase64(String encryptedBase64, PrivateKey privateKey, String charset) {byte[] plainBytes = decryptByPrivateKey(Encodes.decodeBase64(encryptedBase64), privateKey);try {return new String(plainBytes, Strings.isBlankDefault(charset, DEFAULT_CHARSET));} catch (UnsupportedEncodingException e) {throw new RuntimeException("不支持的字符集:" + e.getMessage());}}public static String decryptByPrivateKeyHex(String plainHex, PrivateKey privateKey, String charset) {byte[] plainBytes = decryptByPrivateKey(Encodes.decodeHex(plainHex), privateKey);try {return new String(plainBytes, Strings.isBlankDefault(charset, DEFAULT_CHARSET));} catch (UnsupportedEncodingException e) {throw new RuntimeException("不支持的字符集:" + e.getMessage());}}

签名和验签

签名和验签基本无需考虑性能问题，我在imac上实际测试一般Signature的初始化在2ms左右，除非要求极致性能，否则也不用做线程缓存。

私钥签名

/*** 私钥签名** @param dataBytes*            明文数据bytes* @param privateKey*            私钥 参考 loadPrivateKey方法* @param signatureAlgorithm*            签名算法 如：SHA1withRSA，MD5withRSA* @return 签名的二进制结果*/public static byte[] sign(@NotNull byte[] dataBytes, @NotNull PrivateKey privateKey,@Null String signatureAlgorithm) {String sa = Strings.isBlankDefault(signatureAlgorithm, SIGN_ALGO_SHA1);try {Signature signature = Signature.getInstance(sa);signature.initSign(privateKey);signature.update(dataBytes);return signature.sign();} catch (Exception e) {throw new RuntimeException("sign with " + sa + " fail:" + e.getMessage());}}public static String signBase64(@NotNull String data, @NotNull PrivateKey privateKey,@Null String signatureAlgorithm, @Null String dataCharset) {byte[] result = sign(getBytes(data, dataCharset), privateKey, signatureAlgorithm);return Encodes.encodeBase64(result);}public static String signBase64(@NotNull String data, @NotNull PrivateKey privateKey) {return signBase64(data, privateKey, null, null);}public static String signHex(@NotNull String data, @NotNull PrivateKey privateKey, @Null String signatureAlgorithm,@Null String dataCharset) {byte[] result = sign(getBytes(data, dataCharset), privateKey, signatureAlgorithm);return Encodes.encodeHex(result);}public static String signHex(@NotNull String data, @NotNull PrivateKey privateKey) {return signHex(data, privateKey, null, null);}

公钥验签

/*** 公钥验签** @param data*            明文数据bytes* @param signData*            签名数据bytes* @param publicKey*            公钥 参考 loadPublicKey(...)方法* @param signatureAlgorithm*            签名算法* @return*/public static boolean verify(byte[] data, byte[] signData, PublicKey publicKey, String signatureAlgorithm) {String sa = Strings.isBlankDefault(signatureAlgorithm, SIGN_ALGO_SHA1);try {Signature signature = Signature.getInstance(sa);signature.initVerify(publicKey);signature.update(data);return signature.verify(signData);} catch (Exception e) {throw new RuntimeException("verify with " + sa + " fail." + e.getMessage());}}public static boolean verifyBase64(String text, String signBase64, PublicKey publicKey, String signatureAlgorithm,String charset) {byte[] data = getBytes(text, charset);byte[] signData = Encodes.decodeBase64(signBase64);return verify(data, signData, publicKey, signatureAlgorithm);}public static boolean verifyBase64(String text, String signBase64, PublicKey publicKey) {return verifyBase64(text, signBase64, publicKey, null, null);}public static boolean verifyHex(String text, String signHex, PublicKey publicKey, String signatureAlgorithm,String charset) {byte[] data = getBytes(text, charset);byte[] signData = Encodes.decodeHex(signHex);return verify(data, signData, publicKey, signatureAlgorithm);}public static boolean verifyHex(String text, String signHex, PublicKey publicKey) {return verifyHex(text, signHex, publicKey, null, null);}

如果你实在要ThreadLocal

如果你选择的Provider不是JCE默认实现，并且这个实现还真没有做缓存，或者你在对称加密场景想做缓存（AES，ECS等场景Cipher初始化还是非常慢的~）。下面一个参考实现：

/*** RSA Cipher 线程缓存* * @author zhangpu*/
public class RSACipherCache {/*** 每个线程可以缓存最多100个不同秘钥对Cipher*/private static final int THREAD_CACHE_SIZE = 10;private static final ThreadLocal<LoadingCache<Key, Cipher>> threadLocal = new ThreadLocal<LoadingCache<Key, Cipher>>() {@Overrideprotected LoadingCache<Key, Cipher> initialValue() {/*** 设置一个按容量控制的内存缓存*/return CacheBuilder.newBuilder().recordStats().maximumSize(THREAD_CACHE_SIZE).build(new CacheLoader<Key, Cipher>() {@Overridepublic Cipher load(final Key key) throws Exception {Cipher cipher = null;try {cipher = Cipher.getInstance(key.getAlgorithm());if (PrivateKey.class.isAssignableFrom(key.getClass())) {// 私钥，在加解密场景用于解密cipher.init(Cipher.DECRYPT_MODE, key);} else {cipher.init(Cipher.ENCRYPT_MODE, key);}} catch (Exception e) {throw new RuntimeException(e);}return cipher;}});}};public static Cipher newCipher(final Key key) {if (key == null) {throw new RuntimeException("Key must be not null.");}return threadLocal.get().getUnchecked(key);}public static CacheStats getStats() {return threadLocal.get().stats();}private RSACipherCache() {}}

OK，以上基本够用~