import org.spongycastle.asn1.x509.AlgorithmIdentifier; //导入依赖的package包/类
/**
 * Create the certificate signing request (CSR) from private and public keys
 *
 * @param keyPair the KeyPair with private and public keys
 * @return PKCS10CertificationRequest with the certificate signing request
 *         (CSR) data
 * @throws IOException
 * @throws OperatorCreationException
 */
public static PKCS10CertificationRequest generateCSR(KeyPair keyPair) throws IOException,
        OperatorCreationException {
    String principal = "CN=AWS IoT Certificate" + ", O=Amazon";
    AsymmetricKeyParameter privateKey = PrivateKeyFactory.createKey(keyPair.getPrivate()
            .getEncoded());
    AlgorithmIdentifier signatureAlgorithm = new DefaultSignatureAlgorithmIdentifierFinder()
            .find("SHA1WITHRSA");
    AlgorithmIdentifier digestAlgorithm = new DefaultDigestAlgorithmIdentifierFinder()
            .find("SHA-1");
    ContentSigner signer = new BcRSAContentSignerBuilder(signatureAlgorithm, digestAlgorithm)
            .build(privateKey);

    PKCS10CertificationRequestBuilder csrBuilder = new JcaPKCS10CertificationRequestBuilder(
            new X500Name(principal), keyPair.getPublic());
    ExtensionsGenerator extensionsGenerator = new ExtensionsGenerator();
    extensionsGenerator.addExtension(Extension.basicConstraints, true, new BasicConstraints(
            true));
    csrBuilder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest,
            extensionsGenerator.generate());
    PKCS10CertificationRequest csr = csrBuilder.build(signer);

    return csr;
}
 

import org.spongycastle.asn1.x509.AlgorithmIdentifier; //导入依赖的package包/类
/**
 * Generates a short-living certificate for the keyPair.
 */
private X509Certificate generateCertificate() throws NoSuchProviderException, NoSuchAlgorithmException, CertificateException, SignatureException, InvalidKeyException, IOException, OperatorCreationException {
    /* The certificate starts to be valid one minute in the past to be safe
     * if the clocks are a bit out of sync. */
    Calendar startDate = Calendar.getInstance();
    startDate.add(Calendar.MINUTE, -1);
    /* The certificate is not valid anymore after two minutes. This should
     * be enough to complete the protocol. */
    Calendar expiryDate = Calendar.getInstance();
    expiryDate.add(Calendar.MINUTE, +2);
    AlgorithmIdentifier sha1withRSA = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA");
    ContentSigner signer = new BcRSAContentSignerBuilder(
            new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA"),
            new DefaultDigestAlgorithmIdentifierFinder().find(sha1withRSA))
            .build(keyPair.getPrivate());
    X500Name subjectName = new X500Name("CN=Wallet Protocol Server Ephemeral Certificate");
    BcX509v3CertificateBuilder certBuilder = new BcX509v3CertificateBuilder(
            subjectName,
            BigInteger.ONE,
            startDate.getTime(), expiryDate.getTime(),
            subjectName,
            keyPair.getPublic()
    );
    X509CertificateHolder certHolder = certBuilder.build(signer);
    X509Certificate cert = new JcaX509CertificateConverter().getCertificate(certHolder);
    return cert;
}
 

import org.spongycastle.asn1.x509.AlgorithmIdentifier; //导入依赖的package包/类
public byte[] getEncoded()
{
    return KeyUtil.getEncodedPrivateKeyInfo(new AlgorithmIdentifier(PKCSObjectIdentifiers.rsaEncryption, DERNull.INSTANCE), new org.spongycastle.asn1.pkcs.RSAPrivateKey(getModulus(), ZERO, getPrivateExponent(), ZERO, ZERO, ZERO, ZERO, ZERO));
}
 

import org.spongycastle.asn1.x509.AlgorithmIdentifier; //导入依赖的package包/类
public byte[] getEncoded()
{
    return KeyUtil.getEncodedSubjectPublicKeyInfo(new AlgorithmIdentifier(PKCSObjectIdentifiers.rsaEncryption, DERNull.INSTANCE), new RSAPublicKeyStructure(getModulus(), getPublicExponent()));
}
 

import org.spongycastle.asn1.x509.AlgorithmIdentifier; //导入依赖的package包/类
public synchronized byte[] signPkcs1(byte[] hash, DigestAlg alg, Key key) throws IOException, UserCancelException {
    //Prepare the card for signing
    byte[] rsp;
    switch (key) {
        case NON_REPUDIATION:
            rsp = cardReader.transmitApdu(INIT_SIGN_NONREP_RAWPKCS1);
            break;
        case AUTHENTICATION:
            rsp = cardReader.transmitApdu(INIT_SIGN_AUTH_RAWPKCS1);
            break;
        default:
            throw new IllegalArgumentException("Unknown key type");
    }
    if (validateResponse(rsp) != ApduSwCode.OK) {
        throw new APDUException(String.format("The card returned an error: SW=%X %X", rsp[0], rsp[1]), rsp[0], rsp[1]);
    }

    //Unlock the card with the pin if needed
    if (key == Key.NON_REPUDIATION) verifyPin();

    //Calculate the signature
    byte [] digestInfo;
    switch (alg) {
        case RAW:
            digestInfo = hash;
            break;
        case SHA1:
            digestInfo = new DigestInfo(new AlgorithmIdentifier(X509ObjectIdentifiers.id_SHA1,
                    DERNull.INSTANCE), hash).getEncoded(ASN1Encoding.DER);
            break;
        case SHA256:
            digestInfo = new DigestInfo(new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha256,
                    DERNull.INSTANCE), hash).getEncoded(ASN1Encoding.DER);
            break;
        default:
            throw new IllegalArgumentException("Unknown digest algorithm");
    }
    byte [] cmd = new byte[DO_SIGN.length + digestInfo.length];
    System.arraycopy(DO_SIGN, 0, cmd, 0, DO_SIGN.length);
    cmd[4] = (byte) digestInfo.length;
    System.arraycopy(digestInfo, 0, cmd, DO_SIGN.length, digestInfo.length);

    byte[] data;
    rsp = cardReader.transmitApdu(cmd);
    switch (validateResponse(rsp)) {
        case OK:
            data = new byte[rsp.length-2];
            System.arraycopy(rsp, 0, data, 0, data.length);
            break;
        case OkGetRsp:
            data = getResponse(rsp[1]);
            break;
        case SecConNotSatisfied:
            verifyPin();
            rsp = cardReader.transmitApdu(cmd);
            switch (validateResponse(rsp)) {
                case OK:
                    data = new byte[rsp.length-2];
                    System.arraycopy(rsp, 0, data, 0, data.length);
                    break;
                case OkGetRsp:
                    data = getResponse(rsp[1]);
                    break;
                default:
                    throw new APDUException(String.format("The card returned an error: SW=%X %X", rsp[0], rsp[1]), rsp[0], rsp[1]);
            }
            break;
        default:
            throw new APDUException(String.format("The card returned an error: SW=%X %X", rsp[0], rsp[1]), rsp[0], rsp[1]);
    }

    return data;
}
 

import org.spongycastle.asn1.x509.AlgorithmIdentifier; //导入依赖的package包/类
@Override
public AlgorithmIdentifier getAlgorithmIdentifier() {
    return AlgorithmIdentifier
            .getInstance(PKCSObjectIdentifiers.sha512WithRSAEncryption);
}
 

import org.spongycastle.asn1.x509.AlgorithmIdentifier; //导入依赖的package包/类
/**
 * Return a PKCS8 representation of the key. The sequence returned
 * represents a full PrivateKeyInfo object.
 *
 * @return a PKCS8 representation of the key.
 */
public byte[] getEncoded()
{
    return KeyUtil.getEncodedPrivateKeyInfo(new AlgorithmIdentifier(PKCSObjectIdentifiers.rsaEncryption, DERNull.INSTANCE), new RSAPrivateKey(getModulus(), getPublicExponent(), getPrivateExponent(), getPrimeP(), getPrimeQ(), getPrimeExponentP(), getPrimeExponentQ(), getCrtCoefficient()));
}