使用DER格式的RSA公鑰文件進行iOS加密

Question

我正在嘗試使用RSA公鑰來加密iOS應用程序中的數據，以通過Web發送給客戶的服務。 密鑰是使用openssl生成的：

openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.der -outform der

然后我嘗試使用密鑰如下：

NSString *aPublicKeyPath = [[NSBundle mainBundle] pathForResource:@"public" ofType:@"der"];
NSFileManager* aFileMgr = [NSFileManager defaultManager];
NSData* myCertData = [aFileMgr contentsAtPath: aPublicKeyPath];
CFDataRef myCertDataRef = (__bridge CFDataRef)myCertData;
SecCertificateRef cert = SecCertificateCreateWithData (kCFAllocatorDefault, myCertDataRef);

cert的內容正確加載到myCertData中，但SecCertificateCreateWithData返回nil而不拋出異常。 沒有要檢查的結果代碼，所以我不知道為什么它不起作用。

僅供參考 - 密鑰似乎有效。 如果我檢查密鑰，我得到這個輸出：

$ openssl rsa -text -in public.der -inform DER -pubin
Modulus (2048 bit):
00:a7:21:90:62:96:15:38:f8:43:5b:33:9f:00:a0:
12:51:63:0e:5c:72:58:05:6a:99:93:d8:6e:f4:d8:
4a:91:cb:dc:74:de:3c:38:63:06:41:5f:63:1e:e9:
70:81:90:e9:f0:e4:78:0a:00:5c:d3:ee:6a:5a:c1:
d7:9a:62:af:f3:45:91:5a:86:bc:aa:8f:86:f5:4f:
3d:01:4b:64:11:31:6f:c1:ab:07:e5:b8:5b:46:8e:
b5:c0:a1:2c:7b:65:1b:09:a9:12:b4:99:f8:77:46:
fa:62:52:04:32:98:09:1c:69:89:52:8c:30:77:af:
51:f2:30:0d:99:33:d3:2b:39:6c:6b:0e:19:ad:67:
10:69:0f:4e:3c:7a:a4:41:bd:87:4e:1d:65:b7:62:
7e:0d:b5:f7:ab:3d:b8:40:f1:c9:8c:c3:1e:9e:7c:
02:67:3a:21:ca:3a:3c:cd:d8:98:fe:4c:ab:30:d4:
f8:2d:3e:78:c3:f0:39:54:15:8a:b7:16:77:ca:3b:
ab:42:5e:70:3e:48:fd:a3:6c:55:5e:66:4b:33:d6:
c0:9c:db:2d:d2:26:78:b8:ca:69:6c:77:6d:38:ab:
77:a0:68:ad:e5:2d:11:50:57:b6:16:dc:b3:e2:82:
bb:07:88:08:a4:87:4c:c6:37:9e:33:ea:5a:f9:b4:
0c:6f
Exponent: 65537 (0x10001)
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApyGQYpYVOPhDWzOfAKAS
UWMOXHJYBWqZk9hu9NhKkcvcdN48OGMGQV9jHulwgZDp8OR4CgBc0+5qWsHXmmKv
80WRWoa8qo+G9U89AUtkETFvwasH5bhbRo61wKEse2UbCakStJn4d0b6YlIEMpgJ
HGmJUowwd69R8jANmTPTKzlsaw4ZrWcQaQ9OPHqkQb2HTh1lt2J+DbX3qz24QPHJ
jMMennwCZzohyjo8zdiY/kyrMNT4LT54w/A5VBWKtxZ3yjurQl5wPkj9o2xVXmZL
M9bAnNst0iZ4uMppbHdtOKt3oGit5S0RUFe2Ftyz4oK7B4gIpIdMxjeeM+pa+bQM
bwIDAQAB
-----END PUBLIC KEY-----

有什么建議么？

更新：

iOS似乎不支持直接讀取上面生成的公鑰而沒有嚴重的黑客攻擊，請參閱此博客文章，其中公共標題從鍵中被手動剝離以使其加載 。 我能夠完成這項工作，但我覺得放入我的應用程序並不是一個好方法。

終於得到了一個我很滿意的解決方案。 如文檔中所述，證書必須是DER格式，因此我使用此命令重新生成它並且它有效：

$ openssl req -x509 -out public_key.crt -outform DER -new -newkey rsa:4096 -keyout private_key.pem

然后我使用密鑰如下：

NSString *aPublicKeyPath = [[NSBundle mainBundle] pathForResource:@"public" ofType:@"der"];
NSFileManager* aFileMgr = [NSFileManager defaultManager];
NSData* aCertData = [aFileMgr contentsAtPath: aPublicKeyPath];
SecCertificateRef aCertRef = SecCertificateCreateWithData(kCFAllocatorDefault, (__bridge CFDataRef)aCertData);

if (aCertRef != NULL) {
    SecKeyRef aPublicKeyRef = NULL;
    SecTrustRef aTrustRef = NULL;
    SecPolicyRef aPolicyRef = SecPolicyCreateBasicX509();

    if (aPolicyRef) {
        if (SecTrustCreateWithCertificates((CFTypeRef)aCertRef, aPolicyRef, &aTrustRef) == noErr) {
            SecTrustResultType result;
            if (SecTrustEvaluate(aTrustRef, &result) == noErr) {
                aPublicKeyRef = SecTrustCopyPublicKey(aTrustRef);
            }
        }
    }

    if (aPolicyRef) CFRelease(aPolicyRef);
    if (aTrustRef) CFRelease(aTrustRef);
    if (aCertRef) CFRelease(aCertRef);
    NSString* aClearTextString = @"This is the test string";
    NSString* aEncryptedString = [[self class] encryptRSA:aClearTextString
                                                      key:aPublicKeyRef];
}

加密程序是：

+(NSString *)encryptRSA:(NSString *)plainTextString key:(SecKeyRef)publicKey         
{
    size_t cipherBufferSize = SecKeyGetBlockSize(publicKey);
    uint8_t *cipherBuffer = malloc(cipherBufferSize);
    uint8_t *nonce = (uint8_t *)[plainTextString UTF8String];
    SecKeyEncrypt(publicKey,
              kSecPaddingOAEP,
              nonce,
              strlen( (char*)nonce ),
              &cipherBuffer[0],
              &cipherBufferSize);
    NSData *encryptedData = [NSData dataWithBytes:cipherBuffer length:cipherBufferSize];
    return [encryptedData base64EncodedStringWithOptions:0];
}

Answer 1

請參閱https://developer.apple.com/library/ios/documentation/Security/Reference/certifkeytrustservices/#//apple_ref/c/func/SecCertificateCreateWithData上的文檔

您正在嘗試加載公鑰。 此API需要公鑰證書，而不是公鑰。

它說

如果data參數中傳遞的數據不是有效的DER編碼的X.509證書，則返回NULL。

因此，使用它的公鑰或使用其他API加載公鑰。