在Java密钥库中存储PGP（公共）密钥 - Bouncycastle

Question

我正在使用bouncycastle（JAVA）实现SSO中的签名、加密、解密和签名验证。我拥有原始PGP公钥和私钥，需要将它们存储在Java keystore中。这些PGP公钥没有证书。

据Keystore的javadoc所述，对于公钥（http://docs.oracle.com/javase/6/docs/api/java/security/KeyStore.html），我必须创建证书。一旦证书创建成功，我可以将其导入keystore作为KeyStore.TrustedCertificateEntry。然而，我无法为类型org.bouncycastle.openpgp.PGPPublicKey创建证书条目。

我已经在网上搜索过，但找不到有效的示例：

1. Bouncycastle documentation: http://www.bouncycastle.org/wiki/display/JA1/X.509+Public+Key+Certificate+and+Certification+Request+Generation Generates certificate for X.509 keys -

2. Bouncycastle examples - org.bouncycastle.openpgp.examples.DirectKeySignature: Add certificat (object of type PGPSignature) directly to the PGPPublicKey. To conclude - I have signed (certified) PGPPublicKey but I am not able to store this type of Key into the java keystore.

   OutputStream out = new ByteArrayOutputStream();
   
   if (armor)
   {
       out = new ArmoredOutputStream(out);
   }
   
   PGPPrivateKey pgpPrivKey = secretKey.extractPrivateKey(secretKeyPass.toCharArray(), "BC");
   
   PGPSignatureGenerator       sGen = new PGPSignatureGenerator(secretKey.getPublicKey().getAlgorithm(), PGPUtil.SHA1, "BC");
   
   sGen.initSign(PGPSignature.DIRECT_KEY, pgpPrivKey);
   
   BCPGOutputStream            bOut = new BCPGOutputStream(out);
   
   sGen.generateOnePassVersion(false).encode(bOut);
   
   PGPSignatureSubpacketGenerator spGen = new PGPSignatureSubpacketGenerator();
   
   boolean isHumanReadable = true;
   
   spGen.setNotationData(true, isHumanReadable, notationName, notationValue);
   
   PGPSignatureSubpacketVector packetVector = spGen.generate();
   sGen.setHashedSubpackets(packetVector);
   
   bOut.flush();
   
   return PGPPublicKey.addCertification(keyToBeSigned, sGen.generate()).getEncoded();
   

我主要关注编程解决方案（Java源代码），但使用一些工具的示例也会很有帮助。

谢谢！

- Juraj Martinka

Answer 1

我认为你应该从你的PGPPublicKey中提取一个java.security.PublicKey，并使用它来构造一个X509Certificate，这可以被存储在密钥库中。

JcaPGPKeyConverter c = new JcaPGPKeyConverter();
PublicKey publicKey = c.getPublicKey(pgpPublicKey);
// ... Use Bouncy's X509V3CertificateGenerator or X509v3CertificateBuilder
// ... to construct a self-signed cert
X509Certificate x509Certificate = // ...
// ... add cert to KeyStore

要从PublicKey创建一个X509Certificate，请参见：生成随机证书。

- martijno

Answer 2

如果您只想保存公钥，为什么不能将密钥内容保存到Java密钥库中？然后在需要时检索内容并转换为PGPPublicKey对象。

首先创建一个包装类。

public class PgpPublicKeyWrapper implements Key {
    private final String keyContent;
    public PgpPublicKeyWrapper(final String keyContent) {
        this.keyContent = keyContent;
    }
    @Override
    public String getAlgorithm() {
        return "PGP-PublicKey"; // you can call whatever you want
    }
    @Override
    public String getFormat() {
        return "RAW"; // has to be raw format
    }
    @Override
    public byte[] getEncoded() {
        return keyContent.getBytes();
    }
}

然后你可以这样做来保存它

keyStore.setKeyEntry("think a name for alias", new PgpPublicKeyWrapper(key), PASSWORD, null);

当你想要检索它时

Key key = this.keyStore.getKey(alias, PASSWORD);
InputStream is = new ByteArrayInputStream(key.getEncoded());
PGPPublicKey publicKey = readPublicKey(is); 

对于readPublicKey()函数，你可以在网上找到许多关于如何读取InputStream并转换成PGPPublicKey对象的示例。

- stevelo