Java对称加密与非对称加密区别、用途及工具类实战教程

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

/**
 * AES对称加密工具类（可直接复用）
 * 说明：128位密钥无需额外配置，256位密钥需安装JCE无限制权限文件
 */
public class AesEncryptUtil {

    // 加密算法：AES，模式：ECB，填充方式：PKCS5Padding（实际开发推荐用CBC模式，需加偏移量）
    private static final String ALGORITHM = "AES/ECB/PKCS5Padding";
    private static final String KEY_ALGORITHM = "AES";
    private static final int KEY_SIZE = 128; // 密钥长度：128/256

    /**
     * 生成AES密钥（返回Base64编码后的密钥字符串，方便存储）
     */
    public static String generateKey() throws Exception {
        KeyGenerator keyGenerator = KeyGenerator.getInstance(KEY_ALGORITHM);
        keyGenerator.init(KEY_SIZE);
        SecretKey secretKey = keyGenerator.generateKey();
        return Base64.getEncoder().encodeToString(secretKey.getEncoded());
    }

    /**
     * 加密：明文 -> Base64编码的密文
     * @param plainText 明文（待加密的字符串）
     * @param keyStr Base64编码后的密钥
     */
    public static String encrypt(String plainText, String keyStr) throws Exception {
        // 1. 解码密钥
        byte[] keyBytes = Base64.getDecoder().decode(keyStr);
        SecretKeySpec secretKey = new SecretKeySpec(keyBytes, KEY_ALGORITHM);
        // 2. 初始化加密器
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKey);
        // 3. 加密并返回Base64编码的密文
        byte[] encryptBytes = cipher.doFinal(plainText.getBytes("UTF-8"));
        return Base64.getEncoder().encodeToString(encryptBytes);
    }

    /**
     * 解密：Base64编码的密文 -> 明文
     * @param cipherText Base64编码后的密文
     * @param keyStr Base64编码后的密钥
     */
    public static String decrypt(String cipherText, String keyStr) throws Exception {
        // 1. 解码密钥和密文
        byte[] keyBytes = Base64.getDecoder().decode(keyStr);
        byte[] cipherBytes = Base64.getDecoder().decode(cipherText);
        SecretKeySpec secretKey = new SecretKeySpec(keyBytes, KEY_ALGORITHM);
        // 2. 初始化解密器
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, secretKey);
        // 3. 解密并返回明文
        byte[] decryptBytes = cipher.doFinal(cipherBytes);
        return new String(decryptBytes, "UTF-8");
    }

    // 测试方法
    public static void main(String[] args) throws Exception {
        // 1. 生成密钥（实际开发中密钥需妥善保管，如配置在Nacos、Vault中）
        String key = generateKey();
        System.out.println("AES密钥（Base64编码）：" + key);

        // 2. 加密
        String plainText = "用户身份证号：110101199001011234";
        String cipherText = encrypt(plainText, key);
        System.out.println("加密后的密文：" + cipherText);

        // 3. 解密
        String decryptText = decrypt(cipherText, key);
        System.out.println("解密后的明文：" + decryptText);
    }
}

import javax.crypto.Cipher;
import java.security.*;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;

/**
 * RSA非对称加密工具类（可直接复用）
 * 说明：密钥长度推荐2048位（安全性足够），4096位加密速度较慢
 */
public class RsaEncryptUtil {

    private static final String ALGORITHM = "RSA";
    private static final int KEY_SIZE = 2048; // 密钥长度：2048/4096
    // 签名算法：SHA256withRSA（SHA256哈希+RSA签名，安全性更高）
    private static final String SIGN_ALGORITHM = "SHA256withRSA";

    /**
     * 生成RSA密钥对（公钥+私钥），返回Base64编码后的字符串
     * @return 数组：[0]公钥，[1]私钥
     */
    public static String[] generateKeyPair() throws Exception {
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(ALGORITHM);
        keyPairGenerator.initialize(KEY_SIZE);
        KeyPair keyPair = keyPairGenerator.generateKeyPair();

        // 公钥编码为Base64字符串
        String publicKey = Base64.getEncoder().encodeToString(keyPair.getPublic().getEncoded());
        // 私钥编码为Base64字符串
        String privateKey = Base64.getEncoder().encodeToString(keyPair.getPrivate().getEncoded());

        return new String[]{publicKey, privateKey};
    }

    /**
     * 公钥加密（适合加密小数据，如AES密钥）
     * @param plainText 明文（待加密的字符串）
     * @param publicKeyStr Base64编码后的公钥
     */
    public static String encryptByPublicKey(String plainText, String publicKeyStr) throws Exception {
        // 1. 解码公钥
        byte[] publicKeyBytes = Base64.getDecoder().decode(publicKeyStr);
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKeyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);
        PublicKey publicKey = keyFactory.generatePublic(keySpec);

        // 2. 初始化加密器
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, publicKey);

        // 3. 加密（RSA加密有长度限制，需分段加密，这里简化处理短字符串）
        byte[] encryptBytes = cipher.doFinal(plainText.getBytes("UTF-8"));
        return Base64.getEncoder().encodeToString(encryptBytes);
    }

    /**
     * 私钥解密
     * @param cipherText Base64编码后的密文
     * @param privateKeyStr Base64编码后的私钥
     */
    public static String decryptByPrivateKey(String cipherText, String privateKeyStr) throws Exception {
        // 1. 解码私钥
        byte[] privateKeyBytes = Base64.getDecoder().decode(privateKeyStr);
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);
        PrivateKey privateKey = keyFactory.generatePrivate(keySpec);

        // 2. 初始化解密器
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, privateKey);

        // 3. 解密
        byte[] cipherBytes = Base64.getDecoder().decode(cipherText);
        byte[] decryptBytes = cipher.doFinal(cipherBytes);
        return new String(decryptBytes, "UTF-8");
    }

    /**
     * 私钥签名（用于数据防篡改、来源认证）
     * @param data 待签名的数据
     * @param privateKeyStr Base64编码后的私钥
     */
    public static String sign(String data, String privateKeyStr) throws Exception {
        // 1. 解码私钥
        byte[] privateKeyBytes = Base64.getDecoder().decode(privateKeyStr);
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);
        PrivateKey privateKey = keyFactory.generatePrivate(keySpec);

        // 2. 生成签名
        Signature signature = Signature.getInstance(SIGN_ALGORITHM);
        signature.initSign(privateKey);
        signature.update(data.getBytes("UTF-8"));
        byte[] signBytes = signature.sign();
        return Base64.getEncoder().encodeToString(signBytes);
    }

    /**
     * 公钥验签（验证数据是否被篡改、签名是否有效）
     * @param data 原始数据
     * @param sign 签名值（Base64编码）
     * @param publicKeyStr Base64编码后的公钥
     */
    public static boolean verifySign(String data, String sign, String publicKeyStr) throws Exception {
        // 1. 解码公钥
        byte[] publicKeyBytes = Base64.getDecoder().decode(publicKeyStr);
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKeyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);
        PublicKey publicKey = keyFactory.generatePublic(keySpec);

        // 2. 验证签名
        Signature signature = Signature.getInstance(SIGN_ALGORITHM);
        signature.initVerify(publicKey);
        signature.update(data.getBytes("UTF-8"));
        return signature.verify(Base64.getDecoder().decode(sign));
    }

    // 测试方法
    public static void main(String[] args) throws Exception {
        // 1. 生成密钥对
        String[] keyPair = generateKeyPair();
        String publicKey = keyPair[0];
        String privateKey = keyPair[1];
        System.out.println("RSA公钥（Base64编码）：" + publicKey);
        System.out.println("RSA私钥（Base64编码）：" + privateKey);

        // 2. 加密解密（加密AES密钥示例）
        String aesKey = "1234567890abcdef"; // 假设生成的AES密钥
        String encryptAesKey = encryptByPublicKey(aesKey, publicKey);
        System.out.println("公钥加密后的AES密钥：" + encryptAesKey);
        String decryptAesKey = decryptByPrivateKey(encryptAesKey, privateKey);
        System.out.println("私钥解密后的AES密钥：" + decryptAesKey);

        // 3. 签名验签
        String data = "接口返回数据：{\"code\":200,\"msg\":\"success\"}";
        String sign = sign(data, privateKey);
        System.out.println("私钥签名值：" + sign);
        boolean verifyResult = verifySign(data, sign, publicKey);
        System.out.println("公钥验签结果：" + verifyResult); // true表示验签通过
    }
}