一篇搞定RSA加密与SHA签名|与Java完全同步

//根据你的p12文件生成私钥对应的SecKeyRef 这边返回若是nil 请检查你p12文件的生成步骤
- (SecKeyRef)getPrivateKeyRefrenceFromData:(NSData*)p12Data password:(NSString*)password {SecKeyRef privateKeyRef = NULL;
NSMutableDictionary * options = [[NSMutableDictionary alloc] init];
[options setObject: password forKey:(__bridge id)kSecImportExportPassphrase];
CFArrayRef items = CFArrayCreate(NULL, , , NULL);
OSStatus securityError = SecPKCS12Import((__bridge CFDataRef) p12Data, (__bridge CFDictionaryRef)options, &items);
if (securityError == noErr && CFArrayGetCount(items) > ) {
CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items, );
SecIdentityRef identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
securityError = SecIdentityCopyPrivateKey(identityApp, &privateKeyRef);
if (securityError != noErr) {
privateKeyRef = NULL;
}
}
CFRelease(items);return privateKeyRef;
}

//根据你的der文件公钥对应的SecKeyRef
- (SecKeyRef)getPublicKeyRefrenceFromeData: (NSData*)derData {SecCertificateRef myCertificate = SecCertificateCreateWithData(kCFAllocatorDefault, (__bridge CFDataRef)derData);
SecPolicyRef myPolicy = SecPolicyCreateBasicX509();
SecTrustRef myTrust;
OSStatus status = SecTrustCreateWithCertificates(myCertificate,myPolicy,&myTrust);
SecTrustResultType trustResult;
if (status == noErr) {
status = SecTrustEvaluate(myTrust, &trustResult);
}
SecKeyRef securityKey = SecTrustCopyPublicKey(myTrust);
CFRelease(myCertificate);
CFRelease(myPolicy);
CFRelease(myTrust);return securityKey;
}

- (NSData*)rsaEncryptData:(NSData*)data {
SecKeyRef key = [self getPublicKey];
size_t cipherBufferSize = SecKeyGetBlockSize(key);
uint8_t *cipherBuffer = malloc(cipherBufferSize * sizeof(uint8_t));
size_t blockSize = cipherBufferSize - ;
size_t blockCount = (size_t)ceil([data length] / (double)blockSize);
NSMutableData *encryptedData = [[NSMutableData alloc] init];
for (int i=; i<blockCount; i++) {
unsigned long bufferSize = MIN(blockSize , [data length] - i * blockSize);
NSData *buffer = [data subdataWithRange:NSMakeRange(i * blockSize, bufferSize)];
OSStatus status = SecKeyEncrypt(key, kSecPaddingPKCS1, (const uint8_t *)[buffer bytes], [buffer length], cipherBuffer, &cipherBufferSize); if (status != noErr) {
return nil;
} NSData *encryptedBytes = [[NSData alloc] initWithBytes:(const void *)cipherBuffer length:cipherBufferSize];
[encryptedData appendData:encryptedBytes];
} if (cipherBuffer){
free(cipherBuffer);
} return encryptedData;
}

- (NSData*)rsaDecryptData:(NSData*)data {
SecKeyRef key = [self getPrivatKey];size_t cipherBufferSize = SecKeyGetBlockSize(key);
size_t blockSize = cipherBufferSize;
size_t blockCount = (size_t)ceil([data length] / (double)blockSize);NSMutableData *decryptedData = [[NSMutableData alloc] init];for (int i = ; i < blockCount; i++) {
unsigned long bufferSize = MIN(blockSize , [data length] - i * blockSize);
NSData *buffer = [data subdataWithRange:NSMakeRange(i * blockSize, bufferSize)]; size_t cipherLen = [buffer length];
void *cipher = malloc(cipherLen);
[buffer getBytes:cipher length:cipherLen];
size_t plainLen = SecKeyGetBlockSize(key);
void *plain = malloc(plainLen); OSStatus status = SecKeyDecrypt(key, kSecPaddingPKCS1, cipher, cipherLen, plain, &plainLen); if (status != noErr) {
return nil;
} NSData *decryptedBytes = [[NSData alloc] initWithBytes:(const void *)plain length:plainLen];
[decryptedData appendData:decryptedBytes];
}return decryptedData;
}

//对数据进行sha256签名
- (NSData *)rsaSHA256SignData:(NSData *)plainData {
SecKeyRef key = [self getPrivatKey]; size_t signedHashBytesSize = SecKeyGetBlockSize(key);
uint8_t* signedHashBytes = malloc(signedHashBytesSize);
memset(signedHashBytes, 0x0, signedHashBytesSize); size_t hashBytesSize = CC_SHA256_DIGEST_LENGTH;
uint8_t* hashBytes = malloc(hashBytesSize);
if (!CC_SHA256([plainData bytes], (CC_LONG)[plainData length], hashBytes)) {
return nil;
} SecKeyRawSign(key,
kSecPaddingPKCS1SHA256,
hashBytes,
hashBytesSize,
signedHashBytes,
&signedHashBytesSize); NSData* signedHash = [NSData dataWithBytes:signedHashBytes
length:(NSUInteger)signedHashBytesSize]; if (hashBytes)
free(hashBytes);
if (signedHashBytes)
free(signedHashBytes); return signedHash;
}

//这边对签名的数据进行验证 验签成功，则返回YES
- (BOOL)rsaSHA256VerifyData:(NSData *)plainData withSignature:(NSData *)signature {
SecKeyRef key = [self getPublicKey]; size_t signedHashBytesSize = SecKeyGetBlockSize(key);
const void* signedHashBytes = [signature bytes]; size_t hashBytesSize = CC_SHA256_DIGEST_LENGTH;
uint8_t* hashBytes = malloc(hashBytesSize);
if (!CC_SHA256([plainData bytes], (CC_LONG)[plainData length], hashBytes)) {
return NO;
} OSStatus status = SecKeyRawVerify(key,
kSecPaddingPKCS1SHA256,
hashBytes,
hashBytesSize,
signedHashBytes,
signedHashBytesSize); return status == errSecSuccess;
}