前言：相信很多人使用SSH远程连接Linux，那么对于我们的用户名和密码，SSH是如何进行加密解密呢？经过和同事的讨论，逐渐了解了其加密原理，下面就来一一阐述：
加密原理
SSH是先通过非对称加密告诉服务端一个对称加密口令，然后进行验证用户名和密码的时候，使用双方已经知道的加密口令进行加密和解密，见下图：
解释：SSH中为什么要使用非对称加密，又使用对称加密，到底有什么用处？到底安全不安全？既然后来又使用了对称加密，开始的时候为什么还要用非对称加密？反过来，既然用非对称加密，为什么又要使用对称加密呢？
好了，，接下来进入到实战操作，我使用的是Java语言，
首先，你先把以下代码片段拷走
`package com.honzh.socket.base.rsa;
import java.security.MessageDigest;
import javax.crypto.KeyGenerator; import javax.crypto.Mac; import javax.crypto.SecretKey; import javax.crypto.spec.SecretKeySpec;
import sun.misc.BASE64Decoder; import sun.misc.BASE64Encoder;
/** * 基础加密组件 * * @author 梁栋 * @version 1.0 * @since 1.0 */ public abstract class Coder { public static final String KEY_SHA = “SHA”; public static final String KEY_MD5 = “MD5”;
/** * MAC算法可选以下多种算法 * * <pre> * HmacMD5 * HmacSHA1 * HmacSHA256 * HmacSHA384 * HmacSHA512 * </pre> */public static final String KEY_MAC = “HmacMD5”;/** * BASE64解密 * * @param key * @return * @throws Exception */public static byte[] decryptBASE64(String key) throws Exception {return (new BASE64Decoder()).decodeBuffer(key);}/** * BASE64加密 * * @param key * @return * @throws Exception */public static String encryptBASE64(byte[] key) throws Exception {return (new BASE64Encoder()).encodeBuffer(key);}/** * MD5加密 * * @param data * @return * @throws Exception */public static byte[] encryptMD5(byte[] data) throws Exception {MessageDigest md5 = MessageDigest.getInstance(KEY_MD5);md5.update(data);return md5.digest();}/** * SHA加密 * * @param data * @return * @throws Exception */public static byte[] encryptSHA(byte[] data) throws Exception {MessageDigest sha = MessageDigest.getInstance(KEY_SHA);sha.update(data);return sha.digest();}/** * 初始化HMAC密钥 * * @return * @throws Exception */public static String initMacKey() throws Exception {KeyGenerator keyGenerator = KeyGenerator.getInstance(KEY_MAC);SecretKey secretKey = keyGenerator.generateKey();return encryptBASE64(secretKey.getEncoded());}/** * HMAC加密 * * @param data * @param key * @return * @throws Exception */public static byte[] encryptHMAC(byte[] data, String key) throws Exception {SecretKey secretKey = new SecretKeySpec(decryptBASE64(key), KEY_MAC);Mac mac = Mac.getInstance(secretKey.getAlgorithm());mac.init(secretKey);return mac.doFinal(data);}
} package com.honzh.socket.base.rsa;
public class KeyResult { private String key; private byte[] result; private String signStr;
public String getKey() {return key;}public void setKey(String key) {this.key = key;}public byte[] getResult() {return result;}public void setResult(byte[] result) {this.result = result;}/** * @return the signStr */public String getSignStr() {return signStr;}/** * @param signStr the signStr to set */public void setSignStr(String signStr) {this.signStr = signStr;}
} package com.honzh.socket.base.rsa;
import java.security.Key; import java.security.KeyFactory; import java.security.KeyPair; import java.security.KeyPairGenerator; import java.security.PrivateKey; import java.security.PublicKey; import java.security.Signature; import java.security.interfaces.RSAPrivateKey; import java.security.interfaces.RSAPublicKey; import java.security.spec.PKCS8EncodedKeySpec; import java.security.spec.X509EncodedKeySpec; import java.util.HashMap; import java.util.Map;
import javax.crypto.Cipher;
/** * RSA安全编码组件 * * @author 梁栋 * @version 1.0 * @since 1.0 */ public abstract class RSACoder extends Coder { public static final String KEY_ALGORITHM = “RSA”; public static final String SIGNATURE_ALGORITHM = “MD5withRSA”;
private static final String PUBLIC_KEY = “RSAPublicKey”;private static final String PRIVATE_KEY = “RSAPrivateKey”;/** * 用私钥对信息生成数字签名 * * @param data *加密数据 * @param privateKey *私钥 * * @return * @throws Exception */public static String sign(byte[] data, String privateKey) throws Exception {// 解密由base64编码的私钥byte[] keyBytes = decryptBASE64(privateKey);// 构造PKCS8EncodedKeySpec对象PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);// KEY_ALGORITHM 指定的加密算法KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);// 取私钥匙对象PrivateKey priKey = keyFactory.generatePrivate(pkcs8KeySpec);// 用私钥对信息生成数字签名Signature signature = Signature.getInstance(SIGNATURE_ALGORITHM);signature.initSign(priKey);signature.update(data);return encryptBASE64(signature.sign());}/** * 校验数字签名 * * @param data *加密数据 * @param publicKey *公钥 * @param sign *数字签名 * * @return 校验成功返回true 失败返回false * @throws Exception * */public static boolean verify(byte[] data, String publicKey, String sign)throws Exception {// 解密由base64编码的公钥byte[] keyBytes = decryptBASE64(publicKey);// 构造X509EncodedKeySpec对象X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);// KEY_ALGORITHM 指定的加密算法KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);// 取公钥匙对象PublicKey pubKey = keyFactory.generatePublic(keySpec);Signature signature = Signature.getInstance(SIGNATURE_ALGORITHM);signature.initVerify(pubKey);signature.update(data);// 验证签名是否正常return signature.verify(decryptBASE64(sign));}/** * 解密<br> * 用私钥解密 * * @param data * @param key * @return * @throws Exception */public static byte[] decryptByPrivateKey(byte[] data, String key)throws Exception {// 对密钥解密byte[] keyBytes = decryptBASE64(key);// 取得私钥PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);Key privateKey = keyFactory.generatePrivate(pkcs8KeySpec);// 对数据解密Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());cipher.init(Cipher.DECRYPT_MODE, privateKey);return cipher.doFinal(data);}/** * 解密<br> * 用公钥解密 * * @param data * @param key * @return * @throws Exception */public static byte[] decryptByPublicKey(byte[] data, String key)throws Exception {// 对密钥解密byte[] keyBytes = decryptBASE64(key);// 取得公钥X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(keyBytes);KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);Key publicKey = keyFactory.generatePublic(x509KeySpec);// 对数据解密Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());cipher.init(Cipher.DECRYPT_MODE, publicKey);return cipher.doFinal(data);}/** * 加密<br> * 用公钥加密 * * @param data * @param key * @return * @throws Exception */public static byte[] encryptByPublicKey(byte[] data, String key)throws Exception {// 对公钥解密byte[] keyBytes = decryptBASE64(key);// 取得公钥X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(keyBytes);KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);Key publicKey = keyFactory.generatePublic(x509KeySpec);// 对数据加密Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());cipher.init(Cipher.ENCRYPT_MODE, publicKey);return cipher.doFinal(data);}/** * 加密<br> * 用私钥加密 * * @param data * @param key * @return * @throws Exception */public static byte[] encryptByPrivateKey(byte[] data, String key)throws Exception {// 对密钥解密byte[] keyBytes = decryptBASE64(key);// 取得私钥PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);Key privateKey = keyFactory.generatePrivate(pkcs8KeySpec);// 对数据加密Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());cipher.init(Cipher.ENCRYPT_MODE, privateKey);return cipher.doFinal(data);}/** * 取得私钥 * * @param keyMap * @return * @throws Exception */public static String getPrivateKey(Map<String, Object> keyMap)throws Exception {Key key = (Key) keyMap.get(PRIVATE_KEY);return encryptBASE64(key.getEncoded());}/** * 取得公钥 * * @param keyMap * @return * @throws Exception */public static String getPublicKey(Map<String, Object> keyMap)throws Exception {Key key = (Key) keyMap.get(PUBLIC_KEY);return encryptBASE64(key.getEncoded());}/** * 初始化密钥 * * @return * @throws Exception */public static Map<String, Object> initKey() throws Exception {KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance(KEY_ALGORITHM);keyPairGen.initialize(1024);KeyPair keyPair = keyPairGen.generateKeyPair();// 公钥RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();// 私钥RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();Map<String, Object> keyMap = new HashMap<String, Object>(2);keyMap.put(PUBLIC_KEY, publicKey);keyMap.put(PRIVATE_KEY, privateKey);return keyMap;}
} package com.honzh.socket.util;
明天是世上增值最快的一块土地，因它充满了希望
