|
|
/*
|
|
|
* Copyright (c) 2010-2011, The MiCode Open Source Community (www.micode.net)
|
|
|
*
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
* You may obtain a copy of the License at
|
|
|
*
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
*
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
* See the License for the specific language governing permissions and
|
|
|
* limitations under the License.
|
|
|
*/
|
|
|
|
|
|
package net.micode.notes.tool;
|
|
|
|
|
|
import android.util.Base64;
|
|
|
import android.util.Log;
|
|
|
|
|
|
import java.io.UnsupportedEncodingException;
|
|
|
import java.security.GeneralSecurityException;
|
|
|
import java.security.MessageDigest;
|
|
|
import java.security.NoSuchAlgorithmException;
|
|
|
import java.security.SecureRandom;
|
|
|
import java.util.Arrays;
|
|
|
|
|
|
import javax.crypto.Cipher;
|
|
|
import javax.crypto.KeyGenerator;
|
|
|
import javax.crypto.SecretKey;
|
|
|
import javax.crypto.SecretKeyFactory;
|
|
|
import javax.crypto.spec.IvParameterSpec;
|
|
|
import javax.crypto.spec.PBEKeySpec;
|
|
|
import javax.crypto.spec.SecretKeySpec;
|
|
|
|
|
|
/**
|
|
|
* 加密工具类，提供AES加密/解密、密码哈希生成和验证、密保问题答案哈希生成和验证等功能
|
|
|
*/
|
|
|
public class EncryptionUtils {
|
|
|
private static final String TAG = "EncryptionUtils";
|
|
|
|
|
|
// ====================== 常量定义 ======================
|
|
|
|
|
|
/**
|
|
|
* 加密算法：AES/CBC/PKCS7Padding
|
|
|
*/
|
|
|
public static final String ENCRYPTION_ALGORITHM = "AES/CBC/PKCS7Padding";
|
|
|
|
|
|
/**
|
|
|
* 密钥生成算法：PBKDF2WithHmacSHA256
|
|
|
*/
|
|
|
private static final String KEY_GENERATION_ALGORITHM = "PBKDF2WithHmacSHA256";
|
|
|
|
|
|
/**
|
|
|
* 哈希算法：SHA-256
|
|
|
*/
|
|
|
private static final String HASH_ALGORITHM = "SHA-256";
|
|
|
|
|
|
/**
|
|
|
* 密钥长度：256位
|
|
|
*/
|
|
|
private static final int KEY_LENGTH = 256;
|
|
|
|
|
|
/**
|
|
|
* 盐值长度：16字节
|
|
|
*/
|
|
|
private static final int SALT_LENGTH = 16;
|
|
|
|
|
|
/**
|
|
|
* 初始化向量长度：16字节
|
|
|
*/
|
|
|
private static final int IV_LENGTH = 16;
|
|
|
|
|
|
/**
|
|
|
* 迭代次数：10000
|
|
|
*/
|
|
|
private static final int ITERATION_COUNT = 10000;
|
|
|
|
|
|
// ====================== 工具方法 ======================
|
|
|
|
|
|
/**
|
|
|
* 生成随机盐值
|
|
|
* @return 随机盐值的Base64编码字符串
|
|
|
*/
|
|
|
public static String generateSalt() {
|
|
|
SecureRandom random = new SecureRandom();
|
|
|
byte[] salt = new byte[SALT_LENGTH];
|
|
|
random.nextBytes(salt);
|
|
|
return Base64.encodeToString(salt, Base64.NO_WRAP);
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 生成随机初始化向量
|
|
|
* @return 随机初始化向量的Base64编码字符串
|
|
|
*/
|
|
|
public static String generateIv() {
|
|
|
SecureRandom random = new SecureRandom();
|
|
|
byte[] iv = new byte[IV_LENGTH];
|
|
|
random.nextBytes(iv);
|
|
|
return Base64.encodeToString(iv, Base64.NO_WRAP);
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 基于密码和盐值生成密钥
|
|
|
* @param password 密码
|
|
|
* @param salt 盐值的Base64编码字符串
|
|
|
* @return 生成的密钥
|
|
|
* @throws GeneralSecurityException 安全异常
|
|
|
*/
|
|
|
public static SecretKey generateKey(String password, String salt) throws GeneralSecurityException {
|
|
|
byte[] saltBytes = Base64.decode(salt, Base64.NO_WRAP);
|
|
|
PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), saltBytes, ITERATION_COUNT, KEY_LENGTH);
|
|
|
SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(KEY_GENERATION_ALGORITHM);
|
|
|
byte[] keyBytes = keyFactory.generateSecret(keySpec).getEncoded();
|
|
|
return new SecretKeySpec(keyBytes, "AES");
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 加密文本
|
|
|
* @param plainText 明文文本
|
|
|
* @param password 密码
|
|
|
* @param salt 盐值的Base64编码字符串
|
|
|
* @param iv 初始化向量的Base64编码字符串
|
|
|
* @return 加密后的文本的Base64编码字符串
|
|
|
* @throws GeneralSecurityException 安全异常
|
|
|
*/
|
|
|
public static String encrypt(String plainText, String password, String salt, String iv) throws GeneralSecurityException {
|
|
|
SecretKey key = generateKey(password, salt);
|
|
|
byte[] ivBytes = Base64.decode(iv, Base64.NO_WRAP);
|
|
|
|
|
|
Cipher cipher = Cipher.getInstance(ENCRYPTION_ALGORITHM);
|
|
|
cipher.init(Cipher.ENCRYPT_MODE, key, new IvParameterSpec(ivBytes));
|
|
|
|
|
|
try {
|
|
|
byte[] encryptedBytes = cipher.doFinal(plainText.getBytes("UTF-8"));
|
|
|
return Base64.encodeToString(encryptedBytes, Base64.NO_WRAP);
|
|
|
} catch (UnsupportedEncodingException e) {
|
|
|
// UTF-8 是标准字符编码，不应该抛出此异常
|
|
|
throw new RuntimeException("UTF-8 encoding not supported", e);
|
|
|
}
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 解密文本
|
|
|
* @param encryptedText 加密文本的Base64编码字符串
|
|
|
* @param password 密码
|
|
|
* @param salt 盐值的Base64编码字符串
|
|
|
* @param iv 初始化向量的Base64编码字符串
|
|
|
* @return 解密后的明文文本
|
|
|
* @throws GeneralSecurityException 安全异常
|
|
|
*/
|
|
|
public static String decrypt(String encryptedText, String password, String salt, String iv) throws GeneralSecurityException {
|
|
|
SecretKey key = generateKey(password, salt);
|
|
|
byte[] ivBytes = Base64.decode(iv, Base64.NO_WRAP);
|
|
|
|
|
|
Cipher cipher = Cipher.getInstance(ENCRYPTION_ALGORITHM);
|
|
|
cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(ivBytes));
|
|
|
|
|
|
byte[] encryptedBytes = Base64.decode(encryptedText, Base64.NO_WRAP);
|
|
|
byte[] decryptedBytes = cipher.doFinal(encryptedBytes);
|
|
|
|
|
|
try {
|
|
|
return new String(decryptedBytes, "UTF-8");
|
|
|
} catch (UnsupportedEncodingException e) {
|
|
|
// UTF-8 是标准字符编码，不应该抛出此异常
|
|
|
throw new RuntimeException("UTF-8 encoding not supported", e);
|
|
|
}
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 生成密码哈希值
|
|
|
* @param password 密码
|
|
|
* @param salt 盐值的Base64编码字符串
|
|
|
* @return 密码哈希值的Base64编码字符串
|
|
|
*/
|
|
|
public static String generatePasswordHash(String password, String salt) {
|
|
|
try {
|
|
|
byte[] saltBytes = Base64.decode(salt, Base64.NO_WRAP);
|
|
|
byte[] passwordBytes = password.getBytes("UTF-8");
|
|
|
|
|
|
// 合并密码和盐值
|
|
|
byte[] combinedBytes = new byte[passwordBytes.length + saltBytes.length];
|
|
|
System.arraycopy(passwordBytes, 0, combinedBytes, 0, passwordBytes.length);
|
|
|
System.arraycopy(saltBytes, 0, combinedBytes, passwordBytes.length, saltBytes.length);
|
|
|
|
|
|
// 计算哈希值
|
|
|
MessageDigest digest = MessageDigest.getInstance(HASH_ALGORITHM);
|
|
|
byte[] hashBytes = digest.digest(combinedBytes);
|
|
|
|
|
|
return Base64.encodeToString(hashBytes, Base64.NO_WRAP);
|
|
|
} catch (NoSuchAlgorithmException e) {
|
|
|
Log.e(TAG, "Error generating password hash", e);
|
|
|
return null;
|
|
|
} catch (UnsupportedEncodingException e) {
|
|
|
Log.e(TAG, "Error generating password hash", e);
|
|
|
return null;
|
|
|
}
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 验证密码
|
|
|
* @param password 待验证的密码
|
|
|
* @param salt 盐值的Base64编码字符串
|
|
|
* @param storedHash 存储的哈希值的Base64编码字符串
|
|
|
* @return 密码是否正确
|
|
|
*/
|
|
|
public static boolean verifyPassword(String password, String salt, String storedHash) {
|
|
|
String generatedHash = generatePasswordHash(password, salt);
|
|
|
return generatedHash != null && generatedHash.equals(storedHash);
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 生成密保问题答案的哈希值
|
|
|
* @param answer 密保问题答案
|
|
|
* @param salt 盐值的Base64编码字符串
|
|
|
* @return 答案哈希值的Base64编码字符串
|
|
|
*/
|
|
|
public static String generateAnswerHash(String answer, String salt) {
|
|
|
// 转换为小写并去除空格，提高用户体验
|
|
|
String normalizedAnswer = answer.toLowerCase().trim();
|
|
|
return generatePasswordHash(normalizedAnswer, salt);
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 验证密保问题答案
|
|
|
* @param answer 待验证的答案
|
|
|
* @param salt 盐值的Base64编码字符串
|
|
|
* @param storedHash 存储的哈希值的Base64编码字符串
|
|
|
* @return 答案是否正确
|
|
|
*/
|
|
|
public static boolean verifyAnswer(String answer, String salt, String storedHash) {
|
|
|
String normalizedAnswer = answer.toLowerCase().trim();
|
|
|
String generatedHash = generatePasswordHash(normalizedAnswer, salt);
|
|
|
return generatedHash != null && generatedHash.equals(storedHash);
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 生成随机密钥（用于测试或特殊情况）
|
|
|
* @return 生成的密钥的Base64编码字符串
|
|
|
* @throws NoSuchAlgorithmException 算法不存在异常
|
|
|
*/
|
|
|
public static String generateRandomKey() throws NoSuchAlgorithmException {
|
|
|
KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
|
|
|
keyGenerator.init(KEY_LENGTH);
|
|
|
SecretKey key = keyGenerator.generateKey();
|
|
|
return Base64.encodeToString(key.getEncoded(), Base64.NO_WRAP);
|
|
|
}
|
|
|
}
|
