RSA是1977年由罗纳德·李维斯特（Ron Rivest）、阿迪·萨莫尔（Adi Shamir）和伦纳德·阿德曼（Leonard Adleman）一起提出的。当时他们三人都在麻省理工学院工作。RSA就是他们三人姓氏开头字母拼在一起组成的。
RSA解决了对称加密的一个不足，比如AES算法加密和解密时使用的是同一个秘钥，因此这个秘钥不能公开，因此对于需要公开秘钥的场合，我们需要在加密和解密过程中使用不同的秘钥，加密使用的公钥可以公开，解密使用的私钥要保密，这就是非对称加密的好处。
常用的开发语言来实现RSA加密：
公钥与私钥
公钥与私钥是成对的，一般的，我们认为的是公钥加密、私钥解密、私钥签名、公钥验证，有人说成私钥加密，公钥解密时不对的。
公钥与私钥的生成有多种方式，可以通过程序生成（下文具体实现），可以通过openssl工具：
# 生成一个私钥，推荐使用1024位的秘钥，秘钥以pem格式保存到-out参数指定的文件中，采用PKCS1格式 openssl genrsa -out rsa.pem 1024 # 生成与私钥对应的公钥，生成的是Subject Public Key，一般配合PKCS8格式私钥使用 openssl rsa -in rsa.pem -pubout -out rsa.pub
RSA生成公钥与私钥一般有两种格式：PKCS1和PKCS8，上面的命令生成的秘钥是PKCS1格式的，而公钥是Subject Public Key，一般配合PKCS8格式私钥使用，所以就可能会涉及到PKCS1和PKCS8之间的转换：
# PKCS1格式私钥转换为PKCS8格式私钥，私钥直接输出到-out参数指定的文件中 openssl pkcs8 -topk8 -inform PEM -in rsa.pem -outform pem -nocrypt -out rsa_pkcs8.pem # PKCS8格式私钥转换为PKCS1格式私钥，私钥直接输出到-out参数指定的文件中 openssl rsa -in rsa_pkcs8.pem -out rsa_pkcs1.pem # PKCS1格式公钥转换为PKCS8格式公钥，转换后的内容直接输出 openssl rsa -pubin -in rsa.pub -RSAPublicKey_out # PKCS8格式公钥转换为PKCS1格式公钥，转换后的内容直接输出 openssl rsa -RSAPublicKey_in -pubout -in rsa.pub
现实中，我们往往从pem、crt、pfx文件获取公私和私钥，crt、pfx的制作可以参考：简单的制作ssl证书，并在nginx和IIS中使用，或者使用现成的：https://pan.baidu.com/s/1MJ5YmuZiLBnf-DfNR_6D7A (提取码：c6tj)，密码都是：123456
C#实现
为了方便读取pem、crt、pfx文件中的公私和私钥，这里我使用了第三方的包：Portable.BouncyCastle，可以使用NuGet安装：Install-Package Portable.BouncyCastle
接着，这里我封装了一个RsaHelper辅助类来实现各种RSA加密的过程：
using Org.BouncyCastle.Utilities.IO.Pem; using System; using System.Collections.Generic; using System.IO; using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates; using System.Text; namespace ConsoleApp1 { public class RsaHelper { #region key /// <summary> /// 将秘钥保存到Pem文件 /// </summary> /// <param name="isPrivateKey"></param> /// <param name="buffer"></param> /// <param name="pemFileName"></param> /// <returns></returns> public static void WriteToPem(byte[] buffer, bool isPrivateKey, string pemFileName) { PemObject pemObject = new PemObject(isPrivateKey ? "RSA PRIVATE KEY" : "RSA PUBLIC KEY", buffer); if (File.Exists(pemFileName)) { File.Delete(pemFileName); } using (var fileStream = new FileStream(pemFileName, FileMode.OpenOrCreate, FileAccess.Write)) { using (var sw = new StreamWriter(fileStream)) { var writer = new PemWriter(sw); writer.WriteObject(pemObject); sw.Flush(); } } } /// <summary> /// 从Pem文件中读取秘钥 /// </summary> /// <param name="pemFileName"></param> /// <returns></returns> public static byte[] ReadFromPem(string pemFileName) { using (var fileStream = new FileStream(pemFileName, FileMode.Open, FileAccess.Read)) { using (var sw = new StreamReader(fileStream)) { var writer = new PemReader(sw); return writer.ReadPemObject().Content; } } } /// <summary> /// 从xml中读取秘钥 /// </summary> /// <param name="xml"></param> /// <param name="isPrivateKey"></param> /// <param name="usePkcs8"></param> /// <returns></returns> public static byte[] ReadFromXml(string xml, bool isPrivateKey, bool usePkcs8) { using (var rsa = new RSACryptoServiceProvider()) { rsa.FromXmlString(xml); if (isPrivateKey) { return usePkcs8 ? rsa.ExportPkcs8PrivateKey() : rsa.ExportRSAPrivateKey(); } return usePkcs8 ? rsa.ExportSubjectPublicKeyInfo() : rsa.ExportRSAPublicKey(); } } /// <summary> /// 将秘钥保存到xml中 /// </summary> /// <param name="buffer"></param> /// <param name="isPrivateKey"></param> /// <param name="usePkcs8"></param> /// <returns></returns> public static string WriteToXml(byte[] buffer, bool isPrivateKey, bool usePkcs8) { using (var rsa = CreateRSACryptoServiceProvider(buffer, isPrivateKey, usePkcs8)) { return rsa.ToXmlString(isPrivateKey); } } /// <summary> /// 获取RSA非对称加密的Key /// </summary> /// <param name="publicKey"></param> /// <param name="privateKey"></param> public static void GenerateRsaKey(bool usePKCS8, out byte[] publicKey, out byte[] privateKey) { using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider()) { rsa.KeySize = 1024;//1024位 if (usePKCS8) { //使用pkcs8填充方式导出 publicKey = rsa.ExportSubjectPublicKeyInfo();//公钥 privateKey = rsa.ExportPkcs8PrivateKey();//私钥 } else { //使用pkcs1填充方式导出 publicKey = rsa.ExportRSAPublicKey();//公钥 privateKey = rsa.ExportRSAPrivateKey();//私钥 } } } /// <summary> /// 从Pfx文件获取RSA非对称加密的Key /// </summary> /// <param name="pfxFileName"></param> /// <param name="publicKey"></param> /// <param name="privateKey"></param> public static void ReadFromPfx(string pfxFileName, string password, out byte[] publicKey, out byte[] privateKey) { X509Certificate2 x509Certificate2 = new X509Certificate2(pfxFileName, password, X509KeyStorageFlags.Exportable); publicKey = x509Certificate2.GetRSAPublicKey().ExportRSAPublicKey(); privateKey = x509Certificate2.GetRSAPrivateKey().ExportRSAPrivateKey(); } /// <summary> /// 从Crt文件中读取公钥 /// </summary> /// <param name="crtFileName"></param> /// <param name="password"></param> /// <returns></returns> public static byte[] ReadPublicKeyFromCrt(string crtFileName, string password) { X509Certificate2 x509Certificate2 = new X509Certificate2(crtFileName, password, X509KeyStorageFlags.Exportable); var publicKey = x509Certificate2.GetRSAPublicKey().ExportRSAPublicKey(); return publicKey; } #endregion #region Pkcs1 and Pkcs8 /// <summary> /// Pkcs1转Pkcs8 /// </summary> /// <param name="isPrivateKey"></param> /// <param name="buffer"></param> /// <returns></returns> public static byte[] Pkcs1ToPkcs8(bool isPrivateKey, byte[] buffer) { using (var rsa = new RSACryptoServiceProvider()) { if (isPrivateKey) { rsa.ImportRSAPrivateKey(buffer, out _); return rsa.ExportPkcs8PrivateKey(); } else { rsa.ImportRSAPublicKey(buffer, out _); return rsa.ExportSubjectPublicKeyInfo(); } } } /// <summary> /// Pkcs8转Pkcs1 /// </summary> /// <param name="isPrivateKey"></param> /// <param name="buffer"></param> /// <returns></returns> public static byte[] Pkcs8ToPkcs1(bool isPrivateKey, byte[] buffer) { using (var rsa = new RSACryptoServiceProvider()) { if (isPrivateKey) { rsa.ImportPkcs8PrivateKey(buffer, out _); return rsa.ExportRSAPrivateKey(); } else { rsa.ImportSubjectPublicKeyInfo(buffer, out _); return rsa.ExportRSAPublicKey(); } } } #endregion #region RSA /// <summary> /// 获取一个RSACryptoServiceProvider /// </summary> /// <param name="isPrivateKey"></param> /// <param name="buffer"></param> /// <param name="usePkcs8"></param> /// <returns></returns> public static RSACryptoServiceProvider CreateRSACryptoServiceProvider(byte[] buffer, bool isPrivateKey, bool usePkcs8 = false) { RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(); if (isPrivateKey) { if (usePkcs8) rsa.ImportPkcs8PrivateKey(buffer, out _); else rsa.ImportRSAPrivateKey(buffer, out _); } else { if (usePkcs8) rsa.ImportSubjectPublicKeyInfo(buffer, out _); else rsa.ImportRSAPublicKey(buffer, out _); } return rsa; } /// <summary> /// RSA公钥加密 /// </summary> /// <param name="value">待加密的明文</param> /// <param name="publicKey">公钥</param> /// <param name="usePkcs8">是否使用pkcs8填充</param> /// <returns></returns> public static string RsaEncrypt(string value, byte[] publicKey, bool usePkcs8 = false) { if (string.IsNullOrEmpty(value)) return value; using (RSACryptoServiceProvider rsa = CreateRSACryptoServiceProvider(publicKey, false, usePkcs8)) { var buffer = Encoding.UTF8.GetBytes(value); buffer = rsa.Encrypt(buffer, false); //使用hex格式输出数据 StringBuilder result = new StringBuilder(); foreach (byte b in buffer) { result.AppendFormat("{0:x2}", b); } return result.ToString(); //或者使用下面的输出 //return BitConverter.ToString(buffer).Replace("-", "").ToLower(); } } /// <summary> /// RSA私钥解密 /// </summary> /// <param name="value">密文</param> /// <param name="privateKey">私钥</param> /// <param name="usePkcs8">是否使用pkcs8填充</param> /// <returns></returns> public static string RsaDecrypt(string value, byte[] privateKey, bool usePkcs8 = false) { if (string.IsNullOrEmpty(value)) return value; using (RSACryptoServiceProvider rsa = CreateRSACryptoServiceProvider(privateKey, true, usePkcs8)) { //转换hex格式数据为byte数组 var buffer = new byte[value.Length / 2]; for (var i = 0; i < buffer.Length; i++) { buffer[i] = (byte)Convert.ToInt32(value.Substring(i * 2, 2), 16); } buffer = rsa.Decrypt(buffer, false); return Encoding.UTF8.GetString(buffer); } } /// <summary> /// RSA私钥生成签名 /// </summary> /// <param name="value">原始值</param> /// <param name="publicKey">公钥</param> /// <param name="halg">签名hash算法：SHA，SHA1，MD5，SHA256，SHA384，SHA512</param> /// <param name="usePkcs8">是否使用pkcs8填充</param> /// <returns></returns> public static string Sign(string value, byte[] privateKey, string halg = "MD5", bool usePkcs8 = false) { if (string.IsNullOrEmpty(value)) return value; using (RSACryptoServiceProvider rsa = CreateRSACryptoServiceProvider(privateKey, true, usePkcs8)) { byte[] buffer = Encoding.UTF8.GetBytes(value); buffer = rsa.SignData(buffer, HashAlgorithm.Create(halg)); //使用hex格式输出数据 StringBuilder result = new StringBuilder(); foreach (byte b in buffer) { result.AppendFormat("{0:x2}", b); } return result.ToString(); //或者使用下面的输出 //return BitConverter.ToString(buffer).Replace("-", "").ToLower(); } } /// <summary> /// RSA公钥验证签名 /// </summary> /// <param name="value">原始值</param> /// <param name="publicKey">公钥</param> /// <param name="signature">签名</param> /// <param name="halg">签名hash算法：SHA，SHA1，MD5，SHA256，SHA384，SHA512</param> /// <param name="usePkcs8">是否使用pkcs8填充</param> /// <returns></returns> public static bool Verify(string value, byte[] publicKey, string signature, string halg = "MD5", bool usePkcs8 = false) { if (string.IsNullOrEmpty(value)) return false; using (RSACryptoServiceProvider rsa = CreateRSACryptoServiceProvider(publicKey, false, usePkcs8)) { //转换hex格式数据为byte数组 var buffer = new byte[signature.Length / 2]; for (var i = 0; i < buffer.Length; i++) { buffer[i] = (byte)Convert.ToInt32(signature.Substring(i * 2, 2), 16); } return rsa.VerifyData(Encoding.UTF8.GetBytes(value), HashAlgorithm.Create(halg), buffer); } } #endregion } }