北在北方

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.SecureRandom;
import java.security.Security;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;

import javax.crypto.Cipher;

import org.apache.commons.codec.binary.Base64;
import org.bouncycastle.jce.provider.BouncyCastleProvider;


/**
 * RSA 工具
 * @author Luxh
 *
 */
public class RSAUtils {
    
    
    
    private static final String ALGORITHM = "RSA";
    
    private static final String PROVIDER = "BC";
    
    private static final String TRANSFORMATION = "RSA/None/PKCS1Padding";
    
    private static final int KEY_SIZE = 1024;
    
    private static KeyPair keyPair = null;
    
    
    /**
     * 初始化密鑰對
     */
    static {
        try{
             Security.addProvider(new BouncyCastleProvider());
             SecureRandom secureRandom = new SecureRandom();
             KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(ALGORITHM, PROVIDER);
             keyPairGenerator.initialize(KEY_SIZE, secureRandom);
             keyPair = keyPairGenerator.generateKeyPair();
        }catch(Exception e) {
            e.printStackTrace();
        }
    }
    
    
    /**
     * 獲取公鑰
     * @return
     */
    public static RSAPublicKey getRSAPublicKey() {
         return (RSAPublicKey)keyPair.getPublic();
    } 
    
    /**
     * 獲取Base64編碼的公鑰
     * @return
     */
    public static String getBase64PublicKey() {
        RSAPublicKey publicKey = getRSAPublicKey();
        //return new String(Base64.encodeBase64(publicKey.getEncoded()));
        return Base64.encodeBase64String(publicKey.getEncoded());
    } 
    
    
    /**
     * 使用公鑰加密
     * @param data
     * @return
     */
    public static String encrypt(byte[] data) {
        String ciphertext = "";
        try {
            Cipher cipher = Cipher.getInstance(keyPair.getPublic().getAlgorithm());
            cipher.init(Cipher.ENCRYPT_MODE, keyPair.getPublic());
            ciphertext = Base64.encodeBase64String(cipher.doFinal(data));
        } catch (Exception e) {
            e.printStackTrace();
        }
        return ciphertext;
    }
    
    
    
    /**
     * 使用私鑰解密
     * @param ciphertext
     * @return
     */
    public static String decrypt(String ciphertext) {
        String plaintext = "";
        try {
            Security.addProvider(new BouncyCastleProvider());
            Cipher cipher = Cipher.getInstance(TRANSFORMATION, PROVIDER);
            RSAPrivateKey pbk = (RSAPrivateKey)keyPair.getPrivate();
            cipher.init(Cipher.DECRYPT_MODE, pbk);
            byte[] data = cipher.doFinal(Base64.decodeBase64(ciphertext));
            plaintext = new String(data);
        }catch (Exception e) {
            e.printStackTrace();
        }
        return plaintext;
    }
    
}

import java.util.Map;

import javax.servlet.http.HttpServletRequest;

import org.apache.commons.lang3.RandomStringUtils;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;

import com.google.common.collect.Maps;

import io.caimi.util.RSAUtils;

@RestController
public class DemoController {
    
    
    /**
     * 獲取公鑰和隨機(jī)值
     * 
     */
    @RequestMapping("/secret")
    public Map<String, Object> secret(HttpServletRequest request) {
        
        Map<String, Object> resultMap = Maps.newHashMap();
        
        // 獲取公鑰
        String publicKey = RSAUtils.getBase64PublicKey();
        resultMap.put("publicKey", publicKey);
        
        // 生成隨機(jī)值
        String rand =  RandomStringUtils.randomAlphabetic(6);
        resultMap.put("rand", rand);
        
        // 將生成的隨機(jī)值存到session中，實(shí)際使用可以存到第三方緩存中,并設(shè)置失效時間
        request.getSession().setAttribute("rand", rand);
        
        return resultMap;
        
    }
    
    
    /**
     * 校驗(yàn)
     * 
     */
    @RequestMapping(value="/check", method=RequestMethod.POST)
    public String check(HttpServletRequest request) {
        // 取得密文
        String password = request.getParameter("password");
        
        // 解密
        String plaintext = RSAUtils.decrypt(password);
        
        String[] arr = plaintext.split("\\|");
        
        // 校驗(yàn)隨機(jī)值
        String rand = arr[1];
        String randInSession = (String) request.getSession().getAttribute("rand");
        //隨機(jī)值失效
        request.getSession().removeAttribute("rand");
        
        if(!rand.equals(randInSession)) {
            return "非法的請求";
        }
        
        // 校驗(yàn)密碼
        String passwd = arr[0];
        
        // 實(shí)際中根據(jù)用戶名從數(shù)據(jù)庫中查詢出密碼
        String realPasswd = "8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92"; 
        
        if(!realPasswd.equals(passwd)) {
            return "密碼輸入錯誤";
        }
        
        return "校驗(yàn)通過";
    }
    
}