Android Java中从.pfx文件提取PKCS#8格式私钥的问题

问题说明 #

从PFX文件提取私钥时，当前Android代码输出PKCS#1格式密钥，但业务要求转换为PKCS#8格式。之前尝试的转换代码未生效，最终需将密钥传递给Flutter用于解密操作。

现有Android提取代码 #

KeyManagerFactory kmf = KeyManagerFactory.getInstance("X509");
char[] password = "password".toCharArray();
KeyStore keyStore = KeyStore.getInstance("PKCS12");
InputStream certificateStream = getResources().openRawResource(R.raw.certificate);
keyStore.load(certificateStream, password);
kmf.init(keyStore,password);
Enumeration<String> aliases = keyStore.aliases();
while (aliases.hasMoreElements()) {
    String alias = aliases.nextElement();

    if (keyStore.isKeyEntry(alias)) {
        PrivateKey keyEntry = (PrivateKey) keyStore.getKey(alias, password);
        byte[] bytes = keyEntry.getEncoded();
        String keyFormat = keyEntry.getFormat();
        String base64PrivateKey = Base64.encodeToString(bytes, Base64.DEFAULT);

        Log.d("PFXExtractor", "Private key extracted and encoded in Base64:\n" + base64PrivateKey);
    }
}

无效的转换尝试 #

PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(privateKey.getEncoded());
KeyFactory kf = KeyFactory.getInstance("RSA");
PrivateKey privateKey1 = kf.generatePrivate(pkcs8EncodedKeySpec);

Flutter端解密代码 #

RSAKeyParser().parse("-----BEGIN RSA PRIVATE KEY-----
$keyStr
-----END RSA PRIVATE KEY-----") as RSAPrivateKey;

解决方案 #

转换失败原因 #

原转换代码直接用PKCS8EncodedKeySpec解析PKCS#1格式的字节数组，而PKCS8EncodedKeySpec仅支持PKCS#8格式的编码，导致转换失败。正确逻辑是先将PKCS#1私钥解析为RSA私钥实例，再封装为PKCS#8格式。

推荐转换方案（基于BouncyCastle） #

1. 首先在Android项目中添加BouncyCastle依赖（build.gradle）：

implementation 'org.bouncycastle:bcprov-jdk15on:1.70'

2. 修改Android提取代码，添加转换逻辑：

if (keyStore.isKeyEntry(alias)) {
    PrivateKey keyEntry = (PrivateKey) keyStore.getKey(alias, password);
    byte[] pkcs1Bytes = keyEntry.getEncoded();
    
    // 将PKCS#1私钥转换为PKCS#8格式
    KeyFactory rsaKeyFactory = KeyFactory.getInstance("RSA");
    RSAPrivateKey rsaPrivKey = (RSAPrivateKey) rsaKeyFactory.generatePrivate(
            new PKCS1EncodedKeySpec(pkcs1Bytes)
    );
    
    // 生成PKCS#8格式的PEM字符串
    StringWriter sw = new StringWriter();
    try (JcaPEMWriter writer = new JcaPEMWriter(sw)) {
        writer.writeObject(rsaPrivKey);
    } catch (IOException e) {
        e.printStackTrace();
    }
    String pkcs8Pem = sw.toString();
    // 提取纯Base64内容（去掉PEM头尾和换行）
    String pkcs8Base64 = pkcs8Pem.replace("-----BEGIN PRIVATE KEY-----", "")
                                 .replace("-----END PRIVATE KEY-----", "")
                                 .replaceAll("\\s+", "");

    Log.d("PFXExtractor", "PKCS#8 Private key Base64:\n" + pkcs8Base64);
    // 将pkcs8Base64通过MethodChannel传递给Flutter
}

Flutter端代码修改 #

PKCS#8格式的PEM头与PKCS#1不同，需修改解密代码的头标识：

RSAKeyParser().parse("-----BEGIN PRIVATE KEY-----
$keyStr
-----END PRIVATE KEY-----") as RSAPrivateKey;

内容的提问来源于stack exchange，提问作者Razer