DH，全稱為“Diffie-Hellman”，是一種確保共享KEY安全穿越不安全網(wǎng)絡(luò)的方法，也就是常說的密鑰一致協(xié)議。由公開密鑰密碼體制的奠基人Diffie和Hellman所提出的一種思想。

簡單的說就是允許兩名用戶在公開媒體上交換信息以生成“一致”的、可以共享的密鑰。也就是由甲方產(chǎn)出一對密鑰（公鑰、私鑰），乙方依照甲方公鑰產(chǎn)生乙方密鑰對（公鑰、私鑰）。

以此為基線，作為數(shù)據(jù)傳輸保密基礎(chǔ)，同時雙方使用同一種對稱加密算法構(gòu)建本地密鑰（SecretKey）對數(shù)據(jù)加密。這樣，在互通了本地密鑰（SecretKey）算法后，甲乙雙方公開自己的公鑰，使用對方的公鑰和剛才產(chǎn)生的私鑰加密數(shù)據(jù)，同時可以使用對方的公鑰和自己的私鑰對數(shù)據(jù)解密。不單單是甲乙雙方兩方，可以擴展為多方共享數(shù)據(jù)通訊，這樣就完成了網(wǎng)絡(luò)交互數(shù)據(jù)的安全通訊！

DH算法的通信模型：

• 甲方將自己的公鑰發(fā)給乙方
• 乙方根據(jù)甲方發(fā)來的公鑰，生成自己的公鑰和私鑰
• 乙方將自己的公鑰發(fā)送給甲方
• 甲方和乙方，生成一樣的秘鑰。用于加密數(shù)據(jù)

import java.security.InvalidKeyException;  
import java.security.KeyFactory;  
import java.security.KeyPair;  
import java.security.KeyPairGenerator;  
import java.security.NoSuchAlgorithmException;  
import java.security.PrivateKey;  
import java.security.PublicKey;  
import java.security.spec.PKCS8EncodedKeySpec;  
import java.security.spec.X509EncodedKeySpec;  
import java.util.HashMap;  
import java.util.Map;  
import javax.crypto.BadPaddingException;  
import javax.crypto.Cipher;  
import javax.crypto.IllegalBlockSizeException;  
import javax.crypto.KeyAgreement;  
import javax.crypto.NoSuchPaddingException;  
import javax.crypto.SecretKey;  
import javax.crypto.interfaces.DHPrivateKey;  
import javax.crypto.interfaces.DHPublicKey;  
import javax.crypto.spec.DHParameterSpec;  
  
public class DHUtil {  
    /** 
     * 定義加密方式 
     */  
    private static final String KEY_DH = "DH";  
    public static final String PUBLIC_KEY = "DHPublicKey";  
    public static final String PRIVATE_KEY = "DHPrivateKey";  
    // 開始生成本地密鑰SecretKey 密鑰算法為對稱密碼算法  
    // 可以為 DES DES AES  
    public static final String KEY_DH_DES = "DES";  
  
    /** 
     * 甲方初始化并返回密鑰對 
     * @return 
     */  
    public static Map<String, Object> initKey() {  
        try {  
            // 實例化密鑰對生成器  
            KeyPairGenerator keyPairGenerator = KeyPairGenerator  
                    .getInstance(KEY_DH);  
            // 初始化密鑰對生成器 默認是1024 512-1024 & 64的倍數(shù)  
            keyPairGenerator.initialize(1024);  
            // 生成密鑰對  
            KeyPair keyPair = keyPairGenerator.generateKeyPair();  
            // 得到甲方公鑰  
            DHPublicKey publicKey = (DHPublicKey) keyPair.getPublic();  
            // 得到甲方私鑰  
            DHPrivateKey privateKey = (DHPrivateKey) keyPair.getPrivate();  
            // 將公鑰和私鑰封裝在Map中， 方便之后使用  
            Map<String, Object> keyMap = new HashMap<String, Object>();  
            keyMap.put(PUBLIC_KEY, publicKey);  
            keyMap.put(PRIVATE_KEY, privateKey);  
            return keyMap;  
        } catch (Exception e) {  
            throw new RuntimeException(e);  
        }  
    }  
    /** 
     * 乙方根據(jù)甲方公鑰初始化并返回密鑰對 
     * @param key 
     * 甲方的公鑰 
     * @return 
     */  
    public static Map<String, Object> initKey(byte[] key) {  
        try {  
            // 將甲方公鑰從字節(jié)數(shù)組轉(zhuǎn)換為PublicKey  
            X509EncodedKeySpec keySpec = new X509EncodedKeySpec(key);  
            // 實例化密鑰工廠  
            KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);  
            // 產(chǎn)生甲方公鑰pubKey  
            DHPublicKey dhPublicKey = (DHPublicKey) keyFactory  
                    .generatePublic(keySpec);  
            // 剖析甲方公鑰，得到其參數(shù)  
            DHParameterSpec dhParameterSpec = dhPublicKey.getParams();  
            // 實例化密鑰對生成器  
            KeyPairGenerator keyPairGenerator = KeyPairGenerator  
                    .getInstance(KEY_DH);  
            // 用甲方公鑰初始化密鑰對生成器  
            keyPairGenerator.initialize(dhParameterSpec);  
            // 產(chǎn)生密鑰對  
            KeyPair keyPair = keyPairGenerator.generateKeyPair();  
            // 得到乙方公鑰  
            DHPublicKey publicKey = (DHPublicKey) keyPair.getPublic();  
            // 得到乙方私鑰  
            DHPrivateKey privateKey = (DHPrivateKey) keyPair.getPrivate();  
            // 將公鑰和私鑰封裝在Map中， 方便之后使用  
            Map<String, Object> keyMap = new HashMap<String, Object>();  
            keyMap.put(PUBLIC_KEY, publicKey);  
            keyMap.put(PRIVATE_KEY, privateKey);  
            return keyMap;  
        } catch (Exception e) {  
            throw new RuntimeException(e);  
        }  
    }  
    /** 
     * 根據(jù)對方的公鑰和自己的私鑰生成 本地密鑰,返回的是SecretKey對象的字節(jié)數(shù)組 
     * @param publicKey 
     *            公鑰 
     * @param privateKey 
     *            私鑰 
     * @return 
     */  
    public static byte[] getSecretKeyBytes(byte[] publicKey, byte[] privateKey) {  
        try {  
            // 實例化密鑰工廠  
            KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);  
            // 將公鑰從字節(jié)數(shù)組轉(zhuǎn)換為PublicKey  
            X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(publicKey);  
            PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);  
            // 將私鑰從字節(jié)數(shù)組轉(zhuǎn)換為PrivateKey  
            PKCS8EncodedKeySpec priKeySpec = new PKCS8EncodedKeySpec(privateKey);  
            PrivateKey priKey = keyFactory.generatePrivate(priKeySpec);  
  
            // 準備根據(jù)以上公鑰和私鑰生成本地密鑰SecretKey  
            // 先實例化KeyAgreement  
            KeyAgreement keyAgreement = KeyAgreement.getInstance(KEY_DH);  
            // 用自己的私鑰初始化keyAgreement  
            keyAgreement.init(priKey);  
            // 結(jié)合對方的公鑰進行運算  
            keyAgreement.doPhase(pubKey, true);  
            // 開始生成本地密鑰SecretKey 密鑰算法為對稱密碼算法  
            SecretKey secretKey = keyAgreement.generateSecret(KEY_DH_DES);  
            return secretKey.getEncoded();  
        } catch (Exception e) {  
            throw new RuntimeException(e);  
        }
    }  
    /** 
     * 根據(jù)對方的公鑰和自己的私鑰生成 本地密鑰,返回的是SecretKey對象 
     * @param publicKey 
     *            公鑰 
     * @param privateKey 
     *            私鑰 
     * @return 
     */  
    public static SecretKey getSecretKey(byte[] publicKey, byte[] privateKey) {  
        try {  
            // 實例化密鑰工廠  
            KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);  
            // 將公鑰從字節(jié)數(shù)組轉(zhuǎn)換為PublicKey  
            X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(publicKey);  
            PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);  
            // 將私鑰從字節(jié)數(shù)組轉(zhuǎn)換為PrivateKey  
            PKCS8EncodedKeySpec priKeySpec = new PKCS8EncodedKeySpec(privateKey);  
            PrivateKey priKey = keyFactory.generatePrivate(priKeySpec);  
  
            // 準備根據(jù)以上公鑰和私鑰生成本地密鑰SecretKey  
            // 先實例化KeyAgreement  
            KeyAgreement keyAgreement = KeyAgreement.getInstance(KEY_DH);  
            // 用自己的私鑰初始化keyAgreement  
            keyAgreement.init(priKey);  
            // 結(jié)合對方的公鑰進行運算  
            keyAgreement.doPhase(pubKey, true);  
            // 開始生成本地密鑰SecretKey 密鑰算法為對稱密碼算法  
            SecretKey secretKey = keyAgreement.generateSecret(KEY_DH_DES);  
            return secretKey;  
        } catch (Exception e) {  
            throw new RuntimeException(e);  
        }    
    }    
    /** 
     * 從 Map 中取得公鑰 
     *  
     * @param keyMap 
     * @return 
     */  
    public static byte[] getPublicKey(Map<String, Object> keyMap) {  
        DHPublicKey key = (DHPublicKey) keyMap.get(PUBLIC_KEY);  
        return key.getEncoded();  
    }  
    /** 
     * 從 Map 中取得私鑰 
     * @param keyMap 
     * @return 
     */  
    public static byte[] getPrivateKey(Map<String, Object> keyMap) {  
        DHPrivateKey key = (DHPrivateKey) keyMap.get(PRIVATE_KEY);  
        return key.getEncoded();  
    }  
    /** 
     * DH 加密 
     *  
     * @param data 
     *            帶加密數(shù)據(jù) 
     * @param publicKey 
     *            甲方公鑰 
     * @param privateKey 
     *            乙方私鑰 
     * @return 
     */  
    public static byte[] encryptDH(byte[] data, byte[] publicKey,  
            byte[] privateKey) {  
        byte[] bytes = null;  
        try {  
            //  
            SecretKey secretKey = getSecretKey(publicKey, privateKey);  
            // 數(shù)據(jù)加密  
            Cipher cipher = Cipher.getInstance(secretKey.getAlgorithm());  
            cipher.init(Cipher.ENCRYPT_MODE, secretKey);  
            bytes = cipher.doFinal(data);  
        } catch (NoSuchAlgorithmException e) {  
            e.printStackTrace();  
        } catch (NoSuchPaddingException e) {  
            e.printStackTrace();  
        } catch (InvalidKeyException e) {  
            e.printStackTrace();  
        } catch (BadPaddingException e) {  
            e.printStackTrace();  
        } catch (IllegalBlockSizeException e) {  
            e.printStackTrace();  
        }  
        return bytes;  
    }  
  
    /** 
     * DH 解密 
     *  
     * @param data 
     *            待解密數(shù)據(jù) 
     * @param publicKey 
     *            乙方公鑰 
     * @param privateKey 
     *            甲方私鑰 
     * @return 
     */  
    public static byte[] decryptDH(byte[] data, byte[] publicKey,  
            byte[] privateKey) {  
        byte[] bytes = null;  
        try {  
            //  
            SecretKey secretKey = getSecretKey(publicKey, privateKey);  
            // 數(shù)據(jù)加密  
            Cipher cipher = Cipher.getInstance(secretKey.getAlgorithm());  
            cipher.init(Cipher.DECRYPT_MODE, secretKey);  
            bytes = cipher.doFinal(data);  
        } catch (NoSuchAlgorithmException e) {  
            e.printStackTrace();  
        } catch (NoSuchPaddingException e) {  
            e.printStackTrace();  
        } catch (InvalidKeyException e) {  
            e.printStackTrace();  
        } catch (BadPaddingException e) {  
            e.printStackTrace();  
        } catch (IllegalBlockSizeException e) {  
            e.printStackTrace();  
        }  
        return bytes;  
    }  
  
}  

字節(jié)數(shù)組轉(zhuǎn)16進制

public class BytesToHex {  
  
    public static String fromBytesToHex(byte[] resultBytes) {  
        StringBuilder builder = new StringBuilder();  
        for (int i = 0; i < resultBytes.length; i++) {  
            if (Integer.toHexString(0xFF & resultBytes[i]).length() == 1) {  
                builder.append("0").append(  
                        Integer.toHexString(0xFF & resultBytes[i]));  
            } else {  
                builder.append(Integer.toHexString(0xFF & resultBytes[i]));  
            }  
        }  
        return builder.toString();  
    }   
}  

測試代碼

import java.util.Map;  
  
public class Test {  
    // 待加密的明文  
    public static final String DATA = "test";  
  
    public static void main(String[] args) throws Exception {  
        /* Test DH */  
        // 甲方公鑰  
        byte[] publicKey1;  
        // 甲方私鑰  
        byte[] privateKey1;  
        // 甲方本地密鑰  
        byte[] secretKey1;  
        // 乙方公鑰  
        byte[] publicKey2;  
        // 乙方私鑰  
        byte[] privateKey2;  
        // 乙方本地密鑰  
        byte[] secretKey2;  
  
        // 初始化密鑰 并生成甲方密鑰對  
        Map<String, Object> keyMap1 = DHUtil.initKey();  
        publicKey1 = DHUtil.getPublicKey(keyMap1);  
        privateKey1 = DHUtil.getPrivateKey(keyMap1);  
        System.out  
                .println("DH 甲方公鑰 : " + BytesToHex.fromBytesToHex(publicKey1));  
        System.out.println("DH 甲方私鑰 : "  
                + BytesToHex.fromBytesToHex(privateKey1));  
  
        // 乙方根據(jù)甲方公鑰產(chǎn)生乙方密鑰對  
        Map<String, Object> keyMap2 = DHUtil.initKey(publicKey1);  
        publicKey2 = DHUtil.getPublicKey(keyMap2);  
        privateKey2 = DHUtil.getPrivateKey(keyMap2);  
        System.out  
                .println("DH 乙方公鑰 : " + BytesToHex.fromBytesToHex(publicKey2));  
        System.out.println("DH 乙方私鑰 : "  
                + BytesToHex.fromBytesToHex(privateKey2));  
  
        // 對于甲方， 根據(jù)其私鑰和乙方發(fā)過來的公鑰， 生成其本地密鑰secretKey1  
        secretKey1 = DHUtil.getSecretKeyBytes(publicKey2, privateKey1);  
        System.out.println("DH 甲方 本地密鑰 : "  
                + BytesToHex.fromBytesToHex(secretKey1));  
  
        // 對于乙方， 根據(jù)其私鑰和甲方發(fā)過來的公鑰， 生成其本地密鑰secretKey2  
        secretKey2 = DHUtil.getSecretKeyBytes(publicKey1, privateKey2);  
        System.out.println("DH 乙方 本地密鑰 : "  
                + BytesToHex.fromBytesToHex(secretKey2));  
        // ---------------------------  
        // 測試數(shù)據(jù)加密和解密  
        System.out.println("加密前的數(shù)據(jù)" + DATA);  
        // 甲方進行數(shù)據(jù)的加密  
        // 用的是甲方的私鑰和乙方的公鑰  
        byte[] encryptDH = DHUtil.encryptDH(DATA.getBytes(), publicKey2,  
                privateKey1);  
        System.out.println("加密后的數(shù)據(jù) 字節(jié)數(shù)組轉(zhuǎn)16進制顯示"  
                + BytesToHex.fromBytesToHex(encryptDH));  
        // 乙方進行數(shù)據(jù)的解密  
        // 用的是乙方的私鑰和甲方的公鑰  
        byte[] decryptDH = DHUtil.decryptDH(encryptDH, publicKey1, privateKey2);  
        System.out.println("解密后數(shù)據(jù):" + new String(decryptDH));  
    }  
}