非對(duì)稱密碼之DH密鑰交換算法

1、DH算法的簡介

DH，全稱為“Diffie-Hellman”，他是一種確保共享KEY安全穿越不安全網(wǎng)絡(luò)的方法，也就是常說的密鑰一致協(xié)議。由公開密鑰密碼體制的奠基人Diffie和Hellman所提出的一種思想。

簡單的說就是允許兩名用戶在公開媒體上交換信息以生成“一致”的、可以共享的密鑰。也就是由甲方產(chǎn)出一對(duì)密鑰（公鑰、私鑰），乙方依照甲方公鑰產(chǎn)生乙方密鑰對(duì)（公鑰、私鑰）。

以此為基線，作為數(shù)據(jù)傳輸保密基礎(chǔ)，同時(shí)雙方使用同一種對(duì)稱加密算法構(gòu)建本地密鑰（SecretKey）對(duì)數(shù)據(jù)加密。這樣，在互通了本地密鑰（SecretKey）算法后，甲乙雙方公開自己的公鑰，使用對(duì)方的公鑰和剛才產(chǎn)生的私鑰加密數(shù)據(jù)，同時(shí)可以使用對(duì)方的公鑰和自己的私鑰對(duì)數(shù)據(jù)解密。不單單是甲乙雙方兩方，可以擴(kuò)展為多方共享數(shù)據(jù)通訊，這樣就完成了網(wǎng)絡(luò)交互數(shù)據(jù)的安全通訊！

2、DH算法的通信模型

2.1 甲方將自己的公鑰發(fā)給乙方

甲方將自己的公鑰發(fā)給乙方

2.2 乙方根據(jù)甲方發(fā)來的公鑰，生成自己的公鑰和私鑰

乙方根據(jù)甲方發(fā)來的公鑰，生成自己的公鑰和私鑰

2.3 乙方將自己的公鑰發(fā)送給甲方

乙方將自己的公鑰發(fā)送給甲方

2.4 甲方和乙方，生成一樣的秘鑰。用于加密數(shù)據(jù)

甲方和乙方，生成一樣的秘鑰。用于加密數(shù)據(jù)

3、DH算法的數(shù)學(xué)原理

DH算法的數(shù)學(xué)原理

4、 JDK實(shí)現(xiàn)

JDK實(shí)現(xiàn)

5、DH算法的實(shí)現(xiàn)

import javax.crypto.*;
import javax.crypto.interfaces.DHPrivateKey;
import javax.crypto.interfaces.DHPublicKey;
import javax.crypto.spec.DHParameterSpec;
import java.security.*;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.HashMap;
import java.util.Map;

public class DHUtil {
    /**
     * 定義加密方式
     */
    private static final String KEY_DH = "DH";
    public static final String PUBLIC_KEY = "DHPublicKey";
    public static final String PRIVATE_KEY = "DHPrivateKey";
    // 開始生成本地密鑰SecretKey 密鑰算法為對(duì)稱密碼算法
    // 可以為 DES DES AES
    public static final String KEY_DH_DES = "DES";

    /**
     * 甲方初始化并返回密鑰對(duì)
     *
     * @return
     */
    public static Map<String, Object> initKey() {
        try {
            // 實(shí)例化密鑰對(duì)生成器
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(KEY_DH);
            // 初始化密鑰對(duì)生成器 默認(rèn)是1024 512-1024 & 64的倍數(shù)
            keyPairGenerator.initialize(1024);
            // 生成密鑰對(duì)
            KeyPair keyPair = keyPairGenerator.generateKeyPair();
            // 得到甲方公鑰
            DHPublicKey publicKey = (DHPublicKey) keyPair.getPublic();
            // 得到甲方私鑰
            DHPrivateKey privateKey = (DHPrivateKey) keyPair.getPrivate();
            // 將公鑰和私鑰封裝在Map中， 方便之后使用
            Map<String, Object> keyMap = new HashMap<String, Object>();
            keyMap.put(PUBLIC_KEY, publicKey);
            keyMap.put(PRIVATE_KEY, privateKey);
            return keyMap;
        } catch (Exception e) {
            throw new RuntimeException(e);
        }

    }

    /**
     * 乙方根據(jù)甲方公鑰初始化并返回密鑰對(duì)
     *
     * @param key 甲方的公鑰
     * @return
     */
    public static Map<String, Object> initKey(byte[] key) {
        try {
            // 將甲方公鑰從字節(jié)數(shù)組轉(zhuǎn)換為PublicKey
            X509EncodedKeySpec keySpec = new X509EncodedKeySpec(key);
            // 實(shí)例化密鑰工廠
            KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);
            // 產(chǎn)生甲方公鑰pubKey
            DHPublicKey dhPublicKey = (DHPublicKey) keyFactory.generatePublic(keySpec);
            // 剖析甲方公鑰，得到其參數(shù)
            DHParameterSpec dhParameterSpec = dhPublicKey.getParams();
            // 實(shí)例化密鑰對(duì)生成器
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(KEY_DH);
            // 用甲方公鑰初始化密鑰對(duì)生成器
            keyPairGenerator.initialize(dhParameterSpec);
            // 產(chǎn)生密鑰對(duì)
            KeyPair keyPair = keyPairGenerator.generateKeyPair();
            // 得到乙方公鑰
            DHPublicKey publicKey = (DHPublicKey) keyPair.getPublic();
            // 得到乙方私鑰
            DHPrivateKey privateKey = (DHPrivateKey) keyPair.getPrivate();
            // 將公鑰和私鑰封裝在Map中， 方便之后使用
            Map<String, Object> keyMap = new HashMap<String, Object>();
            keyMap.put(PUBLIC_KEY, publicKey);
            keyMap.put(PRIVATE_KEY, privateKey);
            return keyMap;
        } catch (Exception e) {
            throw new RuntimeException(e);
        }

    }

    /**
     * 根據(jù)對(duì)方的公鑰和自己的私鑰生成 本地密鑰,返回的是SecretKey對(duì)象的字節(jié)數(shù)組
     *
     * @param publicKey  公鑰
     * @param privateKey 私鑰
     * @return
     */
    public static byte[] getSecretKeyBytes(byte[] publicKey, byte[] privateKey) {
        try {
            // 實(shí)例化密鑰工廠
            KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);
            // 將公鑰從字節(jié)數(shù)組轉(zhuǎn)換為PublicKey
            X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(publicKey);
            PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);
            // 將私鑰從字節(jié)數(shù)組轉(zhuǎn)換為PrivateKey
            PKCS8EncodedKeySpec priKeySpec = new PKCS8EncodedKeySpec(privateKey);
            PrivateKey priKey = keyFactory.generatePrivate(priKeySpec);

            // 準(zhǔn)備根據(jù)以上公鑰和私鑰生成本地密鑰SecretKey
            // 先實(shí)例化KeyAgreement
            KeyAgreement keyAgreement = KeyAgreement.getInstance(KEY_DH);
            // 用自己的私鑰初始化keyAgreement
            keyAgreement.init(priKey);
            // 結(jié)合對(duì)方的公鑰進(jìn)行運(yùn)算
            keyAgreement.doPhase(pubKey, true);
            // 開始生成本地密鑰SecretKey 密鑰算法為對(duì)稱密碼算法
            SecretKey secretKey = keyAgreement.generateSecret(KEY_DH_DES);
            return secretKey.getEncoded();
        } catch (Exception e) {
            throw new RuntimeException(e);
        }

    }

    /**
     * 根據(jù)對(duì)方的公鑰和自己的私鑰生成 本地密鑰,返回的是SecretKey對(duì)象
     *
     * @param publicKey  公鑰
     * @param privateKey 私鑰
     * @return
     */
    public static SecretKey getSecretKey(byte[] publicKey, byte[] privateKey) {
        try {
            // 實(shí)例化密鑰工廠
            KeyFactory keyFactory = KeyFactory.getInstance(KEY_DH);
            // 將公鑰從字節(jié)數(shù)組轉(zhuǎn)換為PublicKey
            X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(publicKey);
            PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);
            // 將私鑰從字節(jié)數(shù)組轉(zhuǎn)換為PrivateKey
            PKCS8EncodedKeySpec priKeySpec = new PKCS8EncodedKeySpec(privateKey);
            PrivateKey priKey = keyFactory.generatePrivate(priKeySpec);

            // 準(zhǔn)備根據(jù)以上公鑰和私鑰生成本地密鑰SecretKey
            // 先實(shí)例化KeyAgreement
            KeyAgreement keyAgreement = KeyAgreement.getInstance(KEY_DH);
            // 用自己的私鑰初始化keyAgreement
            keyAgreement.init(priKey);
            // 結(jié)合對(duì)方的公鑰進(jìn)行運(yùn)算
            keyAgreement.doPhase(pubKey, true);
            // 開始生成本地密鑰SecretKey 密鑰算法為對(duì)稱密碼算法
            SecretKey secretKey = keyAgreement.generateSecret(KEY_DH_DES);
            return secretKey;
        } catch (Exception e) {
            throw new RuntimeException(e);
        }

    }

    /**
     * 從 Map 中取得公鑰
     *
     * @param keyMap
     * @return
     */
    public static byte[] getPublicKey(Map<String, Object> keyMap) {
        DHPublicKey key = (DHPublicKey) keyMap.get(PUBLIC_KEY);
        return key.getEncoded();
    }

    /**
     * 從 Map 中取得私鑰
     *
     * @param keyMap
     * @return
     */
    public static byte[] getPrivateKey(Map<String, Object> keyMap) {
        DHPrivateKey key = (DHPrivateKey) keyMap.get(PRIVATE_KEY);
        return key.getEncoded();
    }

    /**
     * DH 加密
     *
     * @param data       帶加密數(shù)據(jù)
     * @param publicKey  甲方公鑰
     * @param privateKey 乙方私鑰
     * @return
     */
    public static byte[] encryptDH(byte[] data, byte[] publicKey, byte[] privateKey) {
        byte[] bytes = null;
        try {
            //
            SecretKey secretKey = getSecretKey(publicKey, privateKey);
            // 數(shù)據(jù)加密
            Cipher cipher = Cipher.getInstance(secretKey.getAlgorithm());
            cipher.init(Cipher.ENCRYPT_MODE, secretKey);
            bytes = cipher.doFinal(data);
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (NoSuchPaddingException e) {
            e.printStackTrace();
        } catch (InvalidKeyException e) {
            e.printStackTrace();
        } catch (BadPaddingException e) {
            e.printStackTrace();
        } catch (IllegalBlockSizeException e) {
            e.printStackTrace();
        }
        return bytes;
    }

    /**
     * DH 解密
     *
     * @param data       待解密數(shù)據(jù)
     * @param publicKey  乙方公鑰
     * @param privateKey 甲方私鑰
     * @return
     */
    public static byte[] decryptDH(byte[] data, byte[] publicKey, byte[] privateKey) {
        byte[] bytes = null;
        try {
            //
            SecretKey secretKey = getSecretKey(publicKey, privateKey);
            // 數(shù)據(jù)加密
            Cipher cipher = Cipher.getInstance(secretKey.getAlgorithm());
            cipher.init(Cipher.DECRYPT_MODE, secretKey);
            bytes = cipher.doFinal(data);
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (NoSuchPaddingException e) {
            e.printStackTrace();
        } catch (InvalidKeyException e) {
            e.printStackTrace();
        } catch (BadPaddingException e) {
            e.printStackTrace();
        } catch (IllegalBlockSizeException e) {
            e.printStackTrace();
        }
        return bytes;
    }

}

測(cè)試代碼

import org.junit.Test;

import java.util.Map;

public class DHUtilTest {
    // 待加密的明文
    public static final String DATA = "testDH我愛你中國";

    @Test
    public void dhTest() {
        /* Test DH */
        // 甲方公鑰
        byte[] publicKey1;
        // 甲方私鑰
        byte[] privateKey1;
        // 甲方本地密鑰
        byte[] secretKey1;
        // 乙方公鑰
        byte[] publicKey2;
        // 乙方私鑰
        byte[] privateKey2;
        // 乙方本地密鑰
        byte[] secretKey2;

        // 初始化密鑰 并生成甲方密鑰對(duì)
        Map<String, Object> keyMap1 = DHUtil.initKey();
        publicKey1 = DHUtil.getPublicKey(keyMap1);
        privateKey1 = DHUtil.getPrivateKey(keyMap1);
        System.out.println("DH 甲方公鑰 : " + fromBytesToHex(publicKey1));
        System.out.println("DH 甲方私鑰 : " + fromBytesToHex(privateKey1));

        // 乙方根據(jù)甲方公鑰產(chǎn)生乙方密鑰對(duì)
        Map<String, Object> keyMap2 = DHUtil.initKey(publicKey1);
        publicKey2 = DHUtil.getPublicKey(keyMap2);
        privateKey2 = DHUtil.getPrivateKey(keyMap2);
        System.out.println("DH 乙方公鑰 : " + fromBytesToHex(publicKey2));
        System.out.println("DH 乙方私鑰 : " + fromBytesToHex(privateKey2));

        // 對(duì)于甲方， 根據(jù)其私鑰和乙方發(fā)過來的公鑰， 生成其本地密鑰secretKey1
        secretKey1 = DHUtil.getSecretKeyBytes(publicKey2, privateKey1);
        System.out.println("DH 甲方 本地密鑰 : " + fromBytesToHex(secretKey1));

        // 對(duì)于乙方， 根據(jù)其私鑰和甲方發(fā)過來的公鑰， 生成其本地密鑰secretKey2
        secretKey2 = DHUtil.getSecretKeyBytes(publicKey1, privateKey2);
        System.out.println("DH 乙方 本地密鑰 : " + fromBytesToHex(secretKey2));
        // ---------------------------
        // 測(cè)試數(shù)據(jù)加密和解密
        System.out.println("加密前的數(shù)據(jù)" + DATA);

        System.out.println(">>>>>>>>>>>甲向乙發(fā)送數(shù)據(jù)>>>>>>>>>>>");

        //  甲方進(jìn)行數(shù)據(jù)的加密,用的是甲方的私鑰和乙方的公鑰
        byte[] encryptDH = DHUtil.encryptDH(DATA.getBytes(), publicKey2, privateKey1);
        System.out.println("加密后的數(shù)據(jù) 字節(jié)數(shù)組轉(zhuǎn)16進(jìn)制顯示:" + fromBytesToHex(encryptDH));
        // 乙方進(jìn)行數(shù)據(jù)的解密
        // 用的是乙方的私鑰和甲方的公鑰
        byte[] decryptDH = DHUtil.decryptDH(encryptDH, publicKey1, privateKey2);
        System.out.println("解密后數(shù)據(jù):" + new String(decryptDH));

        System.out.println(">>>>>>>>>>>乙向甲發(fā)送數(shù)據(jù)>>>>>>>>>>>");
        //客戶端發(fā)送數(shù)據(jù)
        byte[] clientEncryptDH = DHUtil.encryptDH(DATA.getBytes(), publicKey1, privateKey2);
        System.out.println("加密后的數(shù)據(jù) 字節(jié)數(shù)組轉(zhuǎn)16進(jìn)制顯示:" + fromBytesToHex(clientEncryptDH));
        //服務(wù)端接收數(shù)據(jù)
        byte[] serverEncryptDH = DHUtil.decryptDH(clientEncryptDH, publicKey2, privateKey1);
        System.out.println("解密后數(shù)據(jù):" + new String(serverEncryptDH));
    }

    private static String fromBytesToHex(byte[] resultBytes) {
        StringBuilder builder = new StringBuilder();
        for (int i = 0; i < resultBytes.length; i++) {
            if (Integer.toHexString(0xFF & resultBytes[i]).length() == 1) {
                builder.append("0").append(Integer.toHexString(0xFF & resultBytes[i]));
            } else {
                builder.append(Integer.toHexString(0xFF & resultBytes[i]));
            }
        }
        return builder.toString();
    }
}

結(jié)果驗(yàn)證：

DH 甲方公鑰 : 308201a73082011b06092a864886f70d0103013082010c02818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b6512669455d402251fb593d8d58fabfc5f5ba30f6cb9b556cd7813b801d346ff26660b76b9950a5a49f9fe8047b1022c24fbba9d7feb7c61bf83b57e7c6a8a6150f04fb83f6d3c51ec3023554135a169132f675f3ae2b61d72aeff22203199dd14801c702818100f7e1a085d69b3ddecbbcab5c36b857b97994afbbfa3aea82f9574c0b3d0782675159578ebad4594fe67107108180b449167123e84c281613b7cf09328cc8a6e13c167a8b547c8d28e0a3ae1e2bb3a675916ea37f0bfa213562f1fb627a01243bcca4f1bea8519089a883dfe15ae59f06928b665e807b552564014c3bfecf492a02020200038185000281810083e5ff16d850d8a0dd614ff26cb526b876396fd2ef3582033ab5b0c00512a8def10f4e31f91bd05cfb79a55b6ce9b820a2a1acda76991999440f1078aac18d620b10ec8963cd1552ca3bd479a06d8f579c29de20077e2309f3b1cc3730052d2bcd8783656b50a141f7b1b4c8d5f967d2421116b3c11e033c5e09547522654a05
DH 甲方私鑰 : 308201670201003082011b06092a864886f70d0103013082010c02818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b6512669455d402251fb593d8d58fabfc5f5ba30f6cb9b556cd7813b801d346ff26660b76b9950a5a49f9fe8047b1022c24fbba9d7feb7c61bf83b57e7c6a8a6150f04fb83f6d3c51ec3023554135a169132f675f3ae2b61d72aeff22203199dd14801c702818100f7e1a085d69b3ddecbbcab5c36b857b97994afbbfa3aea82f9574c0b3d0782675159578ebad4594fe67107108180b449167123e84c281613b7cf09328cc8a6e13c167a8b547c8d28e0a3ae1e2bb3a675916ea37f0bfa213562f1fb627a01243bcca4f1bea8519089a883dfe15ae59f06928b665e807b552564014c3bfecf492a020202000443024100dfc7957d9916191dc17472bef781eb281ec424cb22d983f7d1a99a0b232a1fc998a612702e37b16c710858769d2f835ba7dce29642daecc9dd362fa256283c3e
DH 乙方公鑰 : 308201a63082011b06092a864886f70d0103013082010c02818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b6512669455d402251fb593d8d58fabfc5f5ba30f6cb9b556cd7813b801d346ff26660b76b9950a5a49f9fe8047b1022c24fbba9d7feb7c61bf83b57e7c6a8a6150f04fb83f6d3c51ec3023554135a169132f675f3ae2b61d72aeff22203199dd14801c702818100f7e1a085d69b3ddecbbcab5c36b857b97994afbbfa3aea82f9574c0b3d0782675159578ebad4594fe67107108180b449167123e84c281613b7cf09328cc8a6e13c167a8b547c8d28e0a3ae1e2bb3a675916ea37f0bfa213562f1fb627a01243bcca4f1bea8519089a883dfe15ae59f06928b665e807b552564014c3bfecf492a02020200038184000281805c055af852bbb408024230da19e4d0f1b6c6d2c798a371d351b3c6f0944c822340257486400a88bd067ee99e1ea595b2e72eeebd354ffd092ddcb33641b7ed60ee2a5b62d66993c45a7a05117dbc479719f31a3ae057d81ce795154f3dea1e20db4ccb474dde872a6e24b04ca2daf0e0b24cf8e121a4fa2280cee7fe56686697
DH 乙方私鑰 : 308201670201003082011b06092a864886f70d0103013082010c02818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b6512669455d402251fb593d8d58fabfc5f5ba30f6cb9b556cd7813b801d346ff26660b76b9950a5a49f9fe8047b1022c24fbba9d7feb7c61bf83b57e7c6a8a6150f04fb83f6d3c51ec3023554135a169132f675f3ae2b61d72aeff22203199dd14801c702818100f7e1a085d69b3ddecbbcab5c36b857b97994afbbfa3aea82f9574c0b3d0782675159578ebad4594fe67107108180b449167123e84c281613b7cf09328cc8a6e13c167a8b547c8d28e0a3ae1e2bb3a675916ea37f0bfa213562f1fb627a01243bcca4f1bea8519089a883dfe15ae59f06928b665e807b552564014c3bfecf492a020202000443024100860045980965a4f93293cb5f35576ebe8b167d98ecb73c7ed72db11b5f037aaf7961e5d4050997835dccbc59ed8c55df101182a80a1d189b13b7b55bf159d52f
DH 甲方 本地密鑰 : 9ba867f70eb69464
DH 乙方 本地密鑰 : 9ba867f70eb69464
加密前的數(shù)據(jù)testDH我愛你中國
>>>>>>>>>>>甲向乙發(fā)送數(shù)據(jù)>>>>>>>>>>>
加密后的數(shù)據(jù) 字節(jié)數(shù)組轉(zhuǎn)16進(jìn)制顯示:15222436d88b2e36cbeb11aef4d80a7b6312d9d3985b3483
解密后數(shù)據(jù):testDH我愛你中國
>>>>>>>>>>>乙向甲發(fā)送數(shù)據(jù)>>>>>>>>>>>
加密后的數(shù)據(jù) 字節(jié)數(shù)組轉(zhuǎn)16進(jìn)制顯示:15222436d88b2e36cbeb11aef4d80a7b6312d9d3985b3483
解密后數(shù)據(jù):testDH我愛你中國
最后編輯于 ：
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時(shí)請(qǐng)結(jié)合常識(shí)與多方信息審慎甄別。
平臺(tái)聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點(diǎn)，簡書系信息發(fā)布平臺(tái)，僅提供信息存儲(chǔ)服務(wù)。

友情鏈接更多精彩內(nèi)容