证书与私钥匹配

Question

We are currently implementing a digital signature applet in java. Users will have tokens containing keystores of private keys and their respective certificates. The certificates and private keys will have different aliases.

What I need to do is call/match the private key in the store to the certificate selected by the user at the time of signing. How can I match a private key to its respective certificate in java? I need something like getkey(alias, password) where alias is derived from a match between the certificate selected and the key.

Answer 1

If you are using ECC then

Q = k * P

Where Q is your public key, so when you know the private key k you also know the base point P and the curve so you can "easily" compute the public key.

The issue with RSA is also simple, when using well known implementations, where exponent e is fixed. If it's not fixed it can be tricky, but also not that hard.

The completly other issue is... how would you match given pubkey with stored certificate? And the other question is why do something like this ? You should hold cert info after sign and access coresponding cert in java key store. Ambiguity is always a problem, specially in crypto you should be as explicit as you can be.

Answer 2

If I understood your design - your idea is not something that you should proceed with, however java should support what you need:

Use this code:

 KeyStore.PrivateKeyEntry pkEntry = (KeyStore.PrivateKeyEntry)
 ks.getEntry("privateKeyAlias", password);
 Certificate certificateFromPrivateKey = pkEntry.getCertificate();
 KeyStore.TrustedCertificateEntry certEntry = (KeyStore.TrustedCertificateEntry)ks.getEntry("certificateAlias, password);
 Certificate certificateFromPublicKey = certEntry.getCertificate();

 if (certificateFromPrivateKey.equals(certificateFromPublicKey)) ...

Read more about it in the javadoc - but I really think you are going about this the wrong way.

Also - a relevant API (I assume you are using it) - http://docs.oracle.com/javase/6/docs/api/java/security/Signature.html