import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
public PrivateKeyInfo decryptPrivateKeyInfo(InputDecryptorProvider inputDecryptorProvider)
    throws PKCSException
{
    try
    {
        InputDecryptor decrytor = inputDecryptorProvider.get(encryptedPrivateKeyInfo.getEncryptionAlgorithm());

        ByteArrayInputStream encIn = new ByteArrayInputStream(encryptedPrivateKeyInfo.getEncryptedData());

        return PrivateKeyInfo.getInstance(Streams.readAll(decrytor.getInputStream(encIn)));
    }
    catch (Exception e)
    {
        throw new PKCSException("unable to read encrypted data: " + e.getMessage(), e);
    }
}
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
public PKCS12SafeBagFactory(ContentInfo info, InputDecryptorProvider inputDecryptorProvider)
    throws PKCSException
{
    if (info.getContentType().equals(PKCSObjectIdentifiers.encryptedData))
    {
        CMSEncryptedData encData = new CMSEncryptedData(org.bouncycastle.asn1.cms.ContentInfo.getInstance(info));

        try
        {
            this.safeBagSeq = ASN1Sequence.getInstance(encData.getContent(inputDecryptorProvider));
        }
        catch (CMSException e)
        {
            throw new PKCSException("unable to extract data: " + e.getMessage(), e);
        }
        return;
    }

    throw new IllegalArgumentException("encryptedData requires constructor with decryptor.");
}
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
public CMSTypedStream getContentStream(InputDecryptorProvider inputDecryptorProvider)
    throws CMSException
{
    try
    {
        EncryptedContentInfo encContentInfo = encryptedData.getEncryptedContentInfo();
        InputDecryptor decrytor = inputDecryptorProvider.get(encContentInfo.getContentEncryptionAlgorithm());

        ByteArrayInputStream encIn = new ByteArrayInputStream(encContentInfo.getEncryptedContent().getOctets());

        return new CMSTypedStream(encContentInfo.getContentType(), decrytor.getInputStream(encIn));
    }
    catch (Exception e)
    {
        throw new CMSException("unable to create stream: " + e.getMessage(), e);
    }
}
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
public InputDecryptorProvider build(final char[] password)
{
    return new InputDecryptorProvider()
    {
        public InputDecryptor get(final AlgorithmIdentifier algorithmIdentifier)
        {
            final PaddedBufferedBlockCipher engine = PKCS12PBEUtils.getEngine(algorithmIdentifier.getAlgorithm());

            PKCS12PBEParams           pbeParams = PKCS12PBEParams.getInstance(algorithmIdentifier.getParameters());

            CipherParameters params = PKCS12PBEUtils.createCipherParameters(algorithmIdentifier.getAlgorithm(), digest, engine.getBlockSize(), pbeParams, password);

            engine.init(false, params);

            return new InputDecryptor()
            {
                public AlgorithmIdentifier getAlgorithmIdentifier()
                {
                    return algorithmIdentifier;
                }

                public InputStream getInputStream(InputStream input)
                {
                    return new CipherInputStream(input, engine);
                }

                public GenericKey getKey()
                {
                    return new GenericKey(PKCS12ParametersGenerator.PKCS12PasswordToBytes(password));
                }
            };
        }
    };

}
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
public byte[] getContent(InputDecryptorProvider inputDecryptorProvider)
    throws CMSException
{
    try
    {
        return CMSUtils.streamToByteArray(getContentStream(inputDecryptorProvider).getContentStream());
    }
    catch (IOException e)
    {
        throw new CMSException("unable to parse internal stream: " + e.getMessage(), e);
    }
}
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
private static InputDecryptorProvider buildInputDecryptorProvider(String resource, PasswordCallback password,
		@Nullable PKCSException decryptException) throws IOException {
	char[] passwordChars = (decryptException != null ? password.requeryPassword(resource, decryptException)
			: password.queryPassword(resource));

	if (passwordChars == null) {
		throw new PasswordRequiredException(resource, decryptException);
	}
	return PKCS12_DECRYPTOR_PROVIDER_BUILDER.build(passwordChars);
}
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
public static PrivateKey getPrivateKey(String keyString) {

        PrivateKey privateKey = null;

        try {

            BufferedReader br = new BufferedReader(new StringReader(keyString));
            PEMParser pp = new PEMParser(br);
            PKCS8EncryptedPrivateKeyInfo pemPrivateKeyInfo = (PKCS8EncryptedPrivateKeyInfo) pp.readObject();
            pp.close();

            InputDecryptorProvider pkcs8Prov = new JceOpenSSLPKCS8DecryptorProviderBuilder().build("1234".toCharArray());
            JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
            privateKey = converter.getPrivateKey(pemPrivateKeyInfo.decryptPrivateKeyInfo(pkcs8Prov));

        } catch (Exception e) {

            ProtoLogger.error("!!! Error importing private key !!!");

        }

        return privateKey;

    }
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
public InputDecryptorProvider build(final char[] password)
{
    return new InputDecryptorProvider()
    {
        private Cipher cipher;
        private AlgorithmIdentifier encryptionAlg;

        public InputDecryptor get(final AlgorithmIdentifier algorithmIdentifier)
            throws OperatorCreationException
        {
            SecretKey key;
            ASN1ObjectIdentifier algorithm = algorithmIdentifier.getAlgorithm();

            try
            {
                if (algorithm.on(PKCSObjectIdentifiers.pkcs_12PbeIds))
                {
                    PKCS12PBEParams pbeParams = PKCS12PBEParams.getInstance(algorithmIdentifier.getParameters());

                    cipher = helper.createCipher(algorithm.getId());

                    cipher.init(Cipher.DECRYPT_MODE, new PKCS12KeyWithParameters(password, wrongPKCS12Zero, pbeParams.getIV(), pbeParams.getIterations().intValue()));

                    encryptionAlg = algorithmIdentifier;
                }
                else if (algorithm.equals(PKCSObjectIdentifiers.id_PBES2))
                {
                    PBES2Parameters alg = PBES2Parameters.getInstance(algorithmIdentifier.getParameters());
                    PBKDF2Params func = PBKDF2Params.getInstance(alg.getKeyDerivationFunc().getParameters());
                    AlgorithmIdentifier encScheme = AlgorithmIdentifier.getInstance(alg.getEncryptionScheme());

                    SecretKeyFactory keyFact = helper.createSecretKeyFactory(alg.getKeyDerivationFunc().getAlgorithm().getId());

                    if (func.isDefaultPrf())
                    {
                        key = keyFact.generateSecret(new PBEKeySpec(password, func.getSalt(), func.getIterationCount().intValue(), keySizeProvider.getKeySize(encScheme)));
                    }
                    else
                    {
                        key = keyFact.generateSecret(new PBKDF2KeySpec(password, func.getSalt(), func.getIterationCount().intValue(), keySizeProvider.getKeySize(encScheme), func.getPrf()));
                    }

                    cipher = helper.createCipher(alg.getEncryptionScheme().getAlgorithm().getId());

                    encryptionAlg = AlgorithmIdentifier.getInstance(alg.getEncryptionScheme());

                    ASN1Encodable encParams = alg.getEncryptionScheme().getParameters();
                    if (encParams instanceof ASN1OctetString)
                    {
                        cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(ASN1OctetString.getInstance(encParams).getOctets()));
                    }
                    else
                    {
                        // TODO: at the moment it's just GOST, but...
                        GOST28147Parameters gParams = GOST28147Parameters.getInstance(encParams);

                        cipher.init(Cipher.DECRYPT_MODE, key, new GOST28147ParameterSpec(gParams.getEncryptionParamSet(), gParams.getIV()));
                    }
                }
            }
            catch (Exception e)
            {
                throw new OperatorCreationException("unable to create InputDecryptor: " + e.getMessage(), e);
            }

            return new InputDecryptor()
            {
                public AlgorithmIdentifier getAlgorithmIdentifier()
                {
                    return encryptionAlg;
                }

                public InputStream getInputStream(InputStream input)
                {
                    return new CipherInputStream(input, cipher);
                }
            };
        }
    };
}
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
/**
 * Parses a PrivateKey instance from a PEM representation.
 *
 * When the provided key is encrypted, the provided pass phrase is applied.
 *
 * @param pemRepresentation a PEM representation of a private key (cannot be null or empty)
 * @param passPhrase optional pass phrase (must be present if the private key is encrypted).
 * @return a PrivateKey instance (never null)
 */
public static PrivateKey parsePrivateKey(InputStream pemRepresentation, String passPhrase) throws IOException {

    if ( passPhrase == null ) {
        passPhrase = "";
    }
    try (Reader reader = new InputStreamReader(pemRepresentation); //
            PEMParser pemParser = new PEMParser(reader)) {

        final Object object = pemParser.readObject();
        final JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider( "BC" );

        final KeyPair kp;

        if ( object instanceof PEMEncryptedKeyPair )
        {
            // Encrypted key - we will use provided password
            final PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build( passPhrase.toCharArray() );
            kp = converter.getKeyPair( ( (PEMEncryptedKeyPair) object ).decryptKeyPair( decProv ) );
        }
        else if ( object instanceof PKCS8EncryptedPrivateKeyInfo )
        {
            // Encrypted key - we will use provided password
            try
            {
                final PKCS8EncryptedPrivateKeyInfo encryptedInfo = (PKCS8EncryptedPrivateKeyInfo) object;
                final InputDecryptorProvider provider = new JceOpenSSLPKCS8DecryptorProviderBuilder().build( passPhrase.toCharArray() );
                final PrivateKeyInfo privateKeyInfo = encryptedInfo.decryptPrivateKeyInfo( provider );
                return converter.getPrivateKey( privateKeyInfo );
            }
            catch ( PKCSException | OperatorCreationException e )
            {
                throw new IOException( "Unable to decrypt private key.", e );
            }
        }
        else if ( object instanceof PrivateKeyInfo )
        {
            return converter.getPrivateKey( (PrivateKeyInfo) object );
        }
        else
        {
            // Unencrypted key - no password needed
            kp = converter.getKeyPair( (PEMKeyPair) object );
        }
        return kp.getPrivate();
    }
}
 

import org.bouncycastle.operator.InputDecryptorProvider; //导入依赖的package包/类
public void testKeyBag()
    throws Exception
{
    OutputEncryptor encOut = new BcPKCS12PBEOutputEncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd3_KeyTripleDES_CBC, new CBCBlockCipher(new DESedeEngine())).build(passwd);
    InputDecryptorProvider inputDecryptorProvider = new BcPKCS12PBEInputDecryptorProviderBuilder().build(passwd);
    KeyFactory fact = KeyFactory.getInstance("RSA", BC);
    PrivateKey privKey = fact.generatePrivate(privKeySpec);
    PKCS12SafeBagBuilder keyBagBuilder = new JcaPKCS12SafeBagBuilder(privKey);

    keyBagBuilder.addBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_friendlyName, new DERBMPString("Eric's Key"));

    PKCS12PfxPduBuilder builder = new PKCS12PfxPduBuilder();

    builder.addEncryptedData(encOut, keyBagBuilder.build());

    PKCS12PfxPdu pfx = builder.build(new BcPKCS12MacCalculatorBuilder(), passwd);
    assertTrue(pfx.hasMac());
    assertTrue(pfx.isMacValid(new BcPKCS12MacCalculatorBuilderProvider(BcDefaultDigestProvider.INSTANCE), passwd));

    ContentInfo[] infos = pfx.getContentInfos();

    for (int i = 0; i != infos.length; i++)
    {
        if (infos[i].getContentType().equals(PKCSObjectIdentifiers.encryptedData))
        {
            PKCS12SafeBagFactory dataFact = new PKCS12SafeBagFactory(infos[i], inputDecryptorProvider);

            PKCS12SafeBag[] bags = dataFact.getSafeBags();

            assertEquals(1, bags.length);
            assertEquals(PKCSObjectIdentifiers.keyBag, bags[0].getType());

            assertTrue(Arrays.areEqual(privKey.getEncoded(), ((PrivateKeyInfo)bags[0].getBagValue()).getEncoded()));

            Attribute[] attributes = bags[0].getAttributes();

            assertEquals(1, attributes.length);

            assertEquals(PKCSObjectIdentifiers.pkcs_9_at_friendlyName, attributes[0].getAttrType());

            ASN1Encodable[] attrValues = attributes[0].getAttributeValues();

            assertEquals(1, attrValues.length);
            assertEquals(new DERBMPString("Eric's Key"), attrValues[0]);
        }
        else
        {
            fail("unknown bag encountered");
        }
    }
}