作为序列化对象交换公钥
如何将公钥交换到客户端。我使用私钥使用 RSA 算法加密了文档（文本文件），然后使用序列化将公钥作为 java.security.Key 对象存储在文件中。我想知道序列化公钥对象的完整性这是安全的选择或任何其他可用的选择。
How to exchange the public key to the client place. i have encrypted a document(text file) using RSA algorithm by using private key and then stored the public key as an java.security.Key object in a file using serialization.I want to know about the integrity of the serialized public key object whether it is safe option to do or any other option available.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
公钥通常只是作为一段文本进行交换。然后将其导入密钥库。确切的方法取决于实现（我一直使用 PGP）。
我不会将密钥公开为 java.security.Key 的序列化形式，因为它并不是真正的标准。其简单形式的关键是交换的标准形式。
将密钥公开为下载：它是公开的，因此入侵者无法通过下载您的密钥来执行任何操作。唯一可能出错的是有人可能伪造您的服务器并托管不同的密钥。然后使用该密钥的私钥进行签名并声称是您。当然，如果您将其邮寄给某人，您可能会遇到同样的问题。但至少你会知道你把它寄给了谁。
最安全的方法是将密钥分散到越界之外。就像在 U 盘上一样。
根据您的原因，我认为您可以承受这个风险。
A public key is usually just exchanged as a piece of text. It is then imported into a keystore. The exact method of doing is depends on the implementation (I've always used PGP).
I wouldn't expose the key as a serialized form of java.security.Key because it's not really standard. The key in it's simple form is the standard form of interchange.
On exposing the key as a download: it's public, so there's nothing an intruder could do by downloading your key. The only thing that could go wrong is that someone could fake your server and host a different key. Then sign with that key's private key and claim to be you. Of course you could have the same issue if you mailed it to somebody. But then at least you would know who you mailed it to.
The safest approach is to spread the key out-of-bound. Like on a usb stick.
Depending on your cause, I think you can live with the risk.
Joeri 已经就安全方面做出了回答——对此我没有什么可补充的。
您可能遇到的主要问题是序列化表示在库版本之间发生变化，这是任何使用 Java 序列化的潜在问题。
当然还有其他方法可以做到这一点。 RSA 公钥应具有行业标准编码，您可以使用
getEncoded()方法访问该编码。这将为您提供一个字节数组，您可以将其写入到FileOutputStream。所以这真的很容易。Joeri has answered on the security aspects - I have nothing to add about that.
The main problem you might have is the serialized representation changing between library versions, which is a potential issue with any use of Java serialization.
Of course there are other ways to do it. The RSA public key should have an industry-standard encoding which you can access using the
getEncoded()method. This gives you an array of bytes which you canwriteto aFileOutputStream. So it's really easy.