错误填充异常 - pkcs11 中的 RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING

Question

我的应用程序正在访问 e-Token 以解密来自服务器的响应

来自服务器的会话密钥使用 :-

加密

RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING

我正在使用 SunPKCS11 Provider 来实现对加密令牌的访问。 每当我尝试使用上述机制解密它时，即使用 RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING 我得到：-

**javax.crypto.BadPaddingException: doFinal() failed  
    at sun.security.pkcs11.P11RSACipher.implDoFinal(P11RSACipher.java:328)  
    at sun.security.pkcs11.P11RSACipher.engineDoFinal(P11RSACipher.java:353)  
    at javax.crypto.Cipher.doFinal(DashoA13*..)

以下是我的代码：-

private static final String TRANSFORMATION = "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING";
private static final String SECURITY_PROVIDER = "BC";
private static final String DIGEST_ALGORITHM = "SHA-256";
private static final String MASKING_FUNCTION = "MGF1";

报错的代码sn-p如下：-

private byte[] decryptSecretKeyData(byte[] encryptedSecretKey, byte[] iv, PrivateKey privateKey) throws Exception {

        try {
            Cipher rsaCipher = Cipher.getInstance(TRANSFORMATION, SECURITY_PROVIDER);

            System.out.println("Cipher block initialized"); - **Printed**
            PSource pSrc = (new PSource.PSpecified(iv));
            System.out.println("PSource inisitialized"); - **Printed**


            rsaCipher.init(Cipher.DECRYPT_MODE, privateKey,
                    new OAEPParameterSpec(DIGEST_ALGORITHM, MASKING_FUNCTION,
                            MGF1ParameterSpec.SHA256, pSrc));


            System.out.println("Here after cipher initilaization");  - **Not Printed***

            return rsaCipher.doFinal(encryptedSecretKey);
        } catch (GeneralSecurityException e) {
            System.out.println("GeneralSecurityException is "+e.getMessage());
            throw new Exception("Failed to decrypt AES secret key using RSA.", e);
        }
    }

我被困在这里，无法解密 OAEP 转换。

Answer 1

您从加密狗获得一个不可提取的私钥P11Key.P11PrivateKey。它不能在 PKCS11 提供程序之外使用，因此，应使用 SunPKCS11 提供程序进行具有该密钥的操作。

很遗憾，SunPKCS11 提供程序不支持 OAEP 填充，这使其更加困难。 加密仍然可以使用 BouncyCastle 完成，但解密可以在没有填充和 SunPKCS11 提供程序的情况下完成。 keyLength 参数是以位为单位的 RSA 密钥模数长度（1024,2048 等）。

private void testEncryption(byte[] plainText, PrivateKey privateKey, PublicKey publicKey, int keyLength) throws GeneralSecurityException {

    System.out.println("Plain text: " + DatatypeConverter.printHexBinary(plainText));

    Provider bcProvider = new BouncyCastleProvider();
    Cipher rsaCipher = Cipher.getInstance("RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING", bcProvider);
    rsaCipher.init(Cipher.ENCRYPT_MODE, publicKey);
    byte[] cipherText = rsaCipher.doFinal(plainText);

    System.out.println("Cipher text: " + DatatypeConverter.printHexBinary(cipherText));

    Provider pkcs11provider = new SunPKCS11("C:\\Users\\manishs525\\pkcs11.cfg");
    Cipher rsaCipher2 = Cipher.getInstance("RSA/ECB/NoPadding", pkcs11provider);
    rsaCipher2.init(Cipher.DECRYPT_MODE, privateKey);
    byte[] paddedPlainText = rsaCipher2.doFinal(cipherText);

    /* Ensure leading zeros not stripped */
    if (paddedPlainText.length < keyLength / 8) {
        byte[] tmp = new byte[keyLength / 8];
        System.arraycopy(paddedPlainText, 0, tmp, tmp.length - paddedPlainText.length, paddedPlainText.length);
        System.out.println("Zero padding to " + (keyLength / 8));
        paddedPlainText = tmp;
    }           

    System.out.println("OAEP padded plain text: " + DatatypeConverter.printHexBinary(paddedPlainText));

    OAEPParameterSpec paramSpec = new OAEPParameterSpec("SHA-256", "MGF1", MGF1ParameterSpec.SHA1,
            PSource.PSpecified.DEFAULT);
    RSAPadding padding = RSAPadding.getInstance(RSAPadding.PAD_OAEP_MGF1, keyLength / 8, new SecureRandom(), paramSpec);
    byte[] plainText2 = padding.unpad(paddedPlainText);

    System.out.println("Unpadded plain text: " + DatatypeConverter.printHexBinary(plainText2));
}

注意事项：

• JDK1.7 之前的 SunPKCS11 未实现 RSA/ECB/NoPadding。
• 此示例已使用 BouncyCastle 1.50 和 JDK 1.7 进行了测试

Answer 2

我发现问题是 SunJCE 的密码“RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING”的实现与其他实现不兼容（BouncyCastle/IAIK/PKCS11 )

在设置 AlgorithmParameters（使用 OAEPParameterSpec）时会引发异常(javax.crypto.BadPaddingException)

参考： Problems with Cipher "RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING" Bug Details