入坑指南 1：kotlin的Byte是有符号，go的是无符号，所以kotlin的ByteArray打印出来有负数，golang没有。因此会造成ByteArray的size有时是33位，有时是32位。(33位是在前面补了一个0，保证数值不会因为符号位产生变化)；
入坑指南 2：kotlin和go的encoded publickey算法不同，导致相互无法转换正确。
入坑指南 3：kotlin的标准secp256r1曲线和go的曲线参数不一样。
入坑指南 4: kotlin和go的密钥交换算法原理相同，实现大有千秋，这里使用java实现go的密钥交换算法。鉴于笔者kotlin/java语言现学现卖，可能已经有实现好的算法库，奈何我即不会找kotlin的底层源代码，又没有找到相对应go的算法库，只好自己实现，能用就行，我还奢求什么呢？
背景
go写的服务端后台，android是客户端之一，需要用到密钥交换（ecdh）算法生成aes密钥加密数据。公私钥生成算法，ECC-P256，也即secp256r1.
go 公私钥生成算法
func GenerateECP256Keypair() (privBytes []byte, pubBytes []byte, err error) {
priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil {
return nil, nil, fmt.Errorf("Failed to generate ecdsa key using curve p256, error: %v", err)
}
privBytes, err = x509.MarshalECPrivateKey(priv)
if err != nil {
return nil, nil, fmt.Errorf("Failed to marshal EC private key, error: %v", err)
}
pubBytes = elliptic.Marshal(elliptic.P256(), priv.X, priv.Y)
return
}
坑2注意 pubBytes 的生成方式：pubBytes = elliptic.Marshal(elliptic.P256(), priv.X, priv.Y)，google大半天，android的官方手册也翻烂，确认kotlin是没有相对应的方法实现的，无奈只能手撸。
kotlin 公私钥生成算法
fun generateKeyPair(): KeyPair {
val kpg = KeyPairGenerator.getInstance("EC")
kpg.initialize(256)
return kpg.generateKeyPair()
}
密钥交换流程
- 服务端、客户端各自生成公私钥后保存在本地，然后通过http/tcp接口交换对方公钥，其中公钥以十六进制形式编码；
- 服务端、客户端各自还原对方公钥；
- 服务端、客户端各自通过自己的私钥和对方公钥生成aes密钥。
公钥编码
go 公钥编码
func Test_GenerateECP256Keypair(t *testing.T) {
privBytes, pubBytes, err := GenerateECP256Keypair()
assert.NoError(t, err)
fmt.Println("priv:", hex.EncodeToString(privBytes))
fmt.Println("pub:", hex.EncodeToString(pubBytes))
}
kotlin 公钥编码
@Test
fun formatPublicKey() {
var clientPubKey = generateKeyPair().public as ECPublicKey
var ecPubHex = toPublicHex(clientPubKey)
println("pub: $ecPubHex")
}
fun toPublicHex(publicKey: ECPublicKey): String {
val pubBytes = ECC.marshal(publicKey.params.curve, publicKey.w)
return HexUtil.uBytesToHex(pubBytes)
}
val U_BYTE_ARRAY_SIZE = 33
fun marshal(curve: EllipticCurve, g: ECPoint): UByteArray {
val byteLen = (curve.field.fieldSize + 7) shr 3
val ret = UByteArray(1 + 2 * byteLen)
// uncompressed point
ret[0] = 4.toUByte()
// copy xBytes into ret
var xBytes = g.affineX.toByteArray().toUByteArray()
if (xBytes.size == U_BYTE_ARRAY_SIZE) {
xBytes = xBytes.copyOfRange(1, U_BYTE_ARRAY_SIZE)
}
xBytes.copyInto(ret, 1 + byteLen - xBytes.size)
// copy yBytes into ret
var yBytes = g.affineY.toByteArray().toUByteArray()
if (yBytes.size == U_BYTE_ARRAY_SIZE) {
yBytes = yBytes.copyOfRange(1, U_BYTE_ARRAY_SIZE)
}
yBytes.copyInto(ret, 1 + 2 * byteLen - yBytes.size)
return ret
}
fun uBytesToHex(data: UByteArray): String {
return data.toHex()
}
private fun UByteArray.toHex(): String {
val result = StringBuffer()
forEach {
val octet = it.toInt()
val firstIndex = (octet and 0xF0).ushr(4)
val secondIndex = octet and 0x0F
result.append(HEX_CHARS[firstIndex])
result.append(HEX_CHARS[secondIndex])
}
return result.toString()
}
坑1 由于java的byte是有符号的，而go的是无符号的，因此，所有涉及到byte转换的全部采用ubyte处理，否则会出现数据不一致的问题。注意kotlin的十六进制转换二进制都是用的 UByteArray 。
坑2 官方推荐的publickey编码方式是keypair.public.encoded，然鹅此方式是采用X509格式编码的，具体实现我找不到源码(O_o)，也无从判断到底在go中应该是怎样。而go的X509的语法糖并没有类似的方法，如图。因此只好对着go的源码实现了一版kotlin的，go-x509语法糖如图所示：
go-x509.png
go的公钥Marshal源码：
// $GOROOT/src/crypto/elliptic/elliptic.go
func Marshal(curve Curve, x, y *big.Int) []byte {
byteLen := (curve.Params().BitSize + 7) >> 3
ret := make([]byte, 1+2*byteLen)
ret[0] = 4 // uncompressed point
fmt.Println("ret:", ret)
xBytes := x.Bytes()
copy(ret[1+byteLen-len(xBytes):], xBytes)
yBytes := y.Bytes()
copy(ret[1+2*byteLen-len(yBytes):], yBytes)
return ret
}
公钥还原
go公钥还原
func Test_Android_ECDH(t *testing.T) {
androidPubKey := "045D8A26B69C8929E1B22FFBA03DD3F1FA59A1BD6AA22B5A43A14F8BAA769939055BDE35936605A897B5CF295029FC3F02F4AC22D173FC08795B1258F0AC4B9B25"
pubBytes, err := hex.DecodeString(androidPubKey)
if err != nil {
t.Fatal(err)
}
x, y := elliptic.Unmarshal(elliptic.P256(), pubBytes)
pubkey := &ecdsa.PublicKey{Curve: elliptic.P256(), X: x, Y: y}
}
// $GOROOT/src/crypto/elliptic/elliptic.go
func Unmarshal(curve Curve, data []byte) (x, y *big.Int) {
byteLen := (curve.Params().BitSize + 7) >> 3
if len(data) != 1+2*byteLen {
return
}
if data[0] != 4 { // uncompressed form
return
}
p := curve.Params().P
x = new(big.Int).SetBytes(data[1 : 1+byteLen])
y = new(big.Int).SetBytes(data[1+byteLen:])
if x.Cmp(p) >= 0 || y.Cmp(p) >= 0 {
return nil, nil
}
if !curve.IsOnCurve(x, y) {
return nil, nil
}
return
}
kotlin 公钥还原
fun fromPublicHex(pubHex: String): ECPublicKey {
HexUtil.hexToUBytes(pubHex).run {
ECC.unmarshal(getParams().curve, this)
}.run {
ECPublicKeySpec(this, getParams())
}.run {
KeyFactory.getInstance("EC").generatePublic(this)
}.run {
return this as ECPublicKey
}
}
fun hexToUBytes(encoded: String): UByteArray {
if (encoded.length % 2 !== 0)
throw IllegalArgumentException("Input string must contain an even number of characters")
val result = UByteArray(encoded.length / 2)
val enc = encoded.toCharArray()
var i = 0
while (i < enc.size) {
val curr = StringBuilder(2)
curr.append(enc[i]).append(enc[i + 1])
result[i / 2] = Integer.parseInt(curr.toString(), 16).toUByte()
i += 2
}
return result
}
val ERROR_EC_POINT = ECPoint(BigInteger("0"), BigInteger("0"))
// unmarshal converts a point, serialized by Marshal, into an x, y pair.
// It is an error if the point is not in uncompressed form or is not on the curve.
// On error, ECPoint = ERROR_EC_POINT.
fun unmarshal(curve: EllipticCurve, data: UByteArray): ECPoint {
val byteLen = (curve.field.fieldSize + 7) shr 3
if (data.size != 1 + 2 * byteLen) {
return ERROR_EC_POINT
}
// uncompressed form
if (data[0].toInt() != 4) {
return ERROR_EC_POINT
}
// get x from data
var xBytes = UByteArray(1 + byteLen)
data.copyInto(xBytes, 1, 1, 1 + byteLen)
val x = BigInteger(xBytes.toByteArray())
// get y from data
var yBytes = UByteArray(1 + byteLen)
data.copyInto(yBytes, 1, 1 + byteLen, data.size)
val y = BigInteger(yBytes.toByteArray())
// check x and y
val p = getGoLangP(curve)
if (x >= p || y >= p) {
return ERROR_EC_POINT
}
if (!isOnCurve(curve, x, y)) {
return ERROR_EC_POINT
}
return ECPoint(x, y)
}
注意，在UByteArray转换为BigInteger上时，一定一定要在前面多出一位来取消java的符号位限制，否则整数可能会变成负数。
坑3源码打印出来，go的曲线结构为：
go-curve.png
其中：各个参数为定值：
go-params.png
而kotlin的曲线结构为：
kotlin-curve.png
其中：各个参数为定值：
kotlin-params.png
对比上面4个图可以看到，go中多一个参数N，且go中的P正好是kotlin的a+3，而go中的B则完全对应kotlin中的b。另，Go中的BitSize则对应kotlin中的filedSize，都是256。
因此，在实现用kotlin实现go的unmarshal方法时，必须要做一个变换：
private fun getGoLangP(curve: EllipticCurve): BigInteger {
return curve.a.add(BigInteger("3"))
}
fun isOnCurve(curve: EllipticCurve, x: BigInteger, y: BigInteger): Boolean {
// y² = x³ - 3x + b
var y2 = y.multiply(y)
val curveP = getGoLangP(curve)
y2 = y2.mod(curveP)
var x3 = x.multiply(x)
x3 = x3.multiply(x)
var threeX = x.shl(1)
threeX = threeX.add(x)
x3 = x3.subtract(threeX)
x3 = x3.add(curve.b)
x3 = x3.mod(curveP)
return x3.compareTo(y2) == 0
}
密钥交换
go密钥交换
// ECDH is Elliptic Curve Diffie-Hellman as defined in ANSI X9.63 and as described in RFC 3278: "Use of Elliptic
// Curve Cryptography (ECC) Algorithms in Cryptographic Message Syntax (CMS)."
//
// see more detail: https://www.ietf.org/rfc/rfc3278.txt
type ECDH struct{}
// GenerateSharedSecret creates the shared secret and returns it as a sha256 hashed object.
func (ecdh *ECDH) GenerateSharedSecret(priv crypto.PrivateKey, pub crypto.PublicKey) ([]byte, error) {
privateKey, ok := priv.(*ecdsa.PrivateKey)
if !ok {
return nil, errors.New("priv only support ecdsa.PrivateKey point type")
}
publicKey, ok := pub.(*ecdsa.PublicKey)
if !ok {
return nil, errors.New("pub only support ecdsa.PublicKey point type")
}
x, _ := publicKey.Curve.ScalarMult(publicKey.X, publicKey.Y, privateKey.D.Bytes())
sharedKey := sha256.Sum256(x.Bytes())
return sharedKey[:], nil
}
注意：在go中，共享密钥的生成是通过publicKey.Curve.ScalarMult(publicKey.X, publicKey.Y, privateKey.D.Bytes())来计算而得的，kotlin官方推荐是这样：
fun generateSharedSecret(privateKey: PrivateKey, publicKey: PublicKey): SecretKey {
val keyAgreement = KeyAgreement.getInstance("ECDH", org.bouncycastle.jce.provider.BouncyCastleProvider())
keyAgreement.init(privateKey)
keyAgreement.doPhase(publicKey, true)
return keyAgreement.generateSecret("AES")
}
由于源码未可知，和go的区别在哪也不敢轻下断言，故而只能再次手撸kotlin版go的密钥交换。
ScalarMult
func (curve *CurveParams) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
Bz := new(big.Int).SetInt64(1)
x, y, z := new(big.Int), new(big.Int), new(big.Int)
for _, byte := range k {
for bitNum := 0; bitNum < 8; bitNum++ {
x, y, z = curve.doubleJacobian(x, y, z)
if byte&0x80 == 0x80 {
x, y, z = curve.addJacobian(Bx, By, Bz, x, y, z)
}
byte <<= 1
}
}
return curve.affineFromJacobian(x, y, z)
}
// doubleJacobian takes a point in Jacobian coordinates, (x, y, z), and
// returns its double, also in Jacobian form.
func (curve *CurveParams) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int, *big.Int) {
// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
delta := new(big.Int).Mul(z, z)
delta.Mod(delta, curve.P)
gamma := new(big.Int).Mul(y, y)
gamma.Mod(gamma, curve.P)
alpha := new(big.Int).Sub(x, delta)
if alpha.Sign() == -1 {
alpha.Add(alpha, curve.P)
}
alpha2 := new(big.Int).Add(x, delta)
alpha.Mul(alpha, alpha2)
alpha2.Set(alpha)
alpha.Lsh(alpha, 1)
alpha.Add(alpha, alpha2)
beta := alpha2.Mul(x, gamma)
x3 := new(big.Int).Mul(alpha, alpha)
beta8 := new(big.Int).Lsh(beta, 3)
beta8.Mod(beta8, curve.P)
x3.Sub(x3, beta8)
if x3.Sign() == -1 {
x3.Add(x3, curve.P)
}
x3.Mod(x3, curve.P)
z3 := new(big.Int).Add(y, z)
z3.Mul(z3, z3)
z3.Sub(z3, gamma)
if z3.Sign() == -1 {
z3.Add(z3, curve.P)
}
z3.Sub(z3, delta)
if z3.Sign() == -1 {
z3.Add(z3, curve.P)
}
z3.Mod(z3, curve.P)
beta.Lsh(beta, 2)
beta.Sub(beta, x3)
if beta.Sign() == -1 {
beta.Add(beta, curve.P)
}
y3 := alpha.Mul(alpha, beta)
gamma.Mul(gamma, gamma)
gamma.Lsh(gamma, 3)
gamma.Mod(gamma, curve.P)
y3.Sub(y3, gamma)
if y3.Sign() == -1 {
y3.Add(y3, curve.P)
}
y3.Mod(y3, curve.P)
return x3, y3, z3
}
// addJacobian takes two points in Jacobian coordinates, (x1, y1, z1) and
// (x2, y2, z2) and returns their sum, also in Jacobian form.
func (curve *CurveParams) addJacobian(x1, y1, z1, x2, y2, z2 *big.Int) (*big.Int, *big.Int, *big.Int) {
// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
x3, y3, z3 := new(big.Int), new(big.Int), new(big.Int)
if z1.Sign() == 0 {
x3.Set(x2)
y3.Set(y2)
z3.Set(z2)
return x3, y3, z3
}
if z2.Sign() == 0 {
x3.Set(x1)
y3.Set(y1)
z3.Set(z1)
return x3, y3, z3
}
z1z1 := new(big.Int).Mul(z1, z1)
z1z1.Mod(z1z1, curve.P)
z2z2 := new(big.Int).Mul(z2, z2)
z2z2.Mod(z2z2, curve.P)
u1 := new(big.Int).Mul(x1, z2z2)
u1.Mod(u1, curve.P)
u2 := new(big.Int).Mul(x2, z1z1)
u2.Mod(u2, curve.P)
h := new(big.Int).Sub(u2, u1)
xEqual := h.Sign() == 0
if h.Sign() == -1 {
h.Add(h, curve.P)
}
i := new(big.Int).Lsh(h, 1)
i.Mul(i, i)
j := new(big.Int).Mul(h, i)
s1 := new(big.Int).Mul(y1, z2)
s1.Mul(s1, z2z2)
s1.Mod(s1, curve.P)
s2 := new(big.Int).Mul(y2, z1)
s2.Mul(s2, z1z1)
s2.Mod(s2, curve.P)
r := new(big.Int).Sub(s2, s1)
if r.Sign() == -1 {
r.Add(r, curve.P)
}
yEqual := r.Sign() == 0
if xEqual && yEqual {
return curve.doubleJacobian(x1, y1, z1)
}
r.Lsh(r, 1)
v := new(big.Int).Mul(u1, i)
x3.Set(r)
x3.Mul(x3, x3)
x3.Sub(x3, j)
x3.Sub(x3, v)
x3.Sub(x3, v)
x3.Mod(x3, curve.P)
y3.Set(r)
v.Sub(v, x3)
y3.Mul(y3, v)
s1.Mul(s1, j)
s1.Lsh(s1, 1)
y3.Sub(y3, s1)
y3.Mod(y3, curve.P)
z3.Add(z1, z2)
z3.Mul(z3, z3)
z3.Sub(z3, z1z1)
z3.Sub(z3, z2z2)
z3.Mul(z3, h)
z3.Mod(z3, curve.P)
return x3, y3, z3
}
// affineFromJacobian reverses the Jacobian transform. See the comment at the
// top of the file. If the point is ∞ it returns 0, 0.
func (curve *CurveParams) affineFromJacobian(x, y, z *big.Int) (xOut, yOut *big.Int) {
if z.Sign() == 0 {
return new(big.Int), new(big.Int)
}
zinv := new(big.Int).ModInverse(z, curve.P)
zinvsq := new(big.Int).Mul(zinv, zinv)
xOut = new(big.Int).Mul(x, zinvsq)
xOut.Mod(xOut, curve.P)
zinvsq.Mul(zinvsq, zinv)
yOut = new(big.Int).Mul(y, zinvsq)
yOut.Mod(yOut, curve.P)
return
}
对应的kotlin实现为：
Kotlin密钥交换
fun generateSharedSecret(privateKey: ECPrivateKey, publicKey: ECPublicKey): ByteArray {
val (x, _) = scalarMultiply(
privateKey.params.curve,
publicKey.w.affineX,
publicKey.w.affineY,
privateKey.s.toByteArray().toUByteArray()
)
val data = x.toByteArray()
if (data.size == U_BYTE_ARRAY_SIZE) {
data.copyOfRange(1, U_BYTE_ARRAY_SIZE)
}
val digest = MessageDigest.getInstance("SHA-256")
return digest.digest(data)
}
scalarMultiply
fun scalarMultiply(
curve: EllipticCurve,
Bx: BigInteger,
By: BigInteger,
s: UByteArray
): Pair<BigInteger, BigInteger> {
var k = s
if (k.size == U_BYTE_ARRAY_SIZE) {
k = k.copyOfRange(1, U_BYTE_ARRAY_SIZE)
}
val Bz = BigInteger.ONE
var xyz = Triple(BigInteger.ZERO, BigInteger.ZERO, BigInteger.ZERO)
for (byte in k) {
var b = byte
for (bitNum in 0..7) {
xyz = curve.doubleJacobian(xyz)
if (b and 0x80.toUByte() == 0x80.toUByte()) {
xyz = curve.addJacobian(Bx, By, Bz, xyz)
}
b = (b.toInt().shl(1)).toUByte()
}
}
return curve.affineFromJacobian(xyz)
}
// doubleJacobian takes a point in Jacobian coordinates, (x, y, z), and
// returns its double, also in Jacobian form.
fun EllipticCurve.doubleJacobian(xyz: Triple<BigInteger, BigInteger, BigInteger>): Triple<BigInteger, BigInteger, BigInteger> {
val (x, y, z) = xyz
val p = getGoLangP(this)
// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
var delta = z.multiply(z)
delta = delta.mod(p)
var gamma = y.multiply(y)
gamma = gamma.mod(p)
var alpha = x.subtract(delta)
if (alpha.signum() == -1) {
alpha = alpha.add(p)
}
var alpha2 = x.add(delta)
alpha = alpha.multiply(alpha2)
alpha2 = alpha.add(BigInteger.ZERO)
alpha = alpha.shiftLeft(1)
alpha = alpha.add(alpha2)
var beta = x.multiply(gamma)
var x3 = alpha.multiply(alpha)
var beta8 = beta.shiftLeft(3)
beta8 = beta8.mod(p)
x3 = x3.subtract(beta8)
if (x3.signum() == -1) {
x3 = x3.add(p)
}
x3 = x3.mod(p)
var z3 = y.add(z)
z3 = z3.multiply(z3)
z3 = z3.subtract(gamma)
if (z3.signum() == -1) {
z3 = z3.add(p)
}
z3 = z3.subtract(delta)
if (z3.signum() == -1) {
z3 = z3.add(p)
}
z3 = z3.mod(p)
beta = beta.shiftLeft(2)
beta = beta.subtract(x3)
if (beta.signum() == -1) {
beta = beta.add(p)
}
var y3 = alpha.multiply(beta)
gamma = gamma.multiply(gamma)
gamma = gamma.shiftLeft(3)
gamma = gamma.mod(p)
y3 = y3.subtract(gamma)
if (y3.signum() == -1) {
y3 = y3.add(p)
}
y3 = y3.mod(p)
return Triple(x3, y3, z3)
}
// addJacobian takes two points in Jacobian coordinates, (x1, y1, z1) and
// (x2, y2, z2) and returns their sum, also in Jacobian form.
fun EllipticCurve.addJacobian(
x1: BigInteger,
y1: BigInteger,
z1: BigInteger,
xyz: Triple<BigInteger, BigInteger, BigInteger>
): Triple<BigInteger, BigInteger, BigInteger> {
val (x2, y2, z2) = xyz
val p = getGoLangP(this)
// See https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl
var (x3, y3, z3) = Triple(BigInteger.ZERO, BigInteger.ZERO, BigInteger.ZERO)
if (z1.signum() == 0) {
x3 = x2.add(BigInteger.ZERO)
y3 = y2.add(BigInteger.ZERO)
z3 = z3.add(BigInteger.ZERO)
return Triple(x3, y3, z3)
}
if (z2.signum() == 0) {
x3 = x1.add(BigInteger.ZERO)
y3 = y1.add(BigInteger.ZERO)
z3 = z1.add(BigInteger.ZERO)
return Triple(x3, y3, z3)
}
var z1z1 = z1.multiply(z1)
z1z1 = z1z1.mod(p)
var z2z2 = z2.multiply(z2)
z2z2 = z2z2.mod(p)
var u1 = x1.multiply(z2z2)
u1 = u1.mod(p)
var u2 = x2.multiply(z1z1)
u2 = u2.mod(p)
var h = u2.subtract(u1)
var xEqual = h.signum() == 0
if (h.signum() == -1) {
h = h.add(p)
}
var i = h.shiftLeft(1)
i = i.multiply(i)
var j = h.multiply(i)
var s1 = y1.multiply(z2)
s1 = s1.multiply(z2z2)
s1 = s1.mod(p)
var s2 = y2.multiply(z1)
s2 = s2.multiply(z1z1)
s2 = s2.mod(p)
var r = s2.subtract(s1)
if (r.signum() == -1) {
r = r.add(p)
}
var yEqual = r.signum() == 0
if (xEqual && yEqual) {
return this.doubleJacobian(Triple(x1, y1, z1))
}
r = r.shiftLeft(1)
var v = u1.multiply(i)
x3 = r.add(BigInteger.ZERO)
x3 = x3.multiply(x3)
x3 = x3.subtract(j)
x3 = x3.subtract(v)
x3 = x3.subtract(v)
x3 = x3.mod(p)
y3 = r.add(BigInteger.ZERO)
v = v.subtract(x3)
y3 = y3.multiply(v)
s1 = s1.multiply(j)
s1 = s1.shiftLeft(1)
y3 = y3.subtract(s1)
y3 = y3.mod(p)
z3 = z1.add(z2)
z3 = z3.multiply(z3)
z3 = z3.subtract(z1z1)
z3 = z3.subtract(z2z2)
z3 = z3.multiply(h)
z3 = z3.mod(p)
return Triple(x3, y3, z3)
}
// affineFromJacobian reverses the Jacobian transform. See the comment at the
// top of the file. If the point is ∞ it returns 0, 0.
fun EllipticCurve.affineFromJacobian(
xyz: Triple<BigInteger, BigInteger, BigInteger>
): Pair<BigInteger, BigInteger> {
val (x, y, z) = xyz
val p = getGoLangP(this)
if (z.signum() == 0) {
return Pair(BigInteger.ZERO, BigInteger.ZERO)
}
var zinv = z.modInverse(p)
var zinvsq = zinv.multiply(zinv)
var xOut = x.multiply(zinvsq)
xOut = xOut.mod(p)
zinvsq = zinvsq.multiply(zinv)
var yOut = y.multiply(zinvsq)
yOut = yOut.mod(p)
return Pair(xOut, yOut)
}
密钥测试
go生成密钥的密钥对为：
var (
privHexForTests = "307702010104207843249525ae7f43e623f5bb2b28bb8b22420e8b07d14212c12ce367e980f568a00a06082a8648ce3d030107a14403420004deb43a5bb4c34cf8db53311d4d9f95d2356b8c011349ecb04fc00b73c303bc9dc0675f4ca45a562f589b993a94129482eb9b03f259ce8982e525927c3f70fdbe"
pubHexForTests = "04deb43a5bb4c34cf8db53311d4d9f95d2356b8c011349ecb04fc00b73c303bc9dc0675f4ca45a562f589b993a94129482eb9b03f259ce8982e525927c3f70fdbe"
)
kotlin采用随机生成，不做固定（待改进，用生成好的固定测试密钥对）
val keypair = generateKeyPair()
println("pubHex:${toPublicHex(keypair.public as ECPublicKey)}")
生成android客户端公私钥对后，服务端生成共享密钥需要用到客户端的公钥，因此打印出来放入服务端。
kotlin单元测试
fun generateSharedSecret_isCorrect() {
val keypair = generateKeyPair()
println("pubHex:${toPublicHex(keypair.public as ECPublicKey)}")
val serverPubHex = "04deb43a5bb4c34cf8db53311d4d9f95d2356b8c011349ecb04fc00b73c303bc9dc0675f4ca45a562f589b993a94129482eb9b03f259ce8982e525927c3f70fdbe"
val ecPubKey = ECCP256.fromPublicHex(serverPubHex)
var aesKey = ECDH.generateSharedSecret(keypair.private as ECPrivateKey, ecPubKey)
val aesHex = HexUtil.bytesToHex(aesKey)
println("aesHex:$aesHex")
}
结果为：
pubHex:04c4fe11531633ca616d2334377396095fca56dc47ac48f2b55b7f7a97c0e7ce529a779d9e099d21be8647db63da946a0b54b8b07a02795ec2074046b9e30749e3
aesHex:12c4e2f52bfd953c75a32503f37e89bba00a0b941544ed632ca5c1837d0a3340
注意：由于kotlin的密钥是随机生成，所以上述结果必然不会相同，但只要aesHex和服务端相同即可
go单元测试
func Test_Android_ECDH(t *testing.T) {
androidPubKey := "04ac0625a2554c9075dc463e1976ccba1f2b837d8276383556e0fc07c5d673e329cf2e6f291bfe0be8256ba28fa3828427b7b2dae3aee3dcb3249cdb94f2c38684"
pubBytes, err := hex.DecodeString(androidPubKey)
if err != nil {
t.Fatal(err)
}
x, y := elliptic.Unmarshal(elliptic.P256(), pubBytes)
pubkey := &ecdsa.PublicKey{Curve: elliptic.P256(), X: x, Y: y}
priv, err := FromPrivHex(privHexForTests)
if err != nil {
t.Fatal(err)
}
ecdh := &ECDH{}
secretkey, err := ecdh.GenerateSharedSecret(priv, pubkey)
assert.NoError(t, err)
fmt.Println("secretkey:", hex.EncodeToString(secretkey))
}
结果为：
secretkey: 12c4e2f52bfd953c75a32503f37e89bba00a0b941544ed632ca5c1837d0a3340
注意，由于kotlin的密钥是随机生成，所以 androidPubKey 需要手动填入。可以看到，客户端和服务端生成的共享密钥是一致的。
有疑问加站长微信联系（非本文作者）
