ECC 椭圆曲线密码学#

import javax.crypto.Cipher;
import javax.crypto.KeyAgreement;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.*;
import java.security.spec.ECGenParameterSpec;
import java.util.Arrays;

public class EcdhKeyExchange {
    
    /**
     * 生成 ECDH 密钥对
     * 推荐使用 Curve25519 或 P-256
     */
    public static KeyPair generateKeyPair(String curve) throws Exception {
        KeyPairGenerator generator = KeyPairGenerator.getInstance("EC");
        generator.initialize(new ECGenParameterSpec(curve), new SecureRandom());
        return generator.generateKeyPair();
    }
    
    /**
     * 执行 ECDH 密钥交换
     * @return 共享密钥
     */
    public static byte[] deriveSharedSecret(KeyPair ownKeyPair, 
            PublicKey otherPublicKey) throws Exception {
        
        KeyAgreement agreement = KeyAgreement.getInstance("ECDH");
        agreement.init(ownKeyPair.getPrivate());
        agreement.doPhase(otherPublicKey, true);
        
        // 原始 ECDH 输出是 x 坐标，需要 KDF 处理
        byte[] sharedSecret = agreement.generateSecret();
        return kdf(sharedSecret, 32); // 派生 32 字节
    }
    
    /**
     * 密钥派生函数（KDF）
     * NIST SP 800-56A 建议的简单 KDF
     */
    private static byte[] kdf(byte[] z, int keyLength) throws Exception {
        MessageDigest hash = MessageDigest.getInstance("SHA-256");
        byte[] k = new byte[keyLength];
        int hashLen = 32;
        
        for (int i = 0; i < (keyLength + hashLen - 1) / hashLen; i++) {
            hash.update(z);
            hash.update((byte) (i + 1));
            byte[] h = hash.digest();
            
            int copyLen = Math.min(h.length, keyLength - i * hashLen);
            System.arraycopy(h, 0, k, i * hashLen, copyLen);
        }
        
        return k;
    }
    
    /**
     * 完整的 ECDH 密钥交换 + 加密示例
     */
    public static EncryptedData ecdhEncrypt(String plaintext, 
            PublicKey recipientPublicKey) throws Exception {
        
        // 1. 生成临时密钥对
        KeyPair ephemeralKeyPair = generateKeyPair("X25519");
        
        // 2. 计算共享密钥
        byte[] sharedSecret = deriveSharedSecret(ephemeralKeyPair, recipientPublicKey);
        
        // 3. 生成 IV
        byte[] iv = new byte[12];
        new SecureRandom().nextBytes(iv);
        
        // 4. AES-GCM 加密
        SecretKey aesKey = new SecretKeySpec(sharedSecret, "AES");
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.ENCRYPT_MODE, aesKey, new GCMParameterSpec(128, iv));
        byte[] ciphertext = cipher.doFinal(plaintext.getBytes("UTF-8"));
        
        // 5. 返回加密数据和临时公钥
        return new EncryptedData(
            ciphertext,
            iv,
            ephemeralKeyPair.getPublic().getEncoded()
        );
    }
    
    /**
     * ECDH 解密
     */
    public static String ecdhDecrypt(EncryptedData encryptedData, 
            PrivateKey recipientPrivateKey) throws Exception {
        
        // 1. 恢复临时公钥
        KeyFactory keyFactory = KeyFactory.getInstance("EC");
        PublicKey ephemeralPublicKey = keyFactory.generatePublic(
            new java.security.spec.X509EncodedKeySpec(encryptedData.ephemeralPublicKey));
        
        // 2. 计算共享密钥
        byte[] sharedSecret = deriveSharedSecret(
            KeyPairGenerator.getInstance("EC")
                .generateKeyPair(), // 需要临时私钥
            ephemeralPublicKey
        );
        
        // 3. 解密
        SecretKey aesKey = new SecretKeySpec(sharedSecret, "AES");
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.DECRYPT_MODE, aesKey, 
            new GCMParameterSpec(128, encryptedData.iv));
        
        return new String(cipher.doFinal(encryptedData.ciphertext), "UTF-8");
    }
    
    public record EncryptedData(
        byte[] ciphertext,
        byte[] iv,
        byte[] ephemeralPublicKey
    ) {}
}

import java.security.*;
import java.security.spec.ECGenParameterSpec;
import java.util.Base64;

public class EcdsaSigning {
    
    /**
     * 生成 ECDSA 签名
     */
    public static byte[] sign(String message, PrivateKey privateKey) 
            throws Exception {
        Signature signature = Signature.getInstance("SHA256withECDSA");
        signature.initSign(privateKey, new SecureRandom());
        signature.update(message.getBytes("UTF-8"));
        return signature.sign();
    }
    
    /**
     * 验证签名
     */
    public static boolean verify(String message, byte[] signatureBytes, 
            PublicKey publicKey) throws Exception {
        Signature signature = Signature.getInstance("SHA256withECDSA");
        signature.initVerify(publicKey);
        signature.update(message.getBytes("UTF-8"));
        return signature.verify(signatureBytes);
    }
    
    /**
     * ECDSA 签名格式转换
     * Java 签名输出为 DER 格式，某些场景需要转换为纯 R|S 格式
     */
    public static byte[] derToRs(byte[] derSignature) {
        // DER 格式: 30 [len] 02 [r_len] r 02 [s_len] s
        int offset = 2; // 跳过 30 和长度
        
        // 读取 r
        if (derSignature[offset++] != 0x02) throw new IllegalArgumentException("Invalid R");
        int rLen = derSignature[offset++];
        byte[] r = new byte[rLen];
        System.arraycopy(derSignature, offset, r, 0, rLen);
        offset += rLen;
        
        // 读取 s
        if (derSignature[offset++] != 0x02) throw new IllegalArgumentException("Invalid S");
        int sLen = derSignature[offset++];
        byte[] s = new byte[sLen];
        System.arraycopy(derSignature, offset, s, 0, sLen);
        
        // 拼接 R|S（32 + 32 = 64 字节）
        byte[] result = new byte[64];
        System.arraycopy(normalize(r, 32), 0, result, 0, 32);
        System.arraycopy(normalize(s, 32), 0, result, 32, 32);
        return result;
    }
    
    private static byte[] normalize(byte[] value, int length) {
        byte[] result = new byte[length];
        System.arraycopy(value, Math.max(0, value.length - length), 
            result, Math.max(0, length - value.length), 
            Math.min(value.length, length));
        return result;
    }
}

/**
 * ECDHE 在 TLS 中的使用
 * 这是 TLS 1.2 及更高版本的标准配置
 */
public class EcdheDemo {
    
    /**
     * TLS 1.3 密码套件
     * TLS_AES_128_GCM_SHA256 使用 ECDH
     * 
     * TLS 1.3 的关键改进：
     * - 1-RTT 握手（比 1.2 快）
     * - 所有密钥交换都是临时的
     * - 强制前向保密
     */
    
    /**
     * 生成 ECDHE 参数
     */
    public static void generateEcdheParams() throws Exception {
        KeyPairGenerator generator = KeyPairGenerator.getInstance("EC");
        generator.initialize(new ECGenParameterSpec("secp384r1"));
        
        KeyPair keyPair = generator.generateKeyPair();
        
        // 公钥用于 TLS 握手的 ServerKeyExchange
        byte[] publicKey = keyPair.getPublic().getEncoded();
        
        // 私钥用于计算共享密钥
        // 握手完成后必须销毁
    }
}

/**
 * 恒定时间比较
 * 防止时序攻击
 */
public class ConstantTimeComparison {
    
    /**
     * 安全的字符串比较
     * 执行时间与输入无关
     */
    public static boolean constantTimeEquals(String a, String b) {
        if (a.length() != b.length()) {
            // 为了保持恒定时间，仍然执行比较
            byte[] dummy = new byte[Math.max(a.length(), b.length())];
            for (int i = 0; i < dummy.length; i++) {
                dummy[i] = (byte) (a.charAt(i % a.length()) ^ b.charAt(i % b.length()));
            }
            return false;
        }
        
        int result = 0;
        for (int i = 0; i < a.length(); i++) {
            result |= a.charAt(i) ^ b.charAt(i);
        }
        return result == 0;
    }
    
    /**
     * 恒定时间内存清零
     * 防止密钥在内存中残留
     */
    public static void secureZero(byte[] data) {
        if (data == null) return;
        for (int i = 0; i < data.length; i++) {
            data[i] = 0;
        }
    }
}

import org.bouncycastle.jce.spec.ECParameterSpec;

public class SecureEccOperations {
    
    /**
     * 抗侧信道攻击的标量乘法
     * 使用固定窗口算法
     */
    public static ECPoint secureMultiply(ECPoint G, byte[] k) {
        // 使用 Bouncy Castle 等经过审计的库
        // 不要自己实现椭圆曲线运算
        
        // 标量乘法是最容易泄露密钥的操作
        // 实现必须：
        // 1. 使用恒定时间的运算
        // 2. 使用防护（blinding）
        // 3. 随机化执行路径
        
        return G.multiply(k);
    }
}