在iOS中使用RSA加密解密,需要用到.der和.p12后綴格式的文件,其中.der格式的文件存放的是公鑰(Public key)用于加密,.p12格式的文件存放的是私鑰(Private key)用于解密. 首先需要先生成這些文件,然后再將文件導(dǎo)入工程使用功偿,不多說,開始做往堡!
一械荷、使用openssl生成所需秘鑰文件
生成環(huán)境是在mac系統(tǒng)下共耍,使用openssl進行生成,首先打開終端吨瞎,按下面這些步驟依次來做:
1. 生成模長為1024bit的私鑰文件private_key.pem
openssl genrsa -out private.pem 1024
2. 生成證書請求文件rsaCertReq.csr
openssl req -new -key private_key.pem -out rsaCerReq.csr
注意:這一步會提示輸入國家痹兜、省份、mail等信息颤诀,可以根據(jù)實際情況填寫字旭,或者全部不用填寫,直接全部敲回車.
3. 生成證書rsaCert.crt崖叫,并設(shè)置有效時間為10年
openssl x509 -req -days 3650 -in rsaCerReq.csr -signkey private_key.pem -out rsaCert.crt
4. 生成供iOS使用的公鑰文件public_key.der
openssl x509 -outform der -inrsaCert.crt-out public_key.der
5. 生成供iOS使用的私鑰文件private_key.p12
openssl pkcs12 -export -out private_key.p12 -inkey private_key.pem -in rsaCert.crt
注意:這一步會提示給私鑰文件設(shè)置密碼遗淳,直接輸入想要設(shè)置密碼即可,然后敲回車心傀,然后再驗證剛才設(shè)置的密碼屈暗,再次輸入密碼,然后敲回車剧包,完畢恐锦!
在解密時往果,private_key.p12文件需要和這里設(shè)置的密碼配合使用疆液,因此需要牢記此密碼.
6. 生成供Java使用的公鑰rsa_public_key.pem
openssl rsa -in private_key.pem -out rsa_public_key.pem -pubout
7. 生成供Java使用的私鑰pkcs8_private_key.pem
openssl pkcs8 -topk8 -inprivate_key.pem -out pkcs8_private_key.pem -nocrypt
全部執(zhí)行成功后,會生成如下文件陕贮,其中public_key.der和private_key.p12就是iOS需要用到的文件堕油,如下圖:
生成的文件
二、將文件導(dǎo)入工程使用
1.新建工程, 并導(dǎo)入Security.framework框架, 如下圖:
新建工程并添加框架
2.導(dǎo)入秘鑰文件
導(dǎo)入.der和.p12格式的秘鑰文件, 如下圖:
導(dǎo)入秘鑰文件
3.新建用于加密肮之、解密的類RSAEncryptor, 并實現(xiàn)相關(guān)方法
新建RSAEncryptor類, 如下圖:
新建用于加密解密的類
下面開始上代碼, 可以直接復(fù)制過去用:
RSAEncryptor.h代碼如下:
//
//RSAEncryptor.h
//毛票食堂
//
//Created by Apple on 17/2/11.
//Copyright ? 2017年P(guān)andora. All rights reserved.
//
#import
@interfaceRSAEncryptor :NSObject
/**
*加密方法
*
*@param str需要加密的字符串
*@param path'.der'格式的公鑰文件路徑
*/
+ (NSString*)encryptString:(NSString*)str publicKeyWithContentsOfFile:(NSString*)path;
/**
*解密方法
*
*@param str需要解密的字符串
*@param path'.p12'格式的私鑰文件路徑
*@param password私鑰文件密碼
*/
+ (NSString*)decryptString:(NSString*)str privateKeyWithContentsOfFile:(NSString*)path password:(NSString*)password;
/**
*加密方法
*
*@param str需要加密的字符串
*@param pubKey公鑰字符串
*/
+ (NSString*)encryptString:(NSString*)str publicKey:(NSString*)pubKey;
/**
*解密方法
*
*@param str需要解密的字符串
*@param privKey私鑰字符串
*/
+ (NSString*)decryptString:(NSString*)str privateKey:(NSString*)privKey;
@end
//
//RSAEncryptor.m
//毛票食堂
//
//Created by Apple on 17/2/11.
//Copyright ? 2017年P(guān)andora. All rights reserved.
//
#import"RSAEncryptor.h"
//RSAEncryptor.m代碼如下:
#import"RSAEncryptor.h"
#import
@implementationRSAEncryptor
staticNSString*base64_encode_data(NSData*data){
data = [database64EncodedDataWithOptions:0];
NSString*ret = [[NSStringalloc]initWithData:dataencoding:NSUTF8StringEncoding];
returnret;
}
staticNSData*base64_decode(NSString*str){
NSData*data = [[NSDataalloc]initWithBase64EncodedString:stroptions:NSDataBase64DecodingIgnoreUnknownCharacters];
returndata;
}
#pragma mark -使用'.der'公鑰文件加密
//加密
+ (NSString*)encryptString:(NSString*)str publicKeyWithContentsOfFile:(NSString*)path{
if(!str || !path)returnnil;
return[selfencryptString:strpublicKeyRef:[selfgetPublicKeyRefWithContentsOfFile:path]];
}
//獲取公鑰
+ (SecKeyRef)getPublicKeyRefWithContentsOfFile:(NSString*)filePath{
NSData*certData = [NSDatadataWithContentsOfFile:filePath];
if(!certData) {
returnnil;
}
SecCertificateRefcert =SecCertificateCreateWithData(NULL, (CFDataRef)certData);
SecKeyRefkey =NULL;
SecTrustReftrust =NULL;
SecPolicyRefpolicy =NULL;
if(cert !=NULL) {
policy =SecPolicyCreateBasicX509();
if(policy) {
if(SecTrustCreateWithCertificates((CFTypeRef)cert, policy, &trust) ==noErr) {
SecTrustResultTyperesult;
if(SecTrustEvaluate(trust, &result) ==noErr) {
key =SecTrustCopyPublicKey(trust);
}
}
}
}
if(policy)CFRelease(policy);
if(trust)CFRelease(trust);
if(cert)CFRelease(cert);
returnkey;
}
+ (NSString*)encryptString:(NSString*)str publicKeyRef:(SecKeyRef)publicKeyRef{
if(![strdataUsingEncoding:NSUTF8StringEncoding]){
returnnil;
}
if(!publicKeyRef){
returnnil;
}
NSData*data = [selfencryptData:[strdataUsingEncoding:NSUTF8StringEncoding]withKeyRef:publicKeyRef];
NSString*ret =base64_encode_data(data);
returnret;
}
#pragma mark -使用'.12'私鑰文件解密
//解密
+ (NSString*)decryptString:(NSString*)str privateKeyWithContentsOfFile:(NSString*)path password:(NSString*)password{
if(!str || !path)returnnil;
if(!password) password =@"";
return[selfdecryptString:strprivateKeyRef:[selfgetPrivateKeyRefWithContentsOfFile:pathpassword:password]];
}
//獲取私鑰
+ (SecKeyRef)getPrivateKeyRefWithContentsOfFile:(NSString*)filePath password:(NSString*)password{
NSData*p12Data = [NSDatadataWithContentsOfFile:filePath];
if(!p12Data) {
returnnil;
}
SecKeyRefprivateKeyRef =NULL;
NSMutableDictionary* options = [[NSMutableDictionaryalloc]init];
[optionssetObject: passwordforKey:(__bridgeid)kSecImportExportPassphrase];
CFArrayRefitems =CFArrayCreate(NULL,0,0,NULL);
OSStatussecurityError =SecPKCS12Import((__bridgeCFDataRef) p12Data, (__bridgeCFDictionaryRef)options, &items);
if(securityError ==noErr&&CFArrayGetCount(items) >0) {
CFDictionaryRefidentityDict =CFArrayGetValueAtIndex(items,0);
SecIdentityRefidentityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict,kSecImportItemIdentity);
securityError =SecIdentityCopyPrivateKey(identityApp, &privateKeyRef);
if(securityError !=noErr) {
privateKeyRef =NULL;
}
}
CFRelease(items);
returnprivateKeyRef;
}
+ (NSString*)decryptString:(NSString*)str privateKeyRef:(SecKeyRef)privKeyRef{
NSData*data = [[NSDataalloc]initWithBase64EncodedString:stroptions:NSDataBase64DecodingIgnoreUnknownCharacters];
if(!privKeyRef) {
returnnil;
}
data = [selfdecryptData:datawithKeyRef:privKeyRef];
NSString*ret = [[NSStringalloc]initWithData:dataencoding:NSUTF8StringEncoding];
returnret;
}
#pragma mark -使用公鑰字符串加密
/* START: Encryption with RSA public key */
//使用公鑰字符串加密
+ (NSString*)encryptString:(NSString*)str publicKey:(NSString*)pubKey{
NSData*data = [selfencryptData:[strdataUsingEncoding:NSUTF8StringEncoding]publicKey:pubKey];
NSString*ret =base64_encode_data(data);
returnret;
}
+ (NSData*)encryptData:(NSData*)data publicKey:(NSString*)pubKey{
if(!data || !pubKey){
returnnil;
}
SecKeyRefkeyRef = [selfaddPublicKey:pubKey];
if(!keyRef){
returnnil;
}
return[selfencryptData:datawithKeyRef:keyRef];
}
+ (SecKeyRef)addPublicKey:(NSString*)key{
NSRangespos = [keyrangeOfString:@"-----BEGIN PUBLIC KEY-----"];
NSRangeepos = [keyrangeOfString:@"-----END PUBLIC KEY-----"];
if(spos.location!=NSNotFound&& epos.location!=NSNotFound){
NSUIntegers = spos.location+ spos.length;
NSUIntegere = epos.location;
NSRangerange =NSMakeRange(s, e-s);
key = [keysubstringWithRange:range];
}
key = [keystringByReplacingOccurrencesOfString:@"\r"withString:@""];
key = [keystringByReplacingOccurrencesOfString:@"\n"withString:@""];
key = [keystringByReplacingOccurrencesOfString:@"\t"withString:@""];
key = [keystringByReplacingOccurrencesOfString:@" "withString:@""];
// This will be base64 encoded, decode it.
NSData*data =base64_decode(key);
data = [selfstripPublicKeyHeader:data];
if(!data){
returnnil;
}
//a tag to read/write keychain storage
NSString*tag =@"RSAUtil_PubKey";
NSData*d_tag = [NSDatadataWithBytes:[tagUTF8String]length:[taglength]];
// Delete any old lingering key with the same tag
NSMutableDictionary*publicKey = [[NSMutableDictionaryalloc]init];
[publicKeysetObject:(__bridgeid)kSecClassKeyforKey:(__bridgeid)kSecClass];
[publicKeysetObject:(__bridgeid)kSecAttrKeyTypeRSAforKey:(__bridgeid)kSecAttrKeyType];
[publicKeysetObject:d_tagforKey:(__bridgeid)kSecAttrApplicationTag];
SecItemDelete((__bridgeCFDictionaryRef)publicKey);
// Add persistent version of the key to system keychain
[publicKeysetObject:dataforKey:(__bridgeid)kSecValueData];
[publicKeysetObject:(__bridgeid)kSecAttrKeyClassPublicforKey:(__bridgeid)
kSecAttrKeyClass];
[publicKeysetObject:[NSNumbernumberWithBool:YES]forKey:(__bridgeid)
kSecReturnPersistentRef];
CFTypeRefpersistKey =nil;
OSStatusstatus =SecItemAdd((__bridgeCFDictionaryRef)publicKey, &persistKey);
if(persistKey !=nil){
CFRelease(persistKey);
}
if((status !=noErr) && (status !=errSecDuplicateItem)) {
returnnil;
}
[publicKeyremoveObjectForKey:(__bridgeid)kSecValueData];
[publicKeyremoveObjectForKey:(__bridgeid)kSecReturnPersistentRef];
[publicKeysetObject:[NSNumbernumberWithBool:YES]forKey:(__bridgeid)kSecReturnRef];
[publicKeysetObject:(__bridgeid)kSecAttrKeyTypeRSAforKey:(__bridgeid)kSecAttrKeyType];
// Now fetch the SecKeyRef version of the key
SecKeyRefkeyRef =nil;
status =SecItemCopyMatching((__bridgeCFDictionaryRef)publicKey, (CFTypeRef*)&keyRef);
if(status !=noErr){
returnnil;
}
returnkeyRef;
}
+ (NSData*)stripPublicKeyHeader:(NSData*)d_key{
// Skip ASN.1 public key header
if(d_key ==nil)return(nil);
unsignedlonglen = [d_keylength];
if(!len)return(nil);
unsignedchar*c_key = (unsignedchar*)[d_keybytes];
unsignedintidx=0;
if(c_key[idx++] !=0x30)return(nil);
if(c_key[idx] >0x80) idx += c_key[idx] -0x80+1;
elseidx++;
// PKCS #1 rsaEncryption szOID_RSA_RSA
staticunsignedcharseqiod[] =
{0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,
0x01,0x05,0x00};
if(memcmp(&c_key[idx], seqiod,15))return(nil);
idx +=15;
if(c_key[idx++] !=0x03)return(nil);
if(c_key[idx] >0x80) idx += c_key[idx] -0x80+1;
elseidx++;
if(c_key[idx++] !='\0')return(nil);
// Now make a new NSData from this buffer
return([NSDatadataWithBytes:&c_key[idx]length:len - idx]);
}
+ (NSData*)encryptData:(NSData*)data withKeyRef:(SecKeyRef) keyRef{
constuint8_t*srcbuf = (constuint8_t*)[databytes];
size_tsrclen = (size_t)data.length;
size_tblock_size =SecKeyGetBlockSize(keyRef) *sizeof(uint8_t);
void*outbuf =malloc(block_size);
size_tsrc_block_size = block_size -11;
NSMutableData*ret = [[NSMutableDataalloc]init];
for(intidx=0; idx
//NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
size_tdata_len = srclen - idx;
if(data_len > src_block_size){
data_len = src_block_size;
}
size_toutlen = block_size;
OSStatusstatus =noErr;
status =SecKeyEncrypt(keyRef,
kSecPaddingPKCS1,
srcbuf + idx,
data_len,
outbuf,
&outlen
);
if(status !=0) {
NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
ret =nil;
break;
}else{
[retappendBytes:outbuflength:outlen];
}
}
free(outbuf);
CFRelease(keyRef);
returnret;
}
/* END: Encryption with RSA public key */
#pragma mark -使用私鑰字符串解密
/* START: Decryption with RSA private key */
//使用私鑰字符串解密
+ (NSString*)decryptString:(NSString*)str privateKey:(NSString*)privKey{
if(!str)returnnil;
NSData*data = [[NSDataalloc]initWithBase64EncodedString:stroptions:NSDataBase64DecodingIgnoreUnknownCharacters];
data = [selfdecryptData:dataprivateKey:privKey];
NSString*ret = [[NSStringalloc]initWithData:dataencoding:NSUTF8StringEncoding];
returnret;
}
+ (NSData*)decryptData:(NSData*)data privateKey:(NSString*)privKey{
if(!data || !privKey){
returnnil;
}
SecKeyRefkeyRef = [selfaddPrivateKey:privKey];
if(!keyRef){
returnnil;
}
return[selfdecryptData:datawithKeyRef:keyRef];
}
+ (SecKeyRef)addPrivateKey:(NSString*)key{
NSRangespos = [keyrangeOfString:@"-----BEGIN RSA PRIVATE KEY-----"];
NSRangeepos = [keyrangeOfString:@"-----END RSA PRIVATE KEY-----"];
if(spos.location!=NSNotFound&& epos.location!=NSNotFound){
NSUIntegers = spos.location+ spos.length;
NSUIntegere = epos.location;
NSRangerange =NSMakeRange(s, e-s);
key = [keysubstringWithRange:range];
}
key = [keystringByReplacingOccurrencesOfString:@"\r"withString:@""];
key = [keystringByReplacingOccurrencesOfString:@"\n"withString:@""];
key = [keystringByReplacingOccurrencesOfString:@"\t"withString:@""];
key = [keystringByReplacingOccurrencesOfString:@" "withString:@""];
// This will be base64 encoded, decode it.
NSData*data =base64_decode(key);
data = [selfstripPrivateKeyHeader:data];
if(!data){
returnnil;
}
//a tag to read/write keychain storage
NSString*tag =@"RSAUtil_PrivKey";
NSData*d_tag = [NSDatadataWithBytes:[tagUTF8String]length:[taglength]];
// Delete any old lingering key with the same tag
NSMutableDictionary*privateKey = [[NSMutableDictionaryalloc]init];
[privateKeysetObject:(__bridgeid)kSecClassKeyforKey:(__bridgeid)kSecClass];
[privateKeysetObject:(__bridgeid)kSecAttrKeyTypeRSAforKey:(__bridgeid)kSecAttrKeyType];
[privateKeysetObject:d_tagforKey:(__bridgeid)kSecAttrApplicationTag];
SecItemDelete((__bridgeCFDictionaryRef)privateKey);
// Add persistent version of the key to system keychain
[privateKeysetObject:dataforKey:(__bridgeid)kSecValueData];
[privateKeysetObject:(__bridgeid)kSecAttrKeyClassPrivateforKey:(__bridgeid)
kSecAttrKeyClass];
[privateKeysetObject:[NSNumbernumberWithBool:YES]forKey:(__bridgeid)
kSecReturnPersistentRef];
CFTypeRefpersistKey =nil;
OSStatusstatus =SecItemAdd((__bridgeCFDictionaryRef)privateKey, &persistKey);
if(persistKey !=nil){
CFRelease(persistKey);
}
if((status !=noErr) && (status !=errSecDuplicateItem)) {
returnnil;
}
[privateKeyremoveObjectForKey:(__bridgeid)kSecValueData];
[privateKeyremoveObjectForKey:(__bridgeid)kSecReturnPersistentRef];
[privateKeysetObject:[NSNumbernumberWithBool:YES]forKey:(__bridgeid)kSecReturnRef];
[privateKeysetObject:(__bridgeid)kSecAttrKeyTypeRSAforKey:(__bridgeid)kSecAttrKeyType];
// Now fetch the SecKeyRef version of the key
SecKeyRefkeyRef =nil;
status =SecItemCopyMatching((__bridgeCFDictionaryRef)privateKey, (CFTypeRef*)&keyRef);
if(status !=noErr){
returnnil;
}
returnkeyRef;
}
+ (NSData*)stripPrivateKeyHeader:(NSData*)d_key{
// Skip ASN.1 private key header
if(d_key ==nil)return(nil);
unsignedlonglen = [d_keylength];
if(!len)return(nil);
unsignedchar*c_key = (unsignedchar*)[d_keybytes];
unsignedintidx=22;//magic byte at offset 22
if(0x04!= c_key[idx++])returnnil;
//calculate length of the key
unsignedintc_len = c_key[idx++];
intdet = c_len &0x80;
if(!det) {
c_len = c_len &0x7f;
}else{
intbyteCount = c_len &0x7f;
if(byteCount + idx > len) {
//rsa length field longer than buffer
returnnil;
}
unsignedintaccum =0;
unsignedchar*ptr = &c_key[idx];
idx += byteCount;
while(byteCount) {
accum = (accum <<8) + *ptr;
ptr++;
byteCount--;
}
c_len = accum;
}
// Now make a new NSData from this buffer
return[d_keysubdataWithRange:NSMakeRange(idx, c_len)];
}
+ (NSData*)decryptData:(NSData*)data withKeyRef:(SecKeyRef) keyRef{
constuint8_t*srcbuf = (constuint8_t*)[databytes];
size_tsrclen = (size_t)data.length;
size_tblock_size =SecKeyGetBlockSize(keyRef) *sizeof(uint8_t);
UInt8*outbuf =malloc(block_size);
size_tsrc_block_size = block_size;
NSMutableData*ret = [[NSMutableDataalloc]init];
for(intidx=0; idx
//NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
size_tdata_len = srclen - idx;
if(data_len > src_block_size){
data_len = src_block_size;
}
size_toutlen = block_size;
OSStatusstatus =noErr;
status =SecKeyDecrypt(keyRef,
kSecPaddingNone,
srcbuf + idx,
data_len,
outbuf,
&outlen
);
if(status !=0) {
NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
ret =nil;
break;
}else{
//the actual decrypted data is in the middle, locate it!
intidxFirstZero = -1;
intidxNextZero = (int)outlen;
for(inti =0; i < outlen; i++ ) {
if( outbuf[i] ==0) {
if( idxFirstZero <0) {
idxFirstZero = i;
}else{
idxNextZero = i;
break;
}
}
}
[retappendBytes:&outbuf[idxFirstZero+1]length:idxNextZero-idxFirstZero-1];
}
}
free(outbuf);
CFRelease(keyRef);
returnret;
}
/* END: Decryption with RSA private key */
@end