JSON与加密密钥——天作之合

billatnapier
发布于 3小时前
阅读 30

本文介绍了如何使用JSON格式封装加密和签名密钥，以及JSON格式在密钥管理中的优势。通过Google Tink展示了对称密钥、消息认证码、数字签名和混合加密等多种密钥类型的JSON格式示例，并列举了几乎所有可用的密钥类型，以及如何使用tinkey工具生成JSON格式的密钥集。

## JSON 和加密密钥 — 天作之合

有多少种加密和签名密钥格式？答案是，非常多。为什么？因为现在我们可以用 JSON 格式包装一个加密密钥，它提供了关于如何使用加密密钥的额外信息。

对于计算机来说，这些密钥只是一堆 1 和 0，但对于人类来说，我们不太擅长解释二进制。两种常见的格式是 **DER**（二进制）和 **PEM**（Base64）。当解释为十六进制时，DER 看起来像这样\[ [这里](https://asecuritysite.com/rsa/hashnew6)\]：

![](https://img.learnblockchain.cn/2025/06/28/0d26wOkdEKG3MjHHE.png)

PEM 格式稍微结构化一些，带有特殊的报头和报尾，中间是 Base64 文本：

![](https://img.learnblockchain.cn/2025/06/28/0PtkLUV-pVC8PI1C4.png)

这些文件格式都没有过多地展示密钥的细节，例如它的标识符、使用的加密类型等等。因此，JSON 格式经常用于查看密钥，而 Google Tink 是查看密钥的好地方。有了它，我们可以定义一个对称密钥，并在其中给出密钥和 ID，然后定义密钥类型（因为我们可以使用一系列加密方法）。在下面的例子中，我们使用一个 AES GCM 密钥：\[ [链接](https://asecuritysite.com/tink/tink01)\]

```
{
    "primaryKeyId": 1331912396,
    "key": [{\
        "keyData": {\
            "typeUrl": "type.googleapis.com/google.crypto.tink.AesGcmKey",\
            "keyMaterialType": "SYMMETRIC",\
            "value": "GhBpskWWTrE27e2w67X4TzfS"\
        },\
        "outputPrefixType": "TINK",\
        "keyId": 1331912396,\
        "status": "ENABLED"\
    }]
}
```

密钥是 "GhBpskWWTrE27e2w67X4TzfS"。十六进制格式是：

```
1A1069B245964EB136EDEDB0EBB5F84F37D2
```

它是 36 个十六进制字符，也就是 144 位。这为密钥提供了 128 位，为一些参数提供了一些额外的位。

对于 MAC（消息认证码），我们使用一个共享密钥，然后可以使用它来检查消息的签名\[ [这里](https://asecuritysite.com/encryption/tink02)\]。同样，在这种情况下，我们生成一个 128 位的 AES GCM 密钥\[ [这里](https://asecuritysite.com/tink/tink02)\]：

在数字签名中，我们使用一个密钥对（一个公钥和一个私钥）。私钥用于对消息进行签名，然后公钥证明签名者。在这种情况下，我们在发送方创建一条椭圆曲线密钥对\[ [链接](https://asecuritysite.com/encryption/tink03)\]：

```
{
 “primaryKeyId”: 438545957,
 “key”: [{\
 “keyData”: {\
 “typeUrl”: “type.googleapis.com/google.crypto.tink.EcdsaPrivateKey”,\
 “keyMaterialType”: “ASYMMETRIC_PRIVATE”,\
 “value”: “Ek0SBggDEAIYAhohAP4v0pziVF9He/fn8BgApUHOu2Y1TkMcejrYC4U24M3xIiBAf0AIU72H5uVIP1S6ULGLaDf4td3/RIb4F58z2Md/khogJsuTDxaY/Q0CmENKlTQIOCXEZ+qvdAW0Rkvix6Wehl4=”\
 },\
 “outputPrefixType”: “TINK”,\
 “keyId”: 438545957,\
 “status”: “ENABLED”\
 }]
}
```

然后我们提取公钥来证明签名：

```
{
 “primaryKeyId”: 438545957,
 “key”: [{\
 “keyData”: {\
 “typeUrl”: “type.googleapis.com/google.crypto.tink.EcdsaPublicKey”,\
 “keyMaterialType”: “ASYMMETRIC_PUBLIC”,\
 “value”: “EgYIAxACGAIaIQD+L9Kc4lRfR3v35/AYAKVBzrtmNU5DHHo62AuFNuDN8SIgQH9ACFO9h+blSD9UulCxi2g3+LXd/0SG+BefM9jHf5I=”\
 },\
 “outputPrefixType”: “TINK”,\
 “keyId”: 438545957,\
 “status”: “ENABLED”\
 }]
}
```

十六进制格式是 12060803100218021A2100FE2FD29CE2545F477BF7E7F01800A541CEBB66354E431C7A3AD80B8536E0CDF12220407F400853BD87E6E5483F54BA50B18B6837F8B5DDFF4486F8179F33D8C77F92，它是 154 个十六进制字符 (616 位 —— 由 **512 位公钥**和一些额外的字节组成，用于定义密钥的格式)。

在许多应用中，我们使用混合方法，可以用一个密钥对来保护对称密钥。在下面的例子中，我们使用 ECIES 加密来保护我们创建的对称密钥，然后使用公钥\[ [链接](https://asecuritysite.com/encryption/tink04)\]。然后使用私钥来解密对称密钥：

```
{
 “primaryKeyId”: 1992984960,
 “key”: [{\
 “keyData”: {\
 “typeUrl”: “type.googleapis.com/google.crypto.tink.EciesAeadHkdfPublicKey”,\
 “keyMaterialType”: “ASYMMETRIC_PUBLIC”,\
 “value”: “EkQKBAgCEAMSOhI4CjB0eXBlLmdvb2dsZWFwaXMuY29tL2dvb2dsZS5jcnlwdG8udGluay5BZXNHY21LZXkSAhAQGAEYARohAOaHVTjvjhpGaHv5mhuXz3Nc+Mb7RE5sMyAsv7YCB8UjIiAOaSLbqRE7ddVM14kWiNoPWB/U2MNluwLlAjw39zwAlw==”\
 },\
 “outputPrefixType”: “TINK”,\
 “keyId”: 1992984960,\
 “status”: “ENABLED”\
 }]
}
```

还有一种方法允许你使用额外的数据认证你的加密，例如数据包的序列号或使用的 TCP 端口。这被称为带有关联数据的认证加密 (AEAD)，这里有一个使用 AES-SIV 的密钥示例\[ [这里](https://asecuritysite.com/encryption/tink07)\]：

```
{
    "primaryKeyId": 1428191678,
    "key": [{\
        "keyData": {\
            "typeUrl": "type.googleapis.com/google.crypto.tink.AesSivKey",\
            "keyMaterialType": "SYMMETRIC",\
            "value": "EkAFkhmlhYkmClmpz/vGzojJVgA/IQIMSty7rL8TXxyu9m/W0ZtzCddmSLFj7r8V/R0CywJ89KxdMVzdR+GDQH2w"\
        },\
        "outputPrefixType": "TINK",\
        "keyId": 1428191678,\
        "status": "ENABLED"\
    }]
}
```

所以，你的加密密钥可以用 JSON 查看。

### 几乎所有你能用到的密钥

让我们来看看如何为 AES、DHKEM (Hybrid ML-KEM)、ECDSA、ECIES、Ed25519、HKDF、HMAC、JWT、RSA PKCS#1 v1.5、RSA PSS 和 XChaCha20 创建密钥：

- **AES:** AES128\_EAX AES128\_EAX\_RAW AES128\_GCM, AES128\_GCM\_HKDF\_1MB AES128\_GCM\_HKDF\_4KB AES128\_GCM\_RAW, AES256\_CMAC AES256\_CMAC\_PRF AES256\_CMAC\_RAW, AES256\_CTR\_HMAC\_SHA256 AES256\_CTR\_HMAC\_SHA256\_1MB, AES256\_CTR\_HMAC\_SHA256\_4KB AES256\_CTR\_HMAC\_SHA256\_RAW, AES256\_EAX AES256\_EAX\_RAW AES256\_GCM AES256\_GCM\_HKDF\_1MB, AES256\_GCM\_HKDF\_4KB AES256\_GCM\_RAW AES256\_SIV, AES256\_SIV\_RAW AES\_CMAC AES\_CMAC\_PRF CHACHA20\_POLY1305 CHACHA20\_POLY1305\_RAW
- **DHKE:** MDHKEM\_P256\_HKDF\_SHA256\_HKDF\_SHA256\_AES\_128\_GCM, DHKEM\_P256\_HKDF\_SHA256\_HKDF\_SHA256\_AES\_128\_GCM\_RAW, DHKEM\_P256\_HKDF\_SHA256\_HKDF\_SHA256\_AES\_256\_GCM, DHKEM\_P256\_HKDF\_SHA256\_HKDF\_SHA256\_AES\_256\_GCM\_RAW, DHKEM\_P384\_HKDF\_SHA384\_HKDF\_SHA384\_AES\_128\_GCM, DHKEM\_P384\_HKDF\_SHA384\_HKDF\_SHA384\_AES\_128\_GCM\_RAW, DHKEM\_P384\_HKDF\_SHA384\_HKDF\_SHA384\_AES\_256\_GCM, DHKEM\_P384\_HKDF\_SHA384\_HKDF\_SHA384\_AES\_256\_GCM\_RAW, DHKEM\_P521\_HKDF\_SHA512\_HKDF\_SHA512\_AES\_128\_GCM, DHKEM\_P521\_HKDF\_SHA512\_HKDF\_SHA512\_AES\_128\_GCM\_RAW, DHKEM\_P521\_HKDF\_SHA512\_HKDF\_SHA512\_AES\_256\_GCM, DHKEM\_P521\_HKDF\_SHA512\_HKDF\_SHA512\_AES\_256\_GCM\_RAW, DHKEM\_X25519\_HKDF\_SHA256\_HKDF\_SHA256\_AES\_128\_GCM, DHKEM\_X25519\_HKDF\_SHA256\_HKDF\_SHA256\_AES\_128\_GCM\_RAW, DHKEM\_X25519\_HKDF\_SHA256\_HKDF\_SHA256\_AES\_256\_GCM, DHKEM\_X25519\_HKDF\_SHA256\_HKDF\_SHA256\_AES\_256\_GCM\_RAW, DHKEM\_X25519\_HKDF\_SHA256\_HKDF\_SHA256\_CHACHA20\_POLY130, DHKEM\_X25519\_HKDF\_SHA256\_HKDF\_SHA256\_CHACHA20\_POLY1305\_RAW ECDSA\_P256 ECDSA\_P256\_IEEE\_P1363
- ECDSA\_P256\_IEEE\_P1363\_WITHOUT\_PREFIX ECDSA\_P256\_RAW, ECDSA\_P384 ECDSA\_P384\_IEEE\_P1363 ECDSA\_P384\_SHA384, ECDSA\_P384\_SHA512 ECDSA\_P521 ECDSA\_P521\_IEEE\_P1363,
- ECIES\_P256\_COMPRESSED\_HKDF\_HMAC\_SHA256\_AES128\_CTR\_HMAC\_SHA256, ECIES\_P256\_COMPRESSED\_HKDF\_HMAC\_SHA256\_AES128\_CTR\_HMAC\_SHA256\_RAW, ECIES\_P256\_COMPRESSED\_HKDF\_HMAC\_SHA256\_AES128\_GCM, ECIES\_P256\_COMPRESSED\_HKDF\_HMAC\_SHA256\_AES128\_GCM\_RAW, ECIES\_P256\_HKDF\_HMAC\_SHA256\_AES128\_CTR\_HMAC\_SHA256, ECIES\_P256\_HKDF\_HMAC\_SHA256\_AES128\_CTR\_HMAC\_SHA256\_RAW, ECIES\_P256\_HKDF\_HMAC\_SHA256\_AES128\_GCM, ECIES\_P256\_HKDF\_HMAC\_SHA256\_AES128\_GCM\_COMPRESSED\_WITHOUT\_PREFIX ECIES\_P256\_HKDF\_HMAC\_SHA256\_AES128\_GCM\_RAW
- ED25519 ED25519WithRawOutput ED25519\_RAW
- HKDF\_SHA256HKDF\_SHA256\_DERIVES\_AES128\_GCM, HKDF\_SHA256\_DERIVES\_AES256\_GCM, HKDF\_SHA256\_DERIVES\_AES256\_GCM\_HKDF\_1MB, HKDF\_SHA256\_DERIVES\_AES256\_SIV, HKDF\_SHA256\_DERIVES\_ED25519, HKDF\_SHA256\_DERIVES\_HMAC\_SHA256\_128BITTAG, HKDF\_SHA256\_DERIVES\_HMAC\_SHA256\_PRF, HKDF\_SHA256\_DERIVES\_XCHACHA20\_POLY1305, HMAC\_SHA256\_128BITTAG HMAC\_SHA256\_128BITTAG\_RAW, HMAC\_SHA256\_256BITTAG HMAC\_SHA256\_256BITTAG\_RAW, HMAC\_SHA256\_PRF HMAC\_SHA512\_128BITTAG, HMAC\_SHA512\_128BITTAG\_RAW HMAC\_SHA512\_256BITTAG, HMAC\_SHA512\_256BITTAG\_RAW HMAC\_SHA512\_512BITTAG, HMAC\_SHA512\_512BITTAG\_RAW HMAC\_SHA512\_PRF JWT\_ES256
- JWT\_ES256\_RAW JWT\_ES384 JWT\_ES384\_RAW JWT\_ES512, JWT\_ES512\_RAW JWT\_HS256 JWT\_HS256\_RAW JWT\_HS384, JWT\_HS384\_RAW JWT\_HS512 JWT\_HS512\_RAW JWT\_PS256\_2048\_F4, JWT\_PS256\_2048\_F4\_RAW JWT\_PS256\_3072\_F4, JWT\_PS256\_3072\_F4\_RAW JWT\_PS384\_3072\_F4, JWT\_PS384\_3072\_F4\_RAW JWT\_PS512\_4096\_F4, JWT\_PS512\_4096\_F4\_RAW JWT\_RS256\_2048\_F4, JWT\_RS256\_2048\_F4\_RAW JWT\_RS256\_3072\_F4, JWT\_RS256\_3072\_F4\_RAW JWT\_RS384\_3072\_F4, JWT\_RS384\_3072\_F4\_RAW JWT\_RS512\_4096\_F4, JWT\_RS512\_4096\_F4\_RAW RSA\_SSA\_PKCS1\_3072\_SHA256\_F4
- RSA\_SSA\_PKCS1\_3072\_SHA256\_F4\_RAW, RSA\_SSA\_PKCS1\_3072\_SHA256\_F4\_WITHOUT\_PREFIX, RSA\_SSA\_PKCS1\_4096\_SHA512\_F4, RSA\_SSA\_PKCS1\_4096\_SHA512\_F4\_RAW. RSA\_SSA\_PSS\_3072\_SHA256\_F4 RSA\_SSA\_PSS\_3072\_SHA256\_F4\_RAW, RSA\_SSA\_PSS\_3072\_SHA256\_SHA256\_32\_F4, RSA\_SSA\_PSS\_4096\_SHA512\_F4 RSA\_SSA\_PSS\_4096\_SHA512\_F4\_RAW, RSA\_SSA\_PSS\_4096\_SHA512\_SHA512\_64\_F4
- XCHACHA20\_POLY1305, XCHACHA20\_POLY1305\_RAW

为此，我们可以使用 tinkey 运行：

```
$ java -jar "tinkey_deploy.jar" create-keyset - key-template AES128_EAX - out-format JSON - out 1.json
$ cat 1.json
{"primaryKeyId":2180785869,"key":
[{"keyData":{\
"typeUrl":"type.googleapis.com_google.crypto.tink.AesEaxKey",\
"value":"EgIIEBoQkkUmFOG1mkQFBTuuLyy6Mw==",\
"keyMaterialType":"SYMMETRIC"},\
"status":"ENABLED",\
"keyId":2180785869,\
"outputPrefixType":"TINK"}]
}
```

代码在这里：

[**Google Tink with Go (PRF)**
\\
**A PRF (Pseudo Random Function) takes inputs and compute an output that will look random. In this case, we will use the…**
\\
asecuritysite.com](https://asecuritysite.com/tink/go_tink_keys?source=post_page-----890d28e3f687---------------------------------------)

对于 AES\_EAX \[ [这里](https://asecuritysite.com/tink/go_tink_keys)\]：

```
{
  "primaryKeyId": 1396503152,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.AesEaxKey",\
        "value": "EgIIEBoQ6RkAIuX/Atj/SkqcpswobA==",\
        "keyMaterialType": "SYMMETRIC"\
      },\
      "status": "ENABLED",\
      "keyId": 1396503152,\
      "outputPrefixType": "TINK"\
    }\
  ]
}
```

对于 ChaCha20 \[ [这里](https://asecuritysite.com/tink/go_tink_keys)\]：

```
{
  "primaryKeyId": 1961123280,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.ChaCha20Poly1305Key",\
        "value": "EiBGO18rw7WEmiWmDhWtdeLh9yifxqh8ZiRkEc+w0Axaxw==",\
        "keyMaterialType": "SYMMETRIC"\
      },\
      "status": "ENABLED",\
      "keyId": 1961123280,\
      "outputPrefixType": "TINK"\
    }\
  ]
}
```

对于 DH-ML-KEM \[ [这里](https://asecuritysite.com/tink/go_tink_keys)\]：

```
{
  "primaryKeyId": 471886363,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.HpkePrivateKey",\
        "value": "EksSBggCEAEYARpBBEPwo/feGpb3vlP+PqHmfNcyx4MFiUhmgI6UTlYeOE3CuPlPEr29y10xpEnU7Rbz/68rC/DKtIQgj9wxSqy2jIAaINRX8U+vDAMHohP7pB0eL4APBLGucNXmrNQ/LlKTXMde",\
        "keyMaterialType": "ASYMMETRIC_PRIVATE"\
      },\
      "status": "ENABLED",\
      "keyId": 471886363,\
      "outputPrefixType": "TINK"\
    }\
  ]
}
```

对于 ECDSA \[ [这里](https://asecuritysite.com/tink/go_tink_keys)\]：

```
{
  "primaryKeyId": 1264604753,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.EcdsaPrivateKey",\
        "value": "Ek4SBggDEAIYAhohADjXTBYypwLxLyv16U1Cjc65bOThbbuy6fLUW/KRPW2+IiEAeNVl+SBSsCTcan65Ak/INw0LxdA7QjxYjhlUwV9jv18aIQDt6E9K9l2uTaMqrptTL+fwMsy4jErqNQrzTLsYB242GQ==",\
        "keyMaterialType": "ASYMMETRIC_PRIVATE"\
      },\
      "status": "ENABLED",\
      "keyId": 1264604753,\
      "outputPrefixType": "TINK"\
    }\
  ]
}
```

对于 Ed25519 \[ [这里](https://asecuritysite.com/tink/go_tink_keys)\]：

```
{
  "primaryKeyId": 548270440,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.Ed25519PrivateKey",\
        "value": "EiBgPvg/MifqxLPxSSJNDX2sVf1vmsXTqA+adiDVHI5LaBoiEiBN/JwLTuGB1fan3TCMBLXPx6aeMhNQ7t/tpJXltxpZiQ==",\
        "keyMaterialType": "ASYMMETRIC_PRIVATE"\
      },\
      "status": "ENABLED",\
      "keyId": 548270440,\
      "outputPrefixType": "TINK"\
    }\
  ]
}
```

对于 RSA PSS \[ [这里](https://asecuritysite.com/tink/go_tink_keys)\]：

```
{
  "primaryKeyId": 744063254,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.RsaSsaPssPrivateKey",\
        "value": "EpEDEgYIAxADGCAagQMAgP3p3Y+/Ymgcjp70eaGg6GjsKWRm4GcuBFH8o4hotVVO0p3MJ2aFBoidMQZpfw8osi4ATZ629A9p1TDu2G58vBKyQVe12kTZ7DP1v5nHspembu9bn9AClUd90CvpHTs7enXHdBMvj/A27qNrD6HD4HWIyMOfHEdjbgAXe3vkB8IAzNDGwmkSEWI10aUyOw63c9/TVRLCmAwBH3b0Nbmx2fJddHfVPLpvlHbErAhFICGr8hI87pBTkh6VWylNWK1hVbAfOnDyw+wKTPBL7ailqkGBT1pj7Sos3zjtswQcCwfbxVOHYhy82tS1DMSW2GztsT2x1tJ3XjMZK7BrvHjOdl2E8q5IgiuEByx8rZWyp69IIfiPgi9hWpsH4Eiq+HUXHJU9YGWHbblpQ/DWQaqBod3nBEQaeiMD1kbtj3UHJaSzeWBh46SSLEBEyThZtpcLd7564FkKb9ZFN8iMezSH/KS9S9SF1Dia5oheWztzkEtQKNhuIsaeMCjaiPuJv+6zIgMBAAEagAM7mJSfaBWtWpqvDiO3uoREPI24Bgo97Y3mMxb9Wz29Yd+cEYnMPmKBhUbS6rp9GLzdrcE4G3c9xY1JEWWYm1uH7T9sTyDW6m6g4dTNpDgOfGBJ6s6zRICdBb3MGy2F8uLlDluLdn3IC9zlXp1NSJjeMI906mStxRHcNbCjvba6GtkRx/e8xJyzaWOiK6fMf10k7SmPqa48X3d5WRU1aUkRgBfLgr4DY8O/nSv6q4t8b/IoUmLSed4SqYyp5Kg2q0uedOC7S4eQ4QZ5Mqo5ckVQwWjnF4rdRtRxI3osjppBbhX9btRAlpsgOMqtjzxqDWI5evUKgEv5K7vJ2x7oAVgkqVt21ha3g4z5AFauM4442Bs+QAxBZLrSAq8mSSVpKDkpaiLSukIb1Pelg/zJPKnibWyGwgfWLLmX8HUdpc6qiRUBZK3X6MC5uo4pXhtGwe3QjmGp3Qw9tizz+Kf9E2IhhbOcTFp8jFHTB50C5IhLkAKDiU2MwPsZHG+8vxaJKAEiwQEA0oxucFs9LOLievcyX2MoEJEGE/7zOBKyCqyc362yshHKKtUT8HiZHZlUz4enIBfkVnG1//yF1aQgg03nTfOB2bBIx0eeQi2i7yVj7uCTVIufikz2KdL+lOwqH++do8b5owN+6z6h+ljvrecdNptywnGAnrqT98kM2BvGHZkQJttVjd5zAc1DiS6culxLc8blgd+6z5XzP3vqhRGgp/NEJASbVh4kLz79xCgZFXdY9BUAib4bi8ig5YQIRL0vtSwBKsEBAJzWZ4/N55rEiup5PoTOc01jU54JZ5YXRVRD+6th64HlYCkENQCchjrATTi7fr7v36g/sunbH0lNiEGEZ+EN8WTnvZNa/AKkYdINz/iCpOoHEo1g45LgQrBUpzXXI8AGL2KPwU7Z9+O/aKWw09e8JnXqIVqeEuOtX1f5WNHAzj/HsDJ2TCZG3r5MmFu6PWn9jbziPX0rtU1mWIyjSipCWHFRo1eXxM1SkjDhcPQl7obNYQiX/hwkC5id90NH/NoqszLBAQC59XRZYgw/B8jWqFviKbaqIxyGLqhsfv6nNNt9J3HrmpC/keCBhFJf9RwWC47NZqyyuM3xYPxnvAVHU1gW3hpyxSMSdyvM8Xe11oVT5x/ZDVSElwLX39YgfBGckUre6w9zLdQ8O95eOYy/QJ/pqhQKrqrWBp5HvFfOy4EIhTbhytjea3mSPtQGZpfgdUHi6Omt8oeRbrQf/vccPnxxugcV9MepoQd+fxks1emJrxZuxdnqznCP3kxVSm7vH1TypAE6wAEHvAsfbGgfmdG//nq20feduWhGQvB41mz02uVubkXPAiDb5Pk4Ln/wJcupIJX/lJTTF1Ebd1Lzqn8tu/njf2yILWWL/tCu0KyCT2wSNV8sq2yezEhs1eJ0D7ivTwzUS3nKwowl91niQW5HvZC08vJynjlG3sTPtZ0eGY3nyjphqtdlpa/bs2MIv35EB8s/juGOjxm5Mo6eYo27YdImg18ZN412pGVwOsI65uNLJxO8UiSW5+gAO0bXH/MxvjsaB0FCwAEyhCrbfvq0CLRYbb9ja7PLwVMVJ6KvCgnWO4k3LbWXa6EsAfSxM4/PNTh4SoDuf0VJI4e0MRlBVWeGt8MetVkXdpqFhUdtIRqVEZ0LC2/Mn7jqAJhAytr9dPL+92G0RF14I8AFUm5S7KXwcSDoj88qQ+NOjkAANtvzxT7eWP3kNlL1G/r2aPJkHNYsj/qhcVLg2YdQogkITgdDOLcePaFRITQQXXEF8r+Z1IXWeaIr2cTNsw8RZ9ykweje5g3GNCs=",\
        "keyMaterialType": "ASYMMETRIC_PRIVATE"\
      },\
      "status": "ENABLED",\
      "keyId": 744063254,\
      "outputPrefixType": "TINK"\
    }\
  ]
}
```

>- 原文链接： [billatnapier.medium.com/...](https://billatnapier.medium.com/json-and-encryption-keys-a-marriage-made-in-heaven-890d28e3f687)
>- 登链社区 AI 助手，为大家转译优秀英文文章，如有翻译不通的地方，还请包涵～

JSON 和加密密钥 — 天作之合

对于计算机来说，这些密钥只是一堆 1 和 0，但对于人类来说，我们不太擅长解释二进制。两种常见的格式是 DER（二进制）和 PEM（Base64）。当解释为十六进制时，DER 看起来像这样[ 这里]：

PEM 格式稍微结构化一些，带有特殊的报头和报尾，中间是 Base64 文本：

{
    "primaryKeyId": 1331912396,
    "key": [{\
        "keyData": {\
            "typeUrl": "type.googleapis.com/google.crypto.tink.AesGcmKey",\
            "keyMaterialType": "SYMMETRIC",\
            "value": "GhBpskWWTrE27e2w67X4TzfS"\
        },\
        "outputPrefixType": "TINK",\
        "keyId": 1331912396,\
        "status": "ENABLED"\
    }]
}

密钥是 "GhBpskWWTrE27e2w67X4TzfS"。十六进制格式是：

1A1069B245964EB136EDEDB0EBB5F84F37D2

它是 36 个十六进制字符，也就是 144 位。这为密钥提供了 128 位，为一些参数提供了一些额外的位。

对于 MAC（消息认证码），我们使用一个共享密钥，然后可以使用它来检查消息的签名[ 这里]。同样，在这种情况下，我们生成一个 128 位的 AES GCM 密钥[ 这里]：

{
    "primaryKeyId": 1331912396,
    "key": [{\
        "keyData": {\
            "typeUrl": "type.googleapis.com/google.crypto.tink.AesGcmKey",\
            "keyMaterialType": "SYMMETRIC",\
            "value": "GhBpskWWTrE27e2w67X4TzfS"\
        },\
        "outputPrefixType": "TINK",\
        "keyId": 1331912396,\
        "status": "ENABLED"\
    }]
}

在数字签名中，我们使用一个密钥对（一个公钥和一个私钥）。私钥用于对消息进行签名，然后公钥证明签名者。在这种情况下，我们在发送方创建一条椭圆曲线密钥对[ 链接]：

{
 “primaryKeyId”: 438545957,
 “key”: [{\
 “keyData”: {\
 “typeUrl”: “type.googleapis.com/google.crypto.tink.EcdsaPrivateKey”,\
 “keyMaterialType”: “ASYMMETRIC_PRIVATE”,\
 “value”: “Ek0SBggDEAIYAhohAP4v0pziVF9He/fn8BgApUHOu2Y1TkMcejrYC4U24M3xIiBAf0AIU72H5uVIP1S6ULGLaDf4td3/RIb4F58z2Md/khogJsuTDxaY/Q0CmENKlTQIOCXEZ+qvdAW0Rkvix6Wehl4=”\
 },\
 “outputPrefixType”: “TINK”,\
 “keyId”: 438545957,\
 “status”: “ENABLED”\
 }]
}

然后我们提取公钥来证明签名：

{
 “primaryKeyId”: 438545957,
 “key”: [{\
 “keyData”: {\
 “typeUrl”: “type.googleapis.com/google.crypto.tink.EcdsaPublicKey”,\
 “keyMaterialType”: “ASYMMETRIC_PUBLIC”,\
 “value”: “EgYIAxACGAIaIQD+L9Kc4lRfR3v35/AYAKVBzrtmNU5DHHo62AuFNuDN8SIgQH9ACFO9h+blSD9UulCxi2g3+LXd/0SG+BefM9jHf5I=”\
 },\
 “outputPrefixType”: “TINK”,\
 “keyId”: 438545957,\
 “status”: “ENABLED”\
 }]
}

十六进制格式是 12060803100218021A2100FE2FD29CE2545F477BF7E7F01800A541CEBB66354E431C7A3AD80B8536E0CDF12220407F400853BD87E6E5483F54BA50B18B6837F8B5DDFF4486F8179F33D8C77F92，它是 154 个十六进制字符 (616 位 —— 由 512 位公钥和一些额外的字节组成，用于定义密钥的格式)。

在许多应用中，我们使用混合方法，可以用一个密钥对来保护对称密钥。在下面的例子中，我们使用 ECIES 加密来保护我们创建的对称密钥，然后使用公钥[ 链接]。然后使用私钥来解密对称密钥：

{
 “primaryKeyId”: 1992984960,
 “key”: [{\
 “keyData”: {\
 “typeUrl”: “type.googleapis.com/google.crypto.tink.EciesAeadHkdfPublicKey”,\
 “keyMaterialType”: “ASYMMETRIC_PUBLIC”,\
 “value”: “EkQKBAgCEAMSOhI4CjB0eXBlLmdvb2dsZWFwaXMuY29tL2dvb2dsZS5jcnlwdG8udGluay5BZXNHY21LZXkSAhAQGAEYARohAOaHVTjvjhpGaHv5mhuXz3Nc+Mb7RE5sMyAsv7YCB8UjIiAOaSLbqRE7ddVM14kWiNoPWB/U2MNluwLlAjw39zwAlw==”\
 },\
 “outputPrefixType”: “TINK”,\
 “keyId”: 1992984960,\
 “status”: “ENABLED”\
 }]
}

还有一种方法允许你使用额外的数据认证你的加密，例如数据包的序列号或使用的 TCP 端口。这被称为带有关联数据的认证加密 (AEAD)，这里有一个使用 AES-SIV 的密钥示例[ 这里]：

{
    "primaryKeyId": 1428191678,
    "key": [{\
        "keyData": {\
            "typeUrl": "type.googleapis.com/google.crypto.tink.AesSivKey",\
            "keyMaterialType": "SYMMETRIC",\
            "value": "EkAFkhmlhYkmClmpz/vGzojJVgA/IQIMSty7rL8TXxyu9m/W0ZtzCddmSLFj7r8V/R0CywJ89KxdMVzdR+GDQH2w"\
        },\
        "outputPrefixType": "TINK",\
        "keyId": 1428191678,\
        "status": "ENABLED"\
    }]
}

所以，你的加密密钥可以用 JSON 查看。

几乎所有你能用到的密钥

让我们来看看如何为 AES、DHKEM (Hybrid ML-KEM)、ECDSA、ECIES、Ed25519、HKDF、HMAC、JWT、RSA PKCS#1 v1.5、RSA PSS 和 XChaCha20 创建密钥：

AES: AES128_EAX AES128_EAX_RAW AES128_GCM, AES128_GCM_HKDF_1MB AES128_GCM_HKDF_4KB AES128_GCM_RAW, AES256_CMAC AES256_CMAC_PRF AES256_CMAC_RAW, AES256_CTR_HMAC_SHA256 AES256_CTR_HMAC_SHA256_1MB, AES256_CTR_HMAC_SHA256_4KB AES256_CTR_HMAC_SHA256_RAW, AES256_EAX AES256_EAX_RAW AES256_GCM AES256_GCM_HKDF_1MB, AES256_GCM_HKDF_4KB AES256_GCM_RAW AES256_SIV, AES256_SIV_RAW AES_CMAC AES_CMAC_PRF CHACHA20_POLY1305 CHACHA20_POLY1305_RAW
DHKE: MDHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_128_GCM, DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_128_GCM_RAW, DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM, DHKEM_P256_HKDF_SHA256_HKDF_SHA256_AES_256_GCM_RAW, DHKEM_P384_HKDF_SHA384_HKDF_SHA384_AES_128_GCM, DHKEM_P384_HKDF_SHA384_HKDF_SHA384_AES_128_GCM_RAW, DHKEM_P384_HKDF_SHA384_HKDF_SHA384_AES_256_GCM, DHKEM_P384_HKDF_SHA384_HKDF_SHA384_AES_256_GCM_RAW, DHKEM_P521_HKDF_SHA512_HKDF_SHA512_AES_128_GCM, DHKEM_P521_HKDF_SHA512_HKDF_SHA512_AES_128_GCM_RAW, DHKEM_P521_HKDF_SHA512_HKDF_SHA512_AES_256_GCM, DHKEM_P521_HKDF_SHA512_HKDF_SHA512_AES_256_GCM_RAW, DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_AES_128_GCM, DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_AES_128_GCM_RAW, DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_AES_256_GCM, DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_AES_256_GCM_RAW, DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY130, DHKEM_X25519_HKDF_SHA256_HKDF_SHA256_CHACHA20_POLY1305_RAW ECDSA_P256 ECDSA_P256_IEEE_P1363
ECDSA_P256_IEEE_P1363_WITHOUT_PREFIX ECDSA_P256_RAW, ECDSA_P384 ECDSA_P384_IEEE_P1363 ECDSA_P384_SHA384, ECDSA_P384_SHA512 ECDSA_P521 ECDSA_P521_IEEE_P1363,
ECIES_P256_COMPRESSED_HKDF_HMAC_SHA256_AES128_CTR_HMAC_SHA256, ECIES_P256_COMPRESSED_HKDF_HMAC_SHA256_AES128_CTR_HMAC_SHA256_RAW, ECIES_P256_COMPRESSED_HKDF_HMAC_SHA256_AES128_GCM, ECIES_P256_COMPRESSED_HKDF_HMAC_SHA256_AES128_GCM_RAW, ECIES_P256_HKDF_HMAC_SHA256_AES128_CTR_HMAC_SHA256, ECIES_P256_HKDF_HMAC_SHA256_AES128_CTR_HMAC_SHA256_RAW, ECIES_P256_HKDF_HMAC_SHA256_AES128_GCM, ECIES_P256_HKDF_HMAC_SHA256_AES128_GCM_COMPRESSED_WITHOUT_PREFIX ECIES_P256_HKDF_HMAC_SHA256_AES128_GCM_RAW
ED25519 ED25519WithRawOutput ED25519_RAW
HKDF_SHA256HKDF_SHA256_DERIVES_AES128_GCM, HKDF_SHA256_DERIVES_AES256_GCM, HKDF_SHA256_DERIVES_AES256_GCM_HKDF_1MB, HKDF_SHA256_DERIVES_AES256_SIV, HKDF_SHA256_DERIVES_ED25519, HKDF_SHA256_DERIVES_HMAC_SHA256_128BITTAG, HKDF_SHA256_DERIVES_HMAC_SHA256_PRF, HKDF_SHA256_DERIVES_XCHACHA20_POLY1305, HMAC_SHA256_128BITTAG HMAC_SHA256_128BITTAG_RAW, HMAC_SHA256_256BITTAG HMAC_SHA256_256BITTAG_RAW, HMAC_SHA256_PRF HMAC_SHA512_128BITTAG, HMAC_SHA512_128BITTAG_RAW HMAC_SHA512_256BITTAG, HMAC_SHA512_256BITTAG_RAW HMAC_SHA512_512BITTAG, HMAC_SHA512_512BITTAG_RAW HMAC_SHA512_PRF JWT_ES256
JWT_ES256_RAW JWT_ES384 JWT_ES384_RAW JWT_ES512, JWT_ES512_RAW JWT_HS256 JWT_HS256_RAW JWT_HS384, JWT_HS384_RAW JWT_HS512 JWT_HS512_RAW JWT_PS256_2048_F4, JWT_PS256_2048_F4_RAW JWT_PS256_3072_F4, JWT_PS256_3072_F4_RAW JWT_PS384_3072_F4, JWT_PS384_3072_F4_RAW JWT_PS512_4096_F4, JWT_PS512_4096_F4_RAW JWT_RS256_2048_F4, JWT_RS256_2048_F4_RAW JWT_RS256_3072_F4, JWT_RS256_3072_F4_RAW JWT_RS384_3072_F4, JWT_RS384_3072_F4_RAW JWT_RS512_4096_F4, JWT_RS512_4096_F4_RAW RSA_SSA_PKCS1_3072_SHA256_F4
RSA_SSA_PKCS1_3072_SHA256_F4_RAW, RSA_SSA_PKCS1_3072_SHA256_F4_WITHOUT_PREFIX, RSA_SSA_PKCS1_4096_SHA512_F4, RSA_SSA_PKCS1_4096_SHA512_F4_RAW. RSA_SSA_PSS_3072_SHA256_F4 RSA_SSA_PSS_3072_SHA256_F4_RAW, RSA_SSA_PSS_3072_SHA256_SHA256_32_F4, RSA_SSA_PSS_4096_SHA512_F4 RSA_SSA_PSS_4096_SHA512_F4_RAW, RSA_SSA_PSS_4096_SHA512_SHA512_64_F4
XCHACHA20_POLY1305, XCHACHA20_POLY1305_RAW

为此，我们可以使用 tinkey 运行：

$ java -jar "tinkey_deploy.jar" create-keyset - key-template AES128_EAX - out-format JSON - out 1.json
$ cat 1.json
{"primaryKeyId":2180785869,"key":
[{"keyData":{\
"typeUrl":"type.googleapis.com_google.crypto.tink.AesEaxKey",\
"value":"EgIIEBoQkkUmFOG1mkQFBTuuLyy6Mw==",\
"keyMaterialType":"SYMMETRIC"},\
"status":"ENABLED",\
"keyId":2180785869,\
"outputPrefixType":"TINK"}]
}

代码在这里：

Google Tink with Go (PRF) \ A PRF (Pseudo Random Function) takes inputs and compute an output that will look random. In this case, we will use the… \ asecuritysite.com

对于 AES_EAX [ 这里]：

{
  "primaryKeyId": 1396503152,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.AesEaxKey",\
        "value": "EgIIEBoQ6RkAIuX/Atj/SkqcpswobA==",\
        "keyMaterialType": "SYMMETRIC"\
      },\
      "status": "ENABLED",\
      "keyId": 1396503152,\
      "outputPrefixType": "TINK"\
    }\
  ]
}

对于 ChaCha20 [ 这里]：

{
  "primaryKeyId": 1961123280,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.ChaCha20Poly1305Key",\
        "value": "EiBGO18rw7WEmiWmDhWtdeLh9yifxqh8ZiRkEc+w0Axaxw==",\
        "keyMaterialType": "SYMMETRIC"\
      },\
      "status": "ENABLED",\
      "keyId": 1961123280,\
      "outputPrefixType": "TINK"\
    }\
  ]
}

对于 DH-ML-KEM [ 这里]：

{
  "primaryKeyId": 471886363,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.HpkePrivateKey",\
        "value": "EksSBggCEAEYARpBBEPwo/feGpb3vlP+PqHmfNcyx4MFiUhmgI6UTlYeOE3CuPlPEr29y10xpEnU7Rbz/68rC/DKtIQgj9wxSqy2jIAaINRX8U+vDAMHohP7pB0eL4APBLGucNXmrNQ/LlKTXMde",\
        "keyMaterialType": "ASYMMETRIC_PRIVATE"\
      },\
      "status": "ENABLED",\
      "keyId": 471886363,\
      "outputPrefixType": "TINK"\
    }\
  ]
}

对于 ECDSA [ 这里]：

{
  "primaryKeyId": 1264604753,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.EcdsaPrivateKey",\
        "value": "Ek4SBggDEAIYAhohADjXTBYypwLxLyv16U1Cjc65bOThbbuy6fLUW/KRPW2+IiEAeNVl+SBSsCTcan65Ak/INw0LxdA7QjxYjhlUwV9jv18aIQDt6E9K9l2uTaMqrptTL+fwMsy4jErqNQrzTLsYB242GQ==",\
        "keyMaterialType": "ASYMMETRIC_PRIVATE"\
      },\
      "status": "ENABLED",\
      "keyId": 1264604753,\
      "outputPrefixType": "TINK"\
    }\
  ]
}

对于 Ed25519 [ 这里]：

{
  "primaryKeyId": 548270440,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.Ed25519PrivateKey",\
        "value": "EiBgPvg/MifqxLPxSSJNDX2sVf1vmsXTqA+adiDVHI5LaBoiEiBN/JwLTuGB1fan3TCMBLXPx6aeMhNQ7t/tpJXltxpZiQ==",\
        "keyMaterialType": "ASYMMETRIC_PRIVATE"\
      },\
      "status": "ENABLED",\
      "keyId": 548270440,\
      "outputPrefixType": "TINK"\
    }\
  ]
}

对于 RSA PSS [ 这里]：

{
  "primaryKeyId": 744063254,
  "key": [\
    {\
      "keyData": {\
        "typeUrl": "type.googleapis.com/google.crypto.tink.RsaSsaPssPrivateKey",\
        "value": "EpEDEgYIAxADGCAagQMAgP3p3Y+/Ymgcjp70eaGg6GjsKWRm4GcuBFH8o4hotVVO0p3MJ2aFBoidMQZpfw8osi4ATZ629A9p1TDu2G58vBKyQVe12kTZ7DP1v5nHspembu9bn9AClUd90CvpHTs7enXHdBMvj/A27qNrD6HD4HWIyMOfHEdjbgAXe3vkB8IAzNDGwmkSEWI10aUyOw63c9/TVRLCmAwBH3b0Nbmx2fJddHfVPLpvlHbErAhFICGr8hI87pBTkh6VWylNWK1hVbAfOnDyw+wKTPBL7ailqkGBT1pj7Sos3zjtswQcCwfbxVOHYhy82tS1DMSW2GztsT2x1tJ3XjMZK7BrvHjOdl2E8q5IgiuEByx8rZWyp69IIfiPgi9hWpsH4Eiq+HUXHJU9YGWHbblpQ/DWQaqBod3nBEQaeiMD1kbtj3UHJaSzeWBh46SSLEBEyThZtpcLd7564FkKb9ZFN8iMezSH/KS9S9SF1Dia5oheWztzkEtQKNhuIsaeMCjaiPuJv+6zIgMBAAEagAM7mJSfaBWtWpqvDiO3uoREPI24Bgo97Y3mMxb9Wz29Yd+cEYnMPmKBhUbS6rp9GLzdrcE4G3c9xY1JEWWYm1uH7T9sTyDW6m6g4dTNpDgOfGBJ6s6zRICdBb3MGy2F8uLlDluLdn3IC9zlXp1NSJjeMI906mStxRHcNbCjvba6GtkRx/e8xJyzaWOiK6fMf10k7SmPqa48X3d5WRU1aUkRgBfLgr4DY8O/nSv6q4t8b/IoUmLSed4SqYyp5Kg2q0uedOC7S4eQ4QZ5Mqo5ckVQwWjnF4rdRtRxI3osjppBbhX9btRAlpsgOMqtjzxqDWI5evUKgEv5K7vJ2x7oAVgkqVt21ha3g4z5AFauM4442Bs+QAxBZLrSAq8mSSVpKDkpaiLSukIb1Pelg/zJPKnibWyGwgfWLLmX8HUdpc6qiRUBZK3X6MC5uo4pXhtGwe3QjmGp3Qw9tizz+Kf9E2IhhbOcTFp8jFHTB50C5IhLkAKDiU2MwPsZHG+8vxaJKAEiwQEA0oxucFs9LOLievcyX2MoEJEGE/7zOBKyCqyc362yshHKKtUT8HiZHZlUz4enIBfkVnG1//yF1aQgg03nTfOB2bBIx0eeQi2i7yVj7uCTVIufikz2KdL+lOwqH++do8b5owN+6z6h+ljvrecdNptywnGAnrqT98kM2BvGHZkQJttVjd5zAc1DiS6culxLc8blgd+6z5XzP3vqhRGgp/NEJASbVh4kLz79xCgZFXdY9BUAib4bi8ig5YQIRL0vtSwBKsEBAJzWZ4/N55rEiup5PoTOc01jU54JZ5YXRVRD+6th64HlYCkENQCchjrATTi7fr7v36g/sunbH0lNiEGEZ+EN8WTnvZNa/AKkYdINz/iCpOoHEo1g45LgQrBUpzXXI8AGL2KPwU7Z9+O/aKWw09e8JnXqIVqeEuOtX1f5WNHAzj/HsDJ2TCZG3r5MmFu6PWn9jbziPX0rtU1mWIyjSipCWHFRo1eXxM1SkjDhcPQl7obNYQiX/hwkC5id90NH/NoqszLBAQC59XRZYgw/B8jWqFviKbaqIxyGLqhsfv6nNNt9J3HrmpC/keCBhFJf9RwWC47NZqyyuM3xYPxnvAVHU1gW3hpyxSMSdyvM8Xe11oVT5x/ZDVSElwLX39YgfBGckUre6w9zLdQ8O95eOYy/QJ/pqhQKrqrWBp5HvFfOy4EIhTbhytjea3mSPtQGZpfgdUHi6Omt8oeRbrQf/vccPnxxugcV9MepoQd+fxks1emJrxZuxdnqznCP3kxVSm7vH1TypAE6wAEHvAsfbGgfmdG//nq20feduWhGQvB41mz02uVubkXPAiDb5Pk4Ln/wJcupIJX/lJTTF1Ebd1Lzqn8tu/njf2yILWWL/tCu0KyCT2wSNV8sq2yezEhs1eJ0D7ivTwzUS3nKwowl91niQW5HvZC08vJynjlG3sTPtZ0eGY3nyjphqtdlpa/bs2MIv35EB8s/juGOjxm5Mo6eYo27YdImg18ZN412pGVwOsI65uNLJxO8UiSW5+gAO0bXH/MxvjsaB0FCwAEyhCrbfvq0CLRYbb9ja7PLwVMVJ6KvCgnWO4k3LbWXa6EsAfSxM4/PNTh4SoDuf0VJI4e0MRlBVWeGt8MetVkXdpqFhUdtIRqVEZ0LC2/Mn7jqAJhAytr9dPL+92G0RF14I8AFUm5S7KXwcSDoj88qQ+NOjkAANtvzxT7eWP3kNlL1G/r2aPJkHNYsj/qhcVLg2YdQogkITgdDOLcePaFRITQQXXEF8r+Z1IXWeaIr2cTNsw8RZ9ykweje5g3GNCs=",\
        "keyMaterialType": "ASYMMETRIC_PRIVATE"\
      },\
      "status": "ENABLED",\
      "keyId": 744063254,\
      "outputPrefixType": "TINK"\
    }\
  ]
}

原文链接： billatnapier.medium.com/...

登链社区 AI 助手，为大家转译优秀英文文章，如有翻译不通的地方，还请包涵～

翻译
学分: 0
分类: 密码学
标签: JSON 加密密钥签名密钥 Google Tink 密钥管理 AES ECDSA

本文参与登链社区写作激励计划，好文好收益，欢迎正在阅读的你也加入。

JSON与加密密钥——天作之合

JSON 和加密密钥 — 天作之合

几乎所有你能用到的密钥

0 条评论

文章目录