android簽名

轉載時請注明出處和作者聯系方式

文章出處：http://www.limodev.cn/blog

作者聯系方式：李先靜 <xianjimli at hotmail dot com>

昨天看了一下Android中的簽名機制，這裡介紹一下Android中簽名用的Key的産生方法和簽名的原理。

産生Key

o 産生RSA私鑰(private key)

openssl genrsa -3 -out testkey.pem 2048

-3 是算法的參數（public exponent）。

2048 是私鑰長度。

testkey.pem 是輸出的檔案。

o 産生PKCS#10格式的認證請求。所謂認證請求就是發給認證機構認證的一個請求，它主要包括一個公鑰和一些相關資訊(如組織名稱和聯系人郵件位址)。

openssl req -new -x509 -key testkey.pem -out testkey.x509.pem -days 10000 /

-subj ‘/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]’

如果不提供最後兩個參數，openssl會提示你輸入相關資訊，這裡的資訊可以根據你自己的實際情況填寫。如：

openssl req -new -x509 -key testkey.pem -out testkey.x509.pem -days 10000

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.’, the field will be left blank.

—–

Country Name (2 letter code) [GB]:CN

State or Province Name (full name) [Berkshire]:GuangDong

Locality Name (eg, city) [Newbury]:ShenZhen

Organization Name (eg, company) [My Company Ltd]:Topwise

Organizational Unit Name (eg, section) []:Broncho

Common Name (eg, your name or your server’s hostname) []:broncho.cn

Email Address []:[email protected]

o 把私鑰的格式轉換成PKCS #8（Private-Key Information Syntax Standard.）

openssl pkcs8 -in testkey.pem -topk8 -outform DER -out testkey.pk8 -nocrypt

私鑰是不能讓别人知道的，否則就起不到保密的作用了。私鑰通常是要加密儲存的，但這裡指定了-nocryp，表示不加密。

Android提供了一個腳本mkkey.sh用來簡化上面的步驟：

if ["$1" == ""]; then

   echo "Create a test certificate key."

   echo "Usage: $0 NAME"

   echo "Will generate NAME.pk8 and NAME.x509.pem"

   echo "  /C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]"

   return

fi

openssl genrsa -3 -out $1.pem 2048

openssl req -new -x509 -key $1.pem -out $1.x509.pem -days 10000 /

   -subj '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]'

openssl pkcs8 -in $1.pem -topk8 -outform DER -out $1.pk8 -nocrypt