Java PublicKey.getAlgorithm方法代码示例

import java.security.PublicKey; //导入方法依赖的package包/类
private static String getJcaSignatureAlgorithm(
        PublicKey publicKey, DigestAlgorithm digestAlgorithm) throws InvalidKeyException {
    String keyAlgorithm = publicKey.getAlgorithm();
    String digestPrefixForSigAlg;
    switch (digestAlgorithm) {
        case SHA1:
            digestPrefixForSigAlg = "SHA1";
            break;
        case SHA256:
            digestPrefixForSigAlg = "SHA256";
            break;
        default:
            throw new IllegalArgumentException(
                    "Unexpected digest algorithm: " + digestAlgorithm);
    }
    if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
        return digestPrefixForSigAlg + "withRSA";
    } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
        return digestPrefixForSigAlg + "withDSA";
    } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
        return digestPrefixForSigAlg + "withECDSA";
    } else {
        throw new InvalidKeyException("Unsupported key algorithm: " + keyAlgorithm);
    }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
@Override
public void main(Provider p) throws Exception {

    /*
     * Use Solaris SPARC 11.2 or later to avoid an intermittent failure
     * when running SunPKCS11-Solaris (8044554)
     */
    if (p.getName().equals("SunPKCS11-Solaris") &&
        props.getProperty("os.name").equals("SunOS") &&
        props.getProperty("os.arch").equals("sparcv9") &&
        props.getProperty("os.version").compareTo("5.11") <= 0 &&
        getDistro().compareTo("11.2") < 0) {

        System.out.println("SunPKCS11-Solaris provider requires " +
            "Solaris SPARC 11.2 or later, skipping");
        return;
    }

    long start = System.currentTimeMillis();
    Providers.setAt(p, 1);
    try {
        String PROVIDER = p.getName();
        String javaHome = props.getProperty("java.home");
        String caCerts = javaHome + SEP + "lib" + SEP + "security" + SEP + "cacerts";
        KeyStore ks;
        try (InputStream in = new FileInputStream(caCerts)) {
            ks = KeyStore.getInstance(KeyStore.getDefaultType());
            ks.load(in, null);
        }
        for (Enumeration e = ks.aliases(); e.hasMoreElements(); ) {
            String alias = (String)e.nextElement();
            if (ks.isCertificateEntry(alias)) {
                System.out.println("* Testing " + alias + "...");
                X509Certificate cert = (X509Certificate)ks.getCertificate(alias);
                PublicKey key = cert.getPublicKey();
                String alg = key.getAlgorithm();
                if (alg.equals("RSA")) {
                    System.out.println("Signature algorithm: " + cert.getSigAlgName());
                    cert.verify(key, PROVIDER);
                } else {
                    System.out.println("Skipping cert with key: " + alg);
                }
            } else {
                System.out.println("Skipping alias " + alias);
            }
        }
        long stop = System.currentTimeMillis();
        System.out.println("All tests passed (" + (stop - start) + " ms).");
     } finally {
        Security.removeProvider(p.getName());
     }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
/**
 * Gets the JAR signing digest algorithm to be used for signing an APK using the provided key.
 *
 * @param minSdkVersion minimum API Level of the platform on which the APK may be installed (see
 *        AndroidManifest.xml minSdkVersion attribute)
 *
 * @throws InvalidKeyException if the provided key is not suitable for signing APKs using
 *         JAR signing (aka v1 signature scheme)
 */
public static DigestAlgorithm getSuggestedSignatureDigestAlgorithm(
        PublicKey signingKey, int minSdkVersion) throws InvalidKeyException {
    String keyAlgorithm = signingKey.getAlgorithm();
    if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
        // Prior to API Level 18, only SHA-1 can be used with RSA.
        if (minSdkVersion < 18) {
            return DigestAlgorithm.SHA1;
        }
        return DigestAlgorithm.SHA256;
    } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
        // Prior to API Level 21, only SHA-1 can be used with DSA
        if (minSdkVersion < 21) {
            return DigestAlgorithm.SHA1;
        } else {
            return DigestAlgorithm.SHA256;
        }
    } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
        if (minSdkVersion < 18) {
            throw new InvalidKeyException(
                    "ECDSA signatures only supported for minSdkVersion 18 and higher");
        }
        return DigestAlgorithm.SHA256;
    } else {
        throw new InvalidKeyException("Unsupported key algorithm: " + keyAlgorithm);
    }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
/**
 * Gets the APK Signature Scheme v2 signature algorithms to be used for signing an APK using the
 * provided key.
 *
 * @param minSdkVersion minimum API Level of the platform on which the APK may be installed (see
 *        AndroidManifest.xml minSdkVersion attribute).
 *
 * @throws InvalidKeyException if the provided key is not suitable for signing APKs using
 *         APK Signature Scheme v2
 */
public static List<SignatureAlgorithm> getSuggestedSignatureAlgorithms(
        PublicKey signingKey, int minSdkVersion) throws InvalidKeyException {
    String keyAlgorithm = signingKey.getAlgorithm();
    if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
        // Use RSASSA-PKCS1-v1_5 signature scheme instead of RSASSA-PSS to guarantee
        // deterministic signatures which make life easier for OTA updates (fewer files
        // changed when deterministic signature schemes are used).

        // Pick a digest which is no weaker than the key.
        int modulusLengthBits = ((RSAKey) signingKey).getModulus().bitLength();
        if (modulusLengthBits <= 3072) {
            // 3072-bit RSA is roughly 128-bit strong, meaning SHA-256 is a good fit.
            return Collections.singletonList(SignatureAlgorithm.RSA_PKCS1_V1_5_WITH_SHA256);
        } else {
            // Keys longer than 3072 bit need to be paired with a stronger digest to avoid the
            // digest being the weak link. SHA-512 is the next strongest supported digest.
            return Collections.singletonList(SignatureAlgorithm.RSA_PKCS1_V1_5_WITH_SHA512);
        }
    } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
        // DSA is supported only with SHA-256.
        return Collections.singletonList(SignatureAlgorithm.DSA_WITH_SHA256);
    } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
        // Pick a digest which is no weaker than the key.
        int keySizeBits = ((ECKey) signingKey).getParams().getOrder().bitLength();
        if (keySizeBits <= 256) {
            // 256-bit Elliptic Curve is roughly 128-bit strong, meaning SHA-256 is a good fit.
            return Collections.singletonList(SignatureAlgorithm.ECDSA_WITH_SHA256);
        } else {
            // Keys longer than 256 bit need to be paired with a stronger digest to avoid the
            // digest being the weak link. SHA-512 is the next strongest supported digest.
            return Collections.singletonList(SignatureAlgorithm.ECDSA_WITH_SHA512);
        }
    } else {
        throw new InvalidKeyException("Unsupported key algorithm: " + keyAlgorithm);
    }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
private String getPublicKeyInfo(PublicKey pk) {
    if (pk==null) return NbBundle.getMessage(CertificationPanel.class, "TXT_NotSpecified");
    else {
        String algorithm = pk.getAlgorithm();
        return algorithm==null?NbBundle.getMessage(CertificationPanel.class, "TXT_NotSpecified"):algorithm;
    }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
/**
 * Gets the JAR signing digest algorithm to be used for signing an APK using the provided key.
 *
 * @param minSdkVersion minimum API Level of the platform on which the APK may be installed (see
 *        AndroidManifest.xml minSdkVersion attribute)
 *
 * @throws InvalidKeyException if the provided key is not suitable for signing APKs using
 *         JAR signing (aka v1 signature scheme)
 */
public static DigestAlgorithm getSuggestedSignatureDigestAlgorithm(
        PublicKey signingKey, int minSdkVersion) throws InvalidKeyException {
    String keyAlgorithm = signingKey.getAlgorithm();
    if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
        // Prior to API Level 18, only SHA-1 can be used with RSA.
        if (minSdkVersion < 18) {
            return DigestAlgorithm.SHA1;
        }
        return DigestAlgorithm.SHA256;
    } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
        // Prior to API Level 21, only SHA-1 can be used with DSA
        if (minSdkVersion < 21) {
            return DigestAlgorithm.SHA1;
        } else {
            return DigestAlgorithm.SHA256;
        }
    } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
        if (minSdkVersion < 18) {
            throw new InvalidKeyException(
                    "ECDSA signatures only supported for minSdkVersion 18 and higher");
        }
        // Prior to API Level 21, only SHA-1 can be used with ECDSA
        if (minSdkVersion < 21) {
            return DigestAlgorithm.SHA1;
        } else {
            return DigestAlgorithm.SHA256;
        }
    } else {
        throw new InvalidKeyException("Unsupported key algorithm: " + keyAlgorithm);
    }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
public KeyValue newKeyValue(PublicKey key)  throws KeyException {
    String algorithm = key.getAlgorithm();
    if (algorithm.equals("DSA")) {
        return new DOMKeyValue.DSA(key);
    } else if (algorithm.equals("RSA")) {
        return new DOMKeyValue.RSA(key);
    } else if (algorithm.equals("EC")) {
        return new DOMKeyValue.EC(key);
    } else {
        throw new KeyException("unsupported key algorithm: " + algorithm);
    }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
/**
 * Returns the JCA {@link Signature} algorithm and PKCS #7 {@code SignatureAlgorithm} to use
 * when signing with the specified key and digest algorithm.
 */
private static Pair<String, AlgorithmIdentifier> getSignerInfoSignatureAlgorithm(
        PublicKey publicKey, DigestAlgorithm digestAlgorithm) throws InvalidKeyException {
    String keyAlgorithm = publicKey.getAlgorithm();
    String jcaDigestPrefixForSigAlg;
    switch (digestAlgorithm) {
        case SHA1:
            jcaDigestPrefixForSigAlg = "SHA1";
            break;
        case SHA256:
            jcaDigestPrefixForSigAlg = "SHA256";
            break;
        default:
            throw new IllegalArgumentException(
                    "Unexpected digest algorithm: " + digestAlgorithm);
    }
    if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
        return Pair.of(
                jcaDigestPrefixForSigAlg + "withRSA",
                new AlgorithmIdentifier(V1SchemeVerifier.Signer.OID_SIG_RSA, ASN1_DER_NULL));
    } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
        AlgorithmIdentifier sigAlgId;
        switch (digestAlgorithm) {
            case SHA1:
                sigAlgId =
                        new AlgorithmIdentifier(
                                V1SchemeVerifier.Signer.OID_SIG_DSA, ASN1_DER_NULL);
                break;
            case SHA256:
                // DSA signatures with SHA-256 in SignedData are accepted by Android API Level
                // 21 and higher. However, there are two ways to specify their SignedData
                // SignatureAlgorithm: dsaWithSha256 (2.16.840.1.101.3.4.3.2) and
                // dsa (1.2.840.10040.4.1). The latter works only on API Level 22+. Thus, we use
                // the former.
                sigAlgId =
                        new AlgorithmIdentifier(
                                V1SchemeVerifier.Signer.OID_SIG_SHA256_WITH_DSA, ASN1_DER_NULL);
                break;
            default:
                throw new IllegalArgumentException(
                        "Unexpected digest algorithm: " + digestAlgorithm);
        }
        return Pair.of(jcaDigestPrefixForSigAlg + "withDSA", sigAlgId);
    } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
        return Pair.of(
                jcaDigestPrefixForSigAlg + "withECDSA",
                new AlgorithmIdentifier(
                        V1SchemeVerifier.Signer.OID_SIG_EC_PUBLIC_KEY, ASN1_DER_NULL));
    } else {
        throw new InvalidKeyException("Unsupported key algorithm: " + keyAlgorithm);
    }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
/**
 * Sign SAML element.
 *
 * @param element the element
 * @param privKey the priv key
 * @param pubKey  the pub key
 * @return the element
 */
private static org.jdom.Element signSamlElement(final org.jdom.Element element, final PrivateKey privKey, final PublicKey pubKey) {
    try {
        final String providerName = System.getProperty("jsr105Provider", SIGNATURE_FACTORY_PROVIDER_CLASS);

        final XMLSignatureFactory sigFactory = XMLSignatureFactory
                .getInstance("DOM", (Provider) Class.forName(providerName).newInstance());

        final List<Transform> envelopedTransform = Collections.singletonList(sigFactory.newTransform(Transform.ENVELOPED,
                (TransformParameterSpec) null));

        final Reference ref = sigFactory.newReference(StringUtils.EMPTY, sigFactory
                .newDigestMethod(DigestMethod.SHA1, null), envelopedTransform, null, null);

        // Create the SignatureMethod based on the type of key
        final SignatureMethod signatureMethod;
        final String algorithm = pubKey.getAlgorithm();
        switch (algorithm) {
            case "DSA":
                signatureMethod = sigFactory.newSignatureMethod(SignatureMethod.DSA_SHA1, null);
                break;
            case "RSA":
                signatureMethod = sigFactory.newSignatureMethod(SignatureMethod.RSA_SHA1, null);
                break;
            default:
                throw new RuntimeException("Error signing SAML element: Unsupported type of key");
        }

        final CanonicalizationMethod canonicalizationMethod = sigFactory
                .newCanonicalizationMethod(
                        CanonicalizationMethod.INCLUSIVE_WITH_COMMENTS,
                        (C14NMethodParameterSpec) null);

        // Create the SignedInfo
        final SignedInfo signedInfo = sigFactory.newSignedInfo(
                canonicalizationMethod, signatureMethod, Collections.singletonList(ref));

        // Create a KeyValue containing the DSA or RSA PublicKey
        final KeyInfoFactory keyInfoFactory = sigFactory.getKeyInfoFactory();
        final KeyValue keyValuePair = keyInfoFactory.newKeyValue(pubKey);

        // Create a KeyInfo and add the KeyValue to it
        final KeyInfo keyInfo = keyInfoFactory.newKeyInfo(Collections.singletonList(keyValuePair));
        // Convert the JDOM document to w3c (Java XML signature API requires w3c representation)
        final Element w3cElement = toDom(element);

        // Create a DOMSignContext and specify the DSA/RSA PrivateKey and
        // location of the resulting XMLSignature's parent element
        final DOMSignContext dsc = new DOMSignContext(privKey, w3cElement);

        final Node xmlSigInsertionPoint = getXmlSignatureInsertLocation(w3cElement);
        dsc.setNextSibling(xmlSigInsertionPoint);

        // Marshal, generate (and sign) the enveloped signature
        final XMLSignature signature = sigFactory.newXMLSignature(signedInfo, keyInfo);
        signature.sign(dsc);

        return toJdom(w3cElement);

    } catch (final Exception e) {
        throw new RuntimeException("Error signing SAML element: " + e.getMessage(), e);
    }
}
 

import java.security.PublicKey; //导入方法依赖的package包/类
/**
 * Returns the JCA {@link Signature} algorithm and {@code SignerInfo} {@code SignatureAlgorithm}
 * to use for {@code SignerInfo} which signs with the specified key and digest algorithms.
 */
@SuppressWarnings("restriction")
private static Pair<String, AlgorithmId> getSignerInfoSignatureAlgorithm(
        PublicKey publicKey, DigestAlgorithm digestAlgorithm) throws InvalidKeyException {
    // NOTE: This method on purpose uses hard-coded OIDs instead of
    // Algorithm.getId(JCA Signature Algorithm). This is to ensure that the generated SignedData
    // is compatible with all targeted Android platforms and is not dependent on changes in the
    // JCA Signature Algorithm -> OID mappings maintained by AlgorithmId.get(String).

    String keyAlgorithm = publicKey.getAlgorithm();
    String digestPrefixForSigAlg;
    switch (digestAlgorithm) {
        case SHA1:
            digestPrefixForSigAlg = "SHA1";
            break;
        case SHA256:
            digestPrefixForSigAlg = "SHA256";
            break;
        default:
            throw new IllegalArgumentException(
                    "Unexpected digest algorithm: " + digestAlgorithm);
    }
    if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
        return Pair.of(
                digestPrefixForSigAlg + "withRSA",
                getSupportedAlgorithmId("1.2.840.113549.1.1.1") // RSA encryption
                );
    } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
        AlgorithmId sigAlgId;
        switch (digestAlgorithm) {
            case SHA1:
                sigAlgId = getSupportedAlgorithmId("1.2.840.10040.4.1"); // DSA
                break;
            case SHA256:
                // DSA signatures with SHA-256 in SignedData are accepted by Android API Level
                // 21 and higher. However, there are two ways to specify their SignedData
                // SignatureAlgorithm: dsaWithSha256 (2.16.840.1.101.3.4.3.2) and
                // dsa (1.2.840.10040.4.1). The latter works only on API Level 22+. Thus, we use
                // the former.
                sigAlgId =
                        getSupportedAlgorithmId("2.16.840.1.101.3.4.3.2"); // DSA with SHA-256
                break;
            default:
                throw new IllegalArgumentException(
                        "Unexpected digest algorithm: " + digestAlgorithm);
        }
        return Pair.of(digestPrefixForSigAlg + "withDSA", sigAlgId);
    } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
        return Pair.of(
                digestPrefixForSigAlg + "withECDSA",
                getSupportedAlgorithmId("1.2.840.10045.2.1") // EC public key
                );
    } else {
        throw new InvalidKeyException("Unsupported key algorithm: " + keyAlgorithm);
    }
}