使用 Java 解密时出错

Question

我在尝试解密文档时遇到了麻烦，我正在使用公钥/私钥对来执行此操作。我正在使用令牌来执行此操作。

这是我得到的错误：

java.security.ProviderException: java.security.KeyException: An internal error occurred.

at sun.security.mscapi.RSACipher.doFinal(RSACipher.java:297)
at sun.security.mscapi.RSACipher.engineDoFinal(RSACipher.java:321)
at javax.crypto.Cipher.doFinal(Cipher.java:2087)
at org.bouncycastle.operator.jcajce.JceAsymmetricKeyUnwrapper.generateUnwrappedKey(Unknown Source)
at org.bouncycastle.cms.jcajce.JceKeyTransRecipient.extractSecretKey(Unknown Source)
at org.bouncycastle.cms.jcajce.JceKeyTransEnvelopedRecipient.getRecipientOperator(Unknown Source)
at org.bouncycastle.cms.KeyTransRecipientInformation.getRecipientOperator(Unknown Source)
at org.bouncycastle.cms.RecipientInformation.getContentStream(Unknown Source)
at org.bouncycastle.cms.RecipientInformation.getContent(Unknown Source)
at ec.gov.informatica.firmadigital.cms.CMSEncryption.decrypt(CMSEncryption.java:198)
at ec.mil.gestordocumental.security.test.encryption.DecryptFileWithPublicCertificateToken.mainTest(DecryptFileWithPublicCertificateToken.java:110)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:44)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:15)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:41)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:20)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:76)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:50)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:193)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:52)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:191)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:42)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:184)
at org.junit.runners.ParentRunner.run(ParentRunner.java:236)
at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:50)
at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:467)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:683)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:390)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:197)
Caused by: java.security.KeyException: An internal error occurred.

at sun.security.mscapi.RSACipher.encryptDecrypt(Native Method)
at sun.security.mscapi.RSACipher.doFinal(RSACipher.java:289)
... 32

这是我用来解密的代码：

public static byte[] decrypt(byte[] encrypted, X509Certificate cert, PrivateKey privateKey, Provider provider) {
    try {
        CMSEnvelopedData enveloped = new CMSEnvelopedData(encrypted);

        RecipientInformationStore recipients = enveloped.getRecipientInfos();
        X509CollectionStoreParameters s = new X509CollectionStoreParameters(Collections.singleton(new JcaX509CertificateHolder(cert)));

        X509StoreCertCollection s1 = new X509StoreCertCollection();
        s1.engineInit(s);

        Iterator it = recipients.getRecipients().iterator();

        RecipientInformation recipient = null;

        while (it.hasNext()) {
            recipient = (RecipientInformation) it.next();

            if (recipient instanceof KeyTransRecipientInformation) {
                Collection matches = s1.engineGetMatches(recipient.getRID());

                if (!matches.isEmpty()) {
                      JceKeyTransEnvelopedRecipient ter = null;

                      if ("sun.security.mscapi.RSAPrivateKey".equals(privateKey.getClass().getCanonicalName() ) ) {
                            ter = new JceKeyTransEnvelopedRecipient(privateKey);
                            ter.setProvider( "SunMSCAPI" );
                            ter.setContentProvider(BouncyCastleProvider.PROVIDER_NAME);
                        } else {
                            ter = new JceKeyTransEnvelopedRecipient(privateKey);
                            ter.setProvider(BouncyCastleProvider.PROVIDER_NAME);
                        } 

                    return recipient.getContent(ter);
                }
            } else {
                throw new RuntimeException("Wrong type of RecipientInformation: " + recipient.getClass());
            }
            recipient=null;
        }

        if (recipient == null) {
            throw new RuntimeException("Could not find a matching recipient"); 
        }

    } catch (CMSException e) {
        throw new RuntimeException(e); // FIXME
    } catch (CertificateEncodingException e) {
        throw new RuntimeException(e);
    }
}

请帮我看看可能是什么。

非常感谢。

Answer 1

我在解密时遇到了同样的问题，同时使用 MSCAPI 和 PKCS#11。我发现在 SunPKCS11 中实现的 P11RSAChiper 不考虑 wrap/unwrap 方法，它为此使用 encrypt/decrypt，在我的情况下，这与底层安全层冲突，其中私钥被标记为仅由智能卡配置文件。