IOS中RSA的加密解密

1.
生成私钥: openssl req -x509 -days 3650 -new -newkey rsa:2048 -keyout private_key.pem -out private_key.pem

2.
生成p12格式的文件: openssl pkcs12 -export -out private_pkcs.p12 -in private_key.pem
3.
生成自签名证书: openssl x509 -in private_key.pem -inform PEM -out public_key.der -outform DER

使用到的第三方库：https://github.com/nicklockwood/Base64

//原始字符串
NSString *value = @"测试iOS中RSA加密和解密";

//加密
NSString *encrypt= [value rsaEncrypt];
FLOG(@"encrypted string: %@",encrypt);

//解密
NSString *decrypt= [encrypt rsaDecrypt];
FLOG(@"decrypted string: %@",decrypt);

类文件：

//
//  RSA.h
//  MCFriends
//
//  Created by marujun on 14-9-4.
//  Copyright (c) 2014年 marujun. All rights reserved.
//

#import <Foundation/Foundation.h>
#import "Base64.h"

@interface RSA : NSObject

+ (NSString *)encryptWithString:(NSString *)content;

+ (NSString *)decryptWithString:(NSString *)content;

@end

@interface NSString (RSA)

- (NSString *)rsaEncrypt;

- (NSString *)rsaDecrypt;

@end

//
//  RSA.m
//  MCFriends
//
//  Created by marujun on 14-9-4.
//  Copyright (c) 2014年 marujun. All rights reserved.
//

#import "RSA.h"

@implementation RSA

static SecKeyRef _publicKey = nil;

+ (SecKeyRef)getPublicKey
{
// 从公钥证书文件中获取到公钥的SecKeyRef指针
if(_publicKey == nil){
NSData *certificateData = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"public_key" ofType:@"der"]];

SecCertificateRef myCertificate =  SecCertificateCreateWithData(kCFAllocatorDefault, (__bridge CFDataRef)certificateData);
SecPolicyRef myPolicy = SecPolicyCreateBasicX509();
SecTrustRef myTrust;
OSStatus status = SecTrustCreateWithCertificates(myCertificate,myPolicy,&myTrust);
SecTrustResultType trustResult;
if (status == noErr) {
status = SecTrustEvaluate(myTrust, &trustResult);
}
_publicKey = SecTrustCopyPublicKey(myTrust);
CFRelease(myCertificate);
CFRelease(myPolicy);
CFRelease(myTrust);
}
return _publicKey;
}

+ (NSString *)encryptWithString:(NSString *)content
{
SecKeyRef key = [self getPublicKey];

// 分配内存块，用于存放加密后的数据段
size_t cipherBufferSize = SecKeyGetBlockSize(key);
uint8_t *cipherBuffer = malloc(cipherBufferSize * sizeof(uint8_t));
NSData *stringBytes = [content dataUsingEncoding:NSUTF8StringEncoding];
size_t blockSize = cipherBufferSize - 12;
size_t blockCount = (size_t)ceil([stringBytes length] / (double)blockSize);

NSMutableData *encryptedData = [NSMutableData data];
// 分段加密
for (int i = 0; i < blockCount; i++) {
NSUInteger loc = i * blockSize;
// 数据段的实际大小。最后一段可能比blockSize小。
int bufferSize = MIN(blockSize,[stringBytes length] - loc);
// 截取需要加密的数据段
NSData *buffer = [stringBytes subdataWithRange:NSMakeRange(loc, bufferSize)];
OSStatus status = SecKeyEncrypt(key, kSecPaddingPKCS1, (const uint8_t *)[buffer bytes], [buffer length], cipherBuffer, &cipherBufferSize);
if (status == noErr) {
NSData *encryptedBytes = [[NSData alloc] initWithBytes:(const void *)cipherBuffer length:cipherBufferSize];
// 追加加密后的数据段
[encryptedData appendData:encryptedBytes];
} else {
if (cipherBuffer) {
free(cipherBuffer);
}
return nil;
}
}
if (cipherBuffer) {
free(cipherBuffer);
}
return [encryptedData base64EncodedString];
}

static SecKeyRef _privateKey = nil;

+ (SecKeyRef)getPrivateKey
{
// 从p12文件中获取到私钥的SecKeyRef指针
if(_privateKey == nil){
NSString *pkcsPassword = @"****"; //p12文件密码
NSData *p12Data = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"private_pkcs" ofType:@"p12"]]; //p12文件路径

CFStringRef password = (__bridge CFStringRef)pkcsPassword;
const void *keys[] = { kSecImportExportPassphrase };
const void *values[] = { password };
CFDictionaryRef options = CFDictionaryCreate(kCFAllocatorDefault, keys, values, 1, NULL, NULL);
CFArrayRef items = CFArrayCreate(kCFAllocatorDefault, NULL, 0, NULL);
OSStatus status = SecPKCS12Import((__bridge CFDataRef)p12Data, options, &items);
if (status == errSecSuccess) {
CFDictionaryRef identity_trust_dic = CFArrayGetValueAtIndex(items, 0);
SecIdentityRef identity = (SecIdentityRef)CFDictionaryGetValue(identity_trust_dic, kSecImportItemIdentity);
SecTrustRef trust = (SecTrustRef)CFDictionaryGetValue(identity_trust_dic, kSecImportItemTrust);
// certs数组中包含了所有的证书
CFArrayRef certs = (CFArrayRef)CFDictionaryGetValue(identity_trust_dic, kSecImportItemCertChain);
if ([(__bridge NSArray *)certs count] && trust && identity) {
// 如果没有下面一句，自签名证书的评估信任结果永远是kSecTrustResultRecoverableTrustFailure
status = SecTrustSetAnchorCertificates(trust, certs);
if (status == noErr) {
SecTrustResultType trustResultType;
// 通常, 返回的trust result type应为kSecTrustResultUnspecified，如果是，就可以说明签名证书是可信的
status = SecTrustEvaluate(trust, &trustResultType);
if ((trustResultType == kSecTrustResultUnspecified || trustResultType == kSecTrustResultProceed) && status == errSecSuccess) {
// 证书可信，可以提取私钥与公钥，然后可以使用公私钥进行加解密操作
status = SecIdentityCopyPrivateKey(identity, &_privateKey);
if (status == noErr && _privateKey) {
// 成功提取私钥
}
}
}
}
}
if (options) {
CFRelease(options);
}
}
return _privateKey;
}

+ (NSString *)decryptWithString:(NSString *)content
{
SecKeyRef key = [self getPrivateKey];

// 分配内存块，用于存放解密后的数据段
size_t plainBufferSize = SecKeyGetBlockSize(key);
uint8_t *plainBuffer = malloc(plainBufferSize * sizeof(uint8_t));
NSData *cipherData = [content base64DecodedData];

// 计算数据段最大长度及数据段的个数
size_t blockSize = plainBufferSize;
size_t blockCount = (size_t)ceil([cipherData length] / blockSize);

NSMutableData *decryptedData = [NSMutableData data];
// 分段解密
for (int i = 0; i < blockCount; i++) {
NSUInteger loc = i * blockSize;
// 数据段的实际大小。最后一段可能比blockSize小。
int bufferRealSize = MIN(blockSize, [cipherData length] - loc);
// 截取需要解密的数据段
NSData *buffer = [cipherData subdataWithRange:NSMakeRange(loc, bufferRealSize)];
OSStatus status = SecKeyDecrypt(key, kSecPaddingPKCS1, (const uint8_t *)[buffer bytes], [buffer length], plainBuffer, &plainBufferSize);
if (status == noErr) {
NSData *decryptedBytes = [[NSData alloc] initWithBytes:(const void *)plainBuffer length:plainBufferSize];
[decryptedData appendData:decryptedBytes];
} else {
if (plainBuffer) {
free(plainBuffer);
}
return nil;
}
}
if (plainBuffer) {
free(plainBuffer);
}
return  [[NSString alloc] initWithData:decryptedData encoding:NSUTF8StringEncoding];;
}

@end

@implementation NSString (RSA)

- (NSString *)rsaEncrypt
{
return [RSA encryptWithString:self];
}

- (NSString *)rsaDecrypt
{
return [RSA decryptWithString:self];
}

@end