使用 FIPS 140-2 库在 Java 中创建 OpenPGP 消息
我当前正在升级生成 OpenPGP 消息的应用程序，以使其符合 FIPS 140-2。目前，我生成使用 RSA/AES-256 加密的 PGP 消息，这两种加密算法都是使用 BouncyCastle 及其 OpenPGP 提供程序批准的算法。我无法再使用 BouncyCastly，因为它不是 FIPS 140-2 验证，因此我正在查看 RSA 的 BSAFE 库。
该库没有高级抽象来让您直接生成 OpenPGP 消息。有谁知道有一个库可以使用现有的 JCE 提供程序（例如我的 BSAFE 库）来生成 OpenPGP 消息？我真的很想避免自己实现 OpenPGP 规范，因为这看起来会非常耗时。或者，对于格式化我的加密文件的其他方法有什么建议吗？
预先感谢您的任何意见！
I am currently upgrading an application that generates OpenPGP messages to be FIPS 140-2 compliant. Currently I generate PGP messages that use RSA/AES-256 encryption which are both approved algorithms using BouncyCastle and its OpenPGP provider. I am no longer able to use BouncyCastly since it is not FIPS 140-2 validates, so I am looking at the BSAFE library from RSA.
This library doesn't have the high-level abstraction to let you generate an OpenPGP message directly. Does anyone know of a library that can use an existing JCE provider (like my BSAFE library) capable of generating OpenPGP messages? I'd really like to avoid having to implement the OpenPGP spec myself, as that seems like it would be quite time consuming. Alternatively any suggestions for other ways to format my encrypted files?
Thanks in advance for any input!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
经过大量研究，如果不自己实现 OpenPGP 格式，似乎没有办法做到这一点。然而，加密消息语法似乎是一个合适的替代品。
After much research it seems that there is no way to do this without implementing the OpenPGP format yourself. However the Cryptographic Message Syntax seems to be a suitable replacement.
S/MIME（加密消息语法）和 OpenPGP 之间存在重大差异。
http://mozilla-enigmail.org/forum/viewtopic.php?t=67
主要是S/MIME以证书的方式交换密钥（必须利用证书颁发机构，限制为1024位，1年后过期），而OpenPGP则使用PGP密钥（可以交换）点对点，或使用免费的密钥服务器，或托管您自己的密钥服务器）。
There are major differences between S/MIME (Cryptographic Message Syntax) and OpenPGP.
http://mozilla-enigmail.org/forum/viewtopic.php?t=67
Mainly, S/MIME exchanges keys in terms of certificates (which must utilize a certificate authority, limited to 1024 bit, and expires after 1 year), while OpenPGP uses PGP keys (can be exchanged peer-to-peer, or utilize a free keyserver, or host your own keyserver).
FIPS 140-2 不适用于 SSL、PGP、S/MIME 或 SSH 等协议。这些是使用 RSA 和 AES 等加密算法的安全协议。 （然而，商业加密货币供应商不太可能指出这种区别）。
FIPS 140-2 列出了批准的算法。它还指定了实现这些算法的“加密模块”的测试标准。但是，它没有提及这些算法的应用。
因此，您可以使用 BouncyCastle 的 PGP 提供程序。不要安装 Bouncy Castle 作为加密货币提供程序，而是安装 FIPS 140-2 认证的实施。 Bouncy Castle 的 PGP 将使用首选的加密提供商作为其底层加密算法。您可以以相同的方式使用他们的 S/MIME 支持。
FIPS 140-2 doesn't apply to protocols like SSL, PGP, S/MIME, or SSH. Those are security protocols that use cryptographic algorithms like RSA and AES. (Commercial crypto vendors aren't likely to point out this distinction, however).
FIPS 140-2 lists approved algorithms. It also specifies testing criteria for "cryptographic modules" that implement these algorithms. But, it doesn't say anything about the application of these algorithms.
So, you can use BouncyCastle's PGP provider. Instead of installing Bouncy Castle as a crypto-provider, install your FIPS 140-2–certified implementation. Bouncy Castle's PGP will use the preferred crypto provider for its underlying cryptographic algorithms. You can use their S/MIME support in the same way.