iOS中使用RSA加密
在iOS中使用RSA加密解密，需要用到.der和.p12后缀格式的文件，其中.der格式的文件存放的是公钥（Public key）用于加密，.p12格式的文件存放的是私钥（Private key）用于解密. 首先需要先生成这些文件，然后再将文件导入工程使用，不多说，开始做！
一、使用openssl生成所需秘钥文件
生成环境是在mac系统下，使用openssl进行生成，首先打开终端，按下面这些步骤依次来做：
1. 生成模长为1024bit的私钥文件private_key.pem
openssl genrsa -outprivate_key.pem1024
2. 生成证书请求文件rsaCertReq.csr
openssl req -new-key private_key.pem -outrsaCerReq.csr
注意：这一步会提示输入国家、省份、mail等信息，可以根据实际情况填写，或者全部不用填写，直接全部敲回车.
3. 生成证书rsaCert.crt，并设置有效时间为1年
opensslx509-req-days3650-inrsaCerReq.csr-signkeyprivate_key.pem-outrsaCert.crt
4. 生成供iOS使用的公钥文件public_key.der
openssl x509 -outform der -inrsaCert.crt-outpublic_key.der
5. 生成供iOS使用的私钥文件private_key.p12
openssl pkcs12 -export-outprivate_key.p12-inkey private_key.pem-inrsaCert.crt
注意：这一步会提示给私钥文件设置密码，直接输入想要设置密码即可，然后敲回车，然后再验证刚才设置的密码，再次输入密码，然后敲回车，完毕！
在解密时，private_key.p12文件需要和这里设置的密码配合使用，因此需要牢记此密码.
6. 生成供Java使用的公钥rsa_public_key.pem
openssl rsa -inprivate_key.pem-outrsa_public_key.pem-pubout
7. 生成供Java使用的私钥pkcs8_private_key.pem
openssl pkcs8 -topk8 -inprivate_key.pem-outpkcs8_private_key.pem-nocrypt
全部执行成功后，会生成如下文件，其中public_key.der和private_key.p12就是iOS需要用到的文件，如下图：
生成的文件
二、将文件导入工程使用
1.新建工程, 并导入Security.framework框架, 如下图:
新建工程并添加框架
2.导入秘钥文件
导入.der和.p12格式的秘钥文件, 如下图:
导入秘钥文件
3.新建用于加密、解密的类RSAEncryptor, 并实现相关方法
新建RSAEncryptor类, 如下图:
新建用于加密解密的类
下面开始上代码, 可以直接复制过去用:
RSAEncryptor.h代码如下:
#import@interfaceRSAEncryptor:NSObject/**
* 加密方法
*
* @param str 需要加密的字符串
* @param path '.der'格式的公钥文件路径
*/+ (NSString*)encryptString:(NSString*)str publicKeyWithContentsOfFile:(NSString*)path;/**
* 解密方法
*
* @param str 需要解密的字符串
* @param path '.p12'格式的私钥文件路径
* @param password 私钥文件密码
*/+ (NSString*)decryptString:(NSString*)str privateKeyWithContentsOfFile:(NSString*)path password:(NSString*)password;/**
* 加密方法
*
* @param str 需要加密的字符串
* @param pubKey 公钥字符串
*/+ (NSString*)encryptString:(NSString*)str publicKey:(NSString*)pubKey;/**
* 解密方法
*
* @param str 需要解密的字符串
* @param privKey 私钥字符串
*/+ (NSString*)decryptString:(NSString*)str privateKey:(NSString*)privKey;@end
RSAEncryptor.m代码如下:
#import"RSAEncryptor.h"#import@implementationRSAEncryptorstaticNSString*base64_encode_data(NSData*data){ data = [data base64EncodedDataWithOptions:0];NSString*ret = [[NSStringalloc] initWithData:data encoding:NSUTF8StringEncoding];returnret;}staticNSData*base64_decode(NSString*str){NSData*data = [[NSDataalloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters];returndata;}#pragma mark - 使用'.der'公钥文件加密//加密+ (NSString*)encryptString:(NSString*)str publicKeyWithContentsOfFile:(NSString*)path{if(!str || !path)returnnil;return[selfencryptString:str publicKeyRef:[selfgetPublicKeyRefWithContentsOfFile:path]];}//获取公钥+ (SecKeyRef)getPublicKeyRefWithContentsOfFile:(NSString*)filePath{NSData*certData = [NSDatadataWithContentsOfFile:filePath];if(!certData) {returnnil; } SecCertificateRef cert = SecCertificateCreateWithData(NULL, (CFDataRef)certData); SecKeyRef key =NULL; SecTrustRef trust =NULL; SecPolicyRef policy =NULL;if(cert !=NULL) { policy = SecPolicyCreateBasicX509();if(policy) {if(SecTrustCreateWithCertificates((CFTypeRef)cert, policy, &trust) == noErr) { SecTrustResultType result;if(SecTrustEvaluate(trust, &result) == noErr) { key = SecTrustCopyPublicKey(trust); } } } }if(policy)CFRelease(policy);if(trust)CFRelease(trust);if(cert)CFRelease(cert);returnkey;}+ (NSString*)encryptString:(NSString*)str publicKeyRef:(SecKeyRef)publicKeyRef{if(![str dataUsingEncoding:NSUTF8StringEncoding]){returnnil; }if(!publicKeyRef){returnnil; }NSData*data = [selfencryptData:[str dataUsingEncoding:NSUTF8StringEncoding] withKeyRef:publicKeyRef];NSString*ret = base64_encode_data(data);returnret;}#pragma mark - 使用'.12'私钥文件解密//解密+ (NSString*)decryptString:(NSString*)str privateKeyWithContentsOfFile:(NSString*)path password:(NSString*)password{if(!str || !path)returnnil;if(!password) password =@"";return[selfdecryptString:str privateKeyRef:[selfgetPrivateKeyRefWithContentsOfFile:path password:password]];}//获取私钥+ (SecKeyRef)getPrivateKeyRefWithContentsOfFile:(NSString*)filePath password:(NSString*)password{NSData*p12Data = [NSDatadataWithContentsOfFile:filePath];if(!p12Data) {returnnil; } SecKeyRef privateKeyRef =NULL;NSMutableDictionary* options = [[NSMutableDictionaryalloc] init]; [options setObject: password forKey:(__bridgeid)kSecImportExportPassphrase];CFArrayRefitems =CFArrayCreate(NULL,0,0,NULL); OSStatus securityError = SecPKCS12Import((__bridgeCFDataRef) p12Data, (__bridgeCFDictionaryRef)options, &items);if(securityError == noErr &&CFArrayGetCount(items) >0) {CFDictionaryRefidentityDict =CFArrayGetValueAtIndex(items,0); SecIdentityRef identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity); securityError = SecIdentityCopyPrivateKey(identityApp, &privateKeyRef);if(securityError != noErr) { privateKeyRef =NULL; } }CFRelease(items);returnprivateKeyRef;}+ (NSString*)decryptString:(NSString*)str privateKeyRef:(SecKeyRef)privKeyRef{NSData*data = [[NSDataalloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters];if(!privKeyRef) {returnnil; } data = [selfdecryptData:data withKeyRef:privKeyRef];NSString*ret = [[NSStringalloc] initWithData:data encoding:NSUTF8StringEncoding];returnret;}#pragma mark - 使用公钥字符串加密/* START: Encryption with RSA public key *///使用公钥字符串加密+ (NSString*)encryptString:(NSString*)str publicKey:(NSString*)pubKey{NSData*data = [selfencryptData:[str dataUsingEncoding:NSUTF8StringEncoding] publicKey:pubKey];NSString*ret = base64_encode_data(data);returnret;}+ (NSData*)encryptData:(NSData*)data publicKey:(NSString*)pubKey{if(!data || !pubKey){returnnil; } SecKeyRef keyRef = [selfaddPublicKey:pubKey];if(!keyRef){returnnil; }return[selfencryptData:data withKeyRef:keyRef];}+ (SecKeyRef)addPublicKey:(NSString*)key{NSRangespos = [key rangeOfString:@"-----BEGIN PUBLIC KEY-----"];NSRangeepos = [key rangeOfString:@"-----END PUBLIC KEY-----"];if(spos.location!=NSNotFound&& epos.location!=NSNotFound){NSUIntegers = spos.location+ spos.length;NSUIntegere = epos.location;NSRangerange =NSMakeRange(s, e-s); key = [key substringWithRange:range]; } key = [key stringByReplacingOccurrencesOfString:@"\r"withString:@""]; key = [key stringByReplacingOccurrencesOfString:@"\n"withString:@""]; key = [key stringByReplacingOccurrencesOfString:@"\t"withString:@""]; key = [key stringByReplacingOccurrencesOfString:@" "withString:@""];// This will be base64 encoded, decode it.NSData*data = base64_decode(key); data = [selfstripPublicKeyHeader:data];if(!data){returnnil; }//a tag to read/write keychain storageNSString*tag =@"RSAUtil_PubKey";NSData*d_tag = [NSDatadataWithBytes:[tag UTF8String] length:[tag length]];// Delete any old lingering key with the same tagNSMutableDictionary*publicKey = [[NSMutableDictionaryalloc] init]; [publicKey setObject:(__bridgeid) kSecClassKey forKey:(__bridgeid)kSecClass]; [publicKey setObject:(__bridgeid) kSecAttrKeyTypeRSA forKey:(__bridgeid)kSecAttrKeyType]; [publicKey setObject:d_tag forKey:(__bridgeid)kSecAttrApplicationTag]; SecItemDelete((__bridgeCFDictionaryRef)publicKey);// Add persistent version of the key to system keychain[publicKey setObject:data forKey:(__bridgeid)kSecValueData]; [publicKey setObject:(__bridgeid) kSecAttrKeyClassPublic forKey:(__bridgeid) kSecAttrKeyClass]; [publicKey setObject:[NSNumbernumberWithBool:YES] forKey:(__bridgeid) kSecReturnPersistentRef];CFTypeRefpersistKey =nil; OSStatus status = SecItemAdd((__bridgeCFDictionaryRef)publicKey, &persistKey);if(persistKey !=nil){CFRelease(persistKey); }if((status != noErr) && (status != errSecDuplicateItem)) {returnnil; } [publicKey removeObjectForKey:(__bridgeid)kSecValueData]; [publicKey removeObjectForKey:(__bridgeid)kSecReturnPersistentRef]; [publicKey setObject:[NSNumbernumberWithBool:YES] forKey:(__bridgeid)kSecReturnRef]; [publicKey setObject:(__bridgeid) kSecAttrKeyTypeRSA forKey:(__bridgeid)kSecAttrKeyType];// Now fetch the SecKeyRef version of the keySecKeyRef keyRef =nil; status = SecItemCopyMatching((__bridgeCFDictionaryRef)publicKey, (CFTypeRef*)&keyRef);if(status != noErr){returnnil; }returnkeyRef;}+ (NSData*)stripPublicKeyHeader:(NSData*)d_key{// Skip ASN.1 public key headerif(d_key ==nil)return(nil);unsignedlonglen = [d_key length];if(!len)return(nil);unsignedchar*c_key = (unsignedchar*)[d_key bytes];unsignedintidx =0;if(c_key[idx++] !=0x30)return(nil);if(c_key[idx] >0x80) idx += c_key[idx] -0x80+1;elseidx++;// PKCS #1 rsaEncryption szOID_RSA_RSAstaticunsignedcharseqiod[] = {0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00};if(memcmp(&c_key[idx], seqiod,15))return(nil); idx +=15;if(c_key[idx++] !=0x03)return(nil);if(c_key[idx] >0x80) idx += c_key[idx] -0x80+1;elseidx++;if(c_key[idx++] !='\0')return(nil);// Now make a new NSData from this bufferreturn([NSDatadataWithBytes:&c_key[idx] length:len - idx]);}+ (NSData*)encryptData:(NSData*)data withKeyRef:(SecKeyRef) keyRef{constuint8_t *srcbuf = (constuint8_t *)[data bytes]; size_t srclen = (size_t)data.length; size_t block_size = SecKeyGetBlockSize(keyRef) *sizeof(uint8_t);void*outbuf = malloc(block_size); size_t src_block_size = block_size -11;NSMutableData*ret = [[NSMutableDataalloc] init];for(intidx=0; idx src_block_size){ data_len = src_block_size; } size_t outlen = block_size; OSStatus status = noErr; status = SecKeyEncrypt(keyRef, kSecPaddingPKCS1, srcbuf + idx, data_len, outbuf, &outlen );if(status !=0) {NSLog(@"SecKeyEncrypt fail. Error Code: %d", status); ret =nil;break; }else{ [ret appendBytes:outbuf length:outlen]; } } free(outbuf);CFRelease(keyRef);returnret;}/* END: Encryption with RSA public key */#pragma mark - 使用私钥字符串解密/* START: Decryption with RSA private key *///使用私钥字符串解密+ (NSString*)decryptString:(NSString*)str privateKey:(NSString*)privKey{if(!str)returnnil;NSData*data = [[NSDataalloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters]; data = [selfdecryptData:data privateKey:privKey];NSString*ret = [[NSStringalloc] initWithData:data encoding:NSUTF8StringEncoding];returnret;}+ (NSData*)decryptData:(NSData*)data privateKey:(NSString*)privKey{if(!data || !privKey){returnnil; } SecKeyRef keyRef = [selfaddPrivateKey:privKey];if(!keyRef){returnnil; }return[selfdecryptData:data withKeyRef:keyRef];}+ (SecKeyRef)addPrivateKey:(NSString*)key{NSRangespos = [key rangeOfString:@"-----BEGIN RSA PRIVATE KEY-----"];NSRangeepos = [key rangeOfString:@"-----END RSA PRIVATE KEY-----"];if(spos.location!=NSNotFound&& epos.location!=NSNotFound){NSUIntegers = spos.location+ spos.length;NSUIntegere = epos.location;NSRangerange =NSMakeRange(s, e-s); key = [key substringWithRange:range]; } key = [key stringByReplacingOccurrencesOfString:@"\r"withString:@""]; key = [key stringByReplacingOccurrencesOfString:@"\n"withString:@""]; key = [key stringByReplacingOccurrencesOfString:@"\t"withString:@""]; key = [key stringByReplacingOccurrencesOfString:@" "withString:@""];// This will be base64 encoded, decode it.NSData*data = base64_decode(key); data = [selfstripPrivateKeyHeader:data];if(!data){returnnil; }//a tag to read/write keychain storageNSString*tag =@"RSAUtil_PrivKey";NSData*d_tag = [NSDatadataWithBytes:[tag UTF8String] length:[tag length]];// Delete any old lingering key with the same tagNSMutableDictionary*privateKey = [[NSMutableDictionaryalloc] init]; [privateKey setObject:(__bridgeid) kSecClassKey forKey:(__bridgeid)kSecClass]; [privateKey setObject:(__bridgeid) kSecAttrKeyTypeRSA forKey:(__bridgeid)kSecAttrKeyType]; [privateKey setObject:d_tag forKey:(__bridgeid)kSecAttrApplicationTag]; SecItemDelete((__bridgeCFDictionaryRef)privateKey);// Add persistent version of the key to system keychain[privateKey setObject:data forKey:(__bridgeid)kSecValueData]; [privateKey setObject:(__bridgeid) kSecAttrKeyClassPrivate forKey:(__bridgeid) kSecAttrKeyClass]; [privateKey setObject:[NSNumbernumberWithBool:YES] forKey:(__bridgeid) kSecReturnPersistentRef];CFTypeRefpersistKey =nil; OSStatus status = SecItemAdd((__bridgeCFDictionaryRef)privateKey, &persistKey);if(persistKey !=nil){CFRelease(persistKey); }if((status != noErr) && (status != errSecDuplicateItem)) {returnnil; } [privateKey removeObjectForKey:(__bridgeid)kSecValueData]; [privateKey removeObjectForKey:(__bridgeid)kSecReturnPersistentRef]; [privateKey setObject:[NSNumbernumberWithBool:YES] forKey:(__bridgeid)kSecReturnRef]; [privateKey setObject:(__bridgeid) kSecAttrKeyTypeRSA forKey:(__bridgeid)kSecAttrKeyType];// Now fetch the SecKeyRef version of the keySecKeyRef keyRef =nil; status = SecItemCopyMatching((__bridgeCFDictionaryRef)privateKey, (CFTypeRef*)&keyRef);if(status != noErr){returnnil; }returnkeyRef;}+ (NSData*)stripPrivateKeyHeader:(NSData*)d_key{// Skip ASN.1 private key headerif(d_key ==nil)return(nil);unsignedlonglen = [d_key length];if(!len)return(nil);unsignedchar*c_key = (unsignedchar*)[d_key bytes];unsignedintidx =22;//magic byte at offset 22if(0x04!= c_key[idx++])returnnil;//calculate length of the keyunsignedintc_len = c_key[idx++];intdet = c_len &0x80;if(!det) { c_len = c_len &0x7f; }else{intbyteCount = c_len &0x7f;if(byteCount + idx > len) {//rsa length field longer than bufferreturnnil; }unsignedintaccum =0;unsignedchar*ptr = &c_key[idx]; idx += byteCount;while(byteCount) { accum = (accum <<8) + *ptr; ptr++; byteCount--; } c_len = accum; }// Now make a new NSData from this bufferreturn[d_key subdataWithRange:NSMakeRange(idx, c_len)];}+ (NSData*)decryptData:(NSData*)data withKeyRef:(SecKeyRef) keyRef{constuint8_t *srcbuf = (constuint8_t *)[data bytes]; size_t srclen = (size_t)data.length; size_t block_size = SecKeyGetBlockSize(keyRef) *sizeof(uint8_t);UInt8*outbuf = malloc(block_size); size_t src_block_size = block_size;NSMutableData*ret = [[NSMutableDataalloc] init];for(intidx=0; idx src_block_size){ data_len = src_block_size; } size_t outlen = block_size; OSStatus status = noErr; status = SecKeyDecrypt(keyRef, kSecPaddingNone, srcbuf + idx, data_len, outbuf, &outlen );if(status !=0) {NSLog(@"SecKeyEncrypt fail. Error Code: %d", status); ret =nil;break; }else{//the actual decrypted data is in the middle, locate it!intidxFirstZero = -1;intidxNextZero = (int)outlen;for(inti =0; i < outlen; i++ ) {if( outbuf[i] ==0) {if( idxFirstZero <0) { idxFirstZero = i; }else{ idxNextZero = i;break; } } } [ret appendBytes:&outbuf[idxFirstZero+1] length:idxNextZero-idxFirstZero-1]; } } free(outbuf);CFRelease(keyRef);returnret;}/* END: Decryption with RSA private key */@end
运行后, 输出信息如下:
输出结果
可以看到已经可以成功加密、解密了.
下面接着测试使用秘钥字符串进行加密、解密, 那么秘钥字符串从哪里来? 可以来这里:http://web.chacuo.net/netrsakeypair, 这是一个在线生成RSA秘钥的网站, 生成公钥和秘钥后, 复制出来用于测试. 然后在ViewController.m中使用RSAEntryptor.h头文件中对应的加密方法进行加密,ViewController.m中代码如下:
#import"ViewController.h"#import"RSAEncryptor.h"@interfaceViewController()@end@implementationViewController- (void)viewDidLoad { [superviewDidLoad];//原始数据NSString*originalString =@"这是一段将要使用'秘钥字符串'进行加密的字符串!";//使用字符串格式的公钥私钥加密解密NSString*encryptStr = [RSAEncryptor encryptString:originalString publicKey:@"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDTbZ6cNH9PgdF60aQKveLz3FTalyzHQwbp601y77SzmGHX3F5NoVUZbdK7UMdoCLK4FBziTewYD9DWvAErXZo9BFuI96bAop8wfl1VkZyyHTcznxNJFGSQd/B70/ExMgMBpEwkAAdyUqIjIdVGh1FQK/4acwS39YXwbS+IlHsPSQIDAQAB"];NSLog(@"加密前:%@", originalString);NSLog(@"加密后:%@", encryptStr);NSLog(@"解密后:%@", [RSAEncryptor decryptString:encryptStr privateKey:@"MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBANNtnpw0f0+B0XrRpAq94vPcVNqXLMdDBunrTXLvtLOYYdfcXk2hVRlt0rtQx2gIsrgUHOJN7BgP0Na8AStdmj0EW4j3psCinzB+XVWRnLIdNzOfE0kUZJB38HvT8TEyAwGkTCQAB3JSoiMh1UaHUVAr/hpzBLf1hfBtL4iUew9JAgMBAAECgYA1tGeQmAkqofga8XtwuxEWDoaDS9k0+EKeUoXGxzqoT/GyiihuIafjILFhoUA1ndf/yCQaG973sbTDhtfpMwqFNQq13+JAownslTjWgr7Hwf7qplYW92R7CU0v7wFfjqm1t/2FKU9JkHfaHfb7qqESMIbO/VMjER9o4tEx58uXDQJBAO0O4lnWDVjr1gN02cqvxPOtTY6DgFbQDeaAZF8obb6XqvCqGW/AVms3Bh8nVlUwdQ2K/xte8tHxjW9FtBQTLd8CQQDkUncO35gAqUF9Bhsdzrs7nO1J3VjLrM0ITrepqjqtVEvdXZc+1/UrkWVaIigWAXjQCVfmQzScdbznhYXPz5fXAkEAgB3KMRkhL4yNpmKRjhw+ih+ASeRCCSj6Sjfbhx4XaakYZmbXxnChg+JB+bZNz06YBFC5nLZM7y/n61o1f5/56wJBALw+ZVzE6ly5L34114uG04W9x0HcFgau7MiJphFjgUdAtd/H9xfgE4odMRPUD3q9Me9LlMYK6MiKpfm4c2+3dzcCQQC8y37NPgpNEkd9smMwPpSEjPW41aMlfcKvP4Da3z7G5bGlmuICrva9YDAiaAyDGGCK8LxC8K6HpKrFgYrXkRtt"]);}- (void)didReceiveMemoryWarning { [superdidReceiveMemoryWarning];// Dispose of any resources that can be recreated.}@end
运行后, 输出信息如下:
输出结果
可以看到,也成功加密、解密了.
至此, RSA加密演示完毕!
上图为2017年最新的视频教程资料，搜索235再填上214最后输入9755加我好友私聊我上传视频教程，有什么不懂的也可以来私聊问我。
不定时更新中。
如果你能明白这些视频资料的好差，那么你也算是入行了，底层和中高层就是这一步之差。
