国密实战（一）：SM2 密钥格式与 PFX 证书解析全指南

<dependencies>
    <!-- BouncyCastle 国密支持（推荐 jdk18on） -->
    <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcprov-jdk18on</artifactId>
        <version>1.84</version>
    </dependency>
    <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcpkix-jdk18on</artifactId>
        <version>1.84</version>
    </dependency>
</dependencies>

import org.bouncycastle.jce.provider.BouncyCastleProvider;
import java.security.Security;

public class Sm2KeyUtils {
    // 静态块中注册 BouncyCastle Provider（只需注册一次）
    static {
        if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
            Security.addProvider(new BouncyCastleProvider());
        }
    }
}

import org.bouncycastle.jce.ECNamedCurveTable;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.jce.spec.ECParameterSpec;
import org.bouncycastle.jce.spec.ECPrivateKeySpec;
import org.bouncycastle.jce.spec.ECPublicKeySpec;
import org.bouncycastle.math.ec.ECPoint;

import java.io.FileInputStream;
import java.math.BigInteger;
import java.security.*;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.ECPublicKey;

public class Sm2KeyExtractor {

    static {
        if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
            Security.addProvider(new BouncyCastleProvider());
        }
    }

    /**
     * 从 PFX 证书中提取 SM2 公钥和私钥
     *
     * @param pfxPath PFX/P12 证书文件路径
     * @param password 证书密码
     * @return KeyPair 包含 SM2 公私钥
     */
    public static KeyPair extractKeyPair(String pfxPath, String password) throws Exception {
        // 1. 加载 KeyStore（类型为 PKCS12，指定 BC Provider）
        KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");
        try (FileInputStream fis = new FileInputStream(pfxPath)) {
            keyStore.load(fis, password.toCharArray());
        }

        // 2. 获取别名（通常只有一个）
        String alias = keyStore.aliases().nextElement();
        System.out.println("证书别名: " + alias);

        // 3. 提取私钥
        Key privateKey = keyStore.getKey(alias, password.toCharArray());
        System.out.println("私钥算法: " + privateKey.getAlgorithm());

        // 4. 提取证书和公钥
        Certificate cert = keyStore.getCertificate(alias);
        PublicKey publicKey = cert.getPublicKey();
        System.out.println("公钥算法: " + publicKey.getAlgorithm());

        // 5. 打印证书信息
        if (cert instanceof X509Certificate) {
            X509Certificate x509 = (X509Certificate) cert;
            System.out.println("证书主题: " + x509.getSubjectDN());
            System.out.println("证书颁发者: " + x509.getIssuerDN());
            System.out.println("签名算法: " + x509.getSigAlgName());
            System.out.println("有效期: " + x509.getNotBefore() + " ~ " + x509.getNotAfter());
        }

        return new KeyPair(publicKey, privateKey);
    }

    /**
     * 获取 hex 格式的私钥（64 字符）
     *
     * @param keyPair 密钥对
     * @return 64 字符 hex 私钥
     */
    public static String getPrivateKeyHex(KeyPair keyPair) {
        ECPrivateKey ecPrivateKey = (ECPrivateKey) keyPair.getPrivate();
        BigInteger d = ecPrivateKey.getS();
        // 补齐前导零，确保 64 字符
        return String.format("%064x", d);
    }

    /**
     * 获取 hex 格式的公钥（130 字符，04 开头）
     *
     * @param keyPair 密钥对
     * @return 130 字符 hex 公钥（04 + x + y）
     */
    public static String getPublicKeyHex(KeyPair keyPair) {
        ECPublicKey ecPublicKey = (ECPublicKey) keyPair.getPublic();
        ECPoint point = ecPublicKey.getW();
        // x 和 y 各 32 字节，补齐前导零
        String x = String.format("%064x", point.getAffineX());
        String y = String.format("%064x", point.getAffineY());
        return "04" + x + y;
    }

    /**
     * 通过 hex 私钥构造 ECPrivateKey 对象
     *
     * @param hexKey 64 字符 hex 私钥
     * @return ECPrivateKey 对象
     */
    public static ECPrivateKey buildPrivateKey(String hexKey) {
        // 补齐前导零到 64 字符
        String padded = String.format("%064s", hexKey).replace(' ', '0');
        BigInteger d = new BigInteger(padded, 16);

        // 使用 sm2p256v1 曲线参数
        ECParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("sm2p256v1");
        ECPrivateKeySpec privSpec = new ECPrivateKeySpec(d, ecSpec);

        try {
            KeyFactory kf = KeyFactory.getInstance("EC", "BC");
            return (ECPrivateKey) kf.generatePrivate(privSpec);
        } catch (Exception e) {
            throw new RuntimeException("构建 SM2 私钥失败", e);
        }
    }

    /**
     * 通过 hex 公钥构造 ECPublicKey 对象
     *
     * @param hexKey 130 字符 hex 公钥（04 开头，可省略 04）
     * @return ECPublicKey 对象
     */
    public static ECPublicKey buildPublicKey(String hexKey) {
        // 确保有 04 前缀（未压缩格式标识）
        String fullHex = hexKey;
        if (!fullHex.startsWith("04")) {
            fullHex = "04" + fullHex;
        }

        ECParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("sm2p256v1");
        // decodePoint 接受 byte[]，将 hex 转为字节数组
        ECPoint point = ecSpec.getCurve().decodePoint(hexToBytes(fullHex));
        ECPublicKeySpec pubSpec = new ECPublicKeySpec(point, ecSpec);

        try {
            KeyFactory kf = KeyFactory.getInstance("EC", "BC");
            return (ECPublicKey) kf.generatePublic(pubSpec);
        } catch (Exception e) {
            throw new RuntimeException("构建 SM2 公钥失败", e);
        }
    }

    /**
     * hex 字符串转字节数组
     */
    private static byte[] hexToBytes(String hex) {
        int len = hex.length();
        byte[] data = new byte[len / 2];
        for (int i = 0; i < len; i += 2) {
            data[i / 2] = (byte) ((Character.digit(hex.charAt(i), 16) << 4)
                + Character.digit(hex.charAt(i + 1), 16));
        }
        return data;
    }
}

public class Sm2KeyExtractorTest {

    public static void main(String[] args) throws Exception {
        String pfxPath = "/path/to/your/sm2-cert.pfx";
        String password = "your_password";

        // 提取密钥对
        KeyPair keyPair = Sm2KeyExtractor.extractKeyPair(pfxPath, password);

        // 获取 hex 格式
        String privKeyHex = Sm2KeyExtractor.getPrivateKeyHex(keyPair);
        String pubKeyHex = Sm2KeyExtractor.getPublicKeyHex(keyPair);

        System.out.println("\n=== 密钥信息 ===");
        System.out.println("私钥 (hex, 64字符): " + privKeyHex);
        System.out.println("私钥长度: " + privKeyHex.length());
        System.out.println("公钥 (hex, 130字符): " + pubKeyHex);
        System.out.println("公钥长度: " + pubKeyHex.length());

        // 验证：从 hex 重建密钥对
        ECPrivateKey rebuiltPriv = Sm2KeyExtractor.buildPrivateKey(privKeyHex);
        ECPublicKey rebuiltPub = Sm2KeyExtractor.buildPublicKey(pubKeyHex);

        System.out.println("\n=== 验证重建 ===");
        System.out.println("私钥重建成功: " + (rebuiltPriv != null));
        System.out.println("公钥重建成功: " + (rebuiltPub != null));

        // 验证重建后的密钥与原始密钥一致
        System.out.println("私钥一致性: " + privKeyHex.equals(
            String.format("%064x", rebuiltPriv.getS())));
    }
}