Java中Ed25519公钥转X25519公钥（LazySodium）报错求助

问题描述 #

尝试在Java中通过LazySodium将Ed25519公钥转换为X25519公钥，实现代码如下：

import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PublicKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.X509EncodedKeySpec;

import com.goterl.lazysodium.LazySodium;
import com.goterl.lazysodium.LazySodiumJava;
import com.goterl.lazysodium.SodiumJava;

public class KeyOps {

    public static PublicKey ed25519ToX25519(PublicKey ed25519PublicKey) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeySpecException {
        byte[] x25519PublicKeyBytes = new byte[32];
        LazySodium lazySodium = new LazySodiumJava(new SodiumJava());
        byte[] ed25519PublicKeyBytes = new byte[32];
        System.arraycopy(ed25519PublicKey.getEncoded(), 12, ed25519PublicKeyBytes, 0, 32);
        lazySodium.convertPublicKeyEd25519ToCurve25519(x25519PublicKeyBytes, ed25519PublicKeyBytes);
        return KeyFactory.getInstance("X25519", "BC").generatePublic(new X509EncodedKeySpec(x25519PublicKeyBytes));
    }

}

Ed25519公钥生成代码：

KeyPair keyPair = KeyPairGenerator.getInstance("Ed25519", "BC").generateKeyPair();
PublicKey ed25519PublicKey = keyPair.getPublic();

运行时出现随机错误，例如：

An exception occured while executing the Java class. encoded key spec not recognized: failed to construct sequence from byte[]: Extra data detected in stream

或

An exception occured while executing the Java class. encoded key spec not recognized: failed to construct sequence from byte[]: corrupted stream - out of bounds length found: 57 >= 54

问题原因 #

1. X509EncodedKeySpec格式不匹配：X509EncodedKeySpec要求传入完整的X.509 DER编码公钥（包含ASN.1结构标识、算法ID、主体公钥等完整结构），但LazySodium转换输出的是32字节的原始X25519公钥裸数据，直接用它构造X509EncodedKeySpec会导致解析失败，因为缺少X.509的结构包装。
2. 提取Ed25519原始公钥的逻辑是正确的：BouncyCastle生成的Ed25519公钥getEncoded()返回的X.509编码中，从索引12开始的32字节确实是原始Ed25519公钥数据，这部分没有问题。

正确解决方案 #

有两种可靠的方式完成转换并生成合法的PublicKey对象：

方法1：手动构造X25519的X.509 DER编码 #

X25519的X.509公钥DER编码结构固定，我们可以把32字节原始公钥包装成符合格式的DER数据：

import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PublicKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.X509EncodedKeySpec;

import com.goterl.lazysodium.LazySodium;
import com.goterl.lazysodium.LazySodiumJava;
import com.goterl.lazysodium.SodiumJava;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;

public class KeyOps {

    public static PublicKey ed25519ToX25519(PublicKey ed25519PublicKey) throws Exception {
        byte[] x25519PublicKeyBytes = new byte[32];
        LazySodium lazySodium = new LazySodiumJava(new SodiumJava());
        
        // 提取原始Ed25519公钥（正确逻辑）
        byte[] ed25519PublicKeyBytes = new byte[32];
        System.arraycopy(ed25519PublicKey.getEncoded(), 12, ed25519PublicKeyBytes, 0, 32);
        
        // 执行转换，检查是否成功
        boolean success = lazySodium.convertPublicKeyEd25519ToCurve25519(x25519PublicKeyBytes, ed25519PublicKeyBytes);
        if (!success) {
            throw new RuntimeException("Ed25519转X25519失败");
        }
        
        // 构造X25519的X.509 SubjectPublicKeyInfo
        ASN1ObjectIdentifier x25519Oid = new ASN1ObjectIdentifier("1.3.101.110");
        AlgorithmIdentifier algId = new AlgorithmIdentifier(x25519Oid);
        SubjectPublicKeyInfo spki = new SubjectPublicKeyInfo(algId, x25519PublicKeyBytes);
        
        // 生成DER编码并转换为PublicKey
        byte[] x509Encoded = spki.getEncoded("DER");
        return KeyFactory.getInstance("X25519", "BC").generatePublic(new X509EncodedKeySpec(x509Encoded));
    }
}

方法2：使用BouncyCastle的X25519PublicKeyParameters（更简洁） #

直接利用BouncyCastle的参数类转换原始公钥字节，无需手动构造DER：

import java.security.KeyFactory;
import java.security.PublicKey;

import com.goterl.lazysodium.LazySodium;
import com.goterl.lazysodium.LazySodiumJava;
import com.goterl.lazysodium.SodiumJava;
import org.bouncycastle.crypto.params.X25519PublicKeyParameters;

public class KeyOps {

    public static PublicKey ed25519ToX25519(PublicKey ed25519PublicKey) throws Exception {
        byte[] x25519PublicKeyBytes = new byte[32];
        LazySodium lazySodium = new LazySodiumJava(new SodiumJava());
        
        // 提取原始Ed25519公钥
        byte[] ed25519PublicKeyBytes = new byte[32];
        System.arraycopy(ed25519PublicKey.getEncoded(), 12, ed25519PublicKeyBytes, 0, 32);
        
        // 执行转换，检查是否成功
        boolean success = lazySodium.convertPublicKeyEd25519ToCurve25519(x25519PublicKeyBytes, ed25519PublicKeyBytes);
        if (!success) {
            throw new RuntimeException("Ed25519转X25519失败");
        }
        
        // 通过BouncyCastle参数类生成PublicKey
        X25519PublicKeyParameters params = new X25519PublicKeyParameters(x25519PublicKeyBytes, 0);
        KeyFactory keyFactory = KeyFactory.getInstance("X25519", "BC");
        return keyFactory.generatePublic(params);
    }
}

注意事项 #

• 确保项目中已正确引入BouncyCastle依赖（如bcprov-jdk15on），且已注册安全提供者：

  Security.addProvider(new BouncyCastleProvider());
  

• 转换前必须检查lazySodium.convertPublicKeyEd25519ToCurve25519的返回值，若返回false说明转换操作失败（比如输入的Ed25519公钥无效）。

内容的提问来源于stack exchange，提问作者TaihouKai