Key Management Service：Contoh kode untuk penandatanganan dan verifikasi

package com.aliyun.dkms.gcs.sdk.example;

import com.aliyun.dkms.gcs.openapi.models.Config;
import com.aliyun.dkms.gcs.openapi.util.models.RuntimeOptions;
import com.aliyun.dkms.gcs.sdk.Client;
import com.aliyun.dkms.gcs.sdk.models.SignRequest;
import com.aliyun.dkms.gcs.sdk.models.SignResponse;
import com.aliyun.dkms.gcs.sdk.models.VerifyRequest;
import com.aliyun.dkms.gcs.sdk.models.VerifyResponse;
import com.aliyun.tea.TeaException;

import java.io.Serializable;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Arrays;

/**
 * Dalam contoh ini, kunci asimetris di KMS dan algoritma SHA-256 digunakan untuk penandatanganan dan verifikasi.
 */
public class Sha256AsymmetricSignVerifySample {
    // Client instance KMS Anda.
    private static Client client = null;

    public static void main(String[] args) {

        try {
            // Buat client untuk instance KMS Anda.
            initClient();

            // Gunakan instance KMS Anda untuk penandatanganan dan verifikasi.
            asymmetricSignVerify();

        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    /**
     * Buat client untuk instance KMS Anda.
     *
     * @throws Exception
     */
    public static void initClient() throws Exception {
        // Protokol koneksi. Atur nilainya ke https. KMS hanya mendukung koneksi melalui HTTPS. 
        Config config = new Config();
        config.setProtocol("https");
    
        // Kunci client. 
        config.setClientKeyFile("<CLIENT_KEY_FILE>");
     
         // Kata sandi file kunci client. 
        config.setPassword("<PASSWORD>");
       
         // Titik akhir instance KMS Anda. Tentukan nilainya dalam format berikut: <ID instance KMS Anda>.cryptoservice.kms.aliyuncs.com. 
        config.setEndpoint("<ENDPOINT>");
        
        // Sertifikat otoritas sertifikat (CA) dari instance KMS Anda. Anda dapat menentukan jalur ke file sertifikat CA atau memasukkan isi sertifikat CA. 
        config.setCaFilePath("<CERTIFICATE_PATH>");
        // Isi sertifikat CA dari instance KMS Anda.
        //config.setCa("<CERTIFICATE_CONTENT");
        client = new Client(config);
        
    }

    /**
     * Gunakan instance KMS Anda untuk penandatanganan dan verifikasi.
     *
     * @throws Exception
     */
    public static void asymmetricSignVerify() throws Exception {
        String keyId = "<KEY_ID>";
        String algorithm = "<ALGORITHM>";
        String message = "<MESSAGE>";
        // Jenis data yang akan ditandatangani. Nilai valid: RAW dan DIGEST. Nilai RAW menunjukkan pesan mentah. Nilai DIGEST menunjukkan ringkasan pesan mentah.
        String messageType = "DIGEST";

        // Gunakan KMS untuk menandatangani pesan.
        final SignContext signContext = asymmetricSign(keyId, algorithm, message, messageType);
        // Gunakan KMS untuk memverifikasi tanda tangan pesan.
        asymmetricVerify(signContext, message);
    }

    /**
     * Gunakan KMS untuk menandatangani pesan.
     *
     * @param keyId
     * @param algorithm
     * @param message
     * @param messageType
     * @return
     * @throws Exception
     */
    public static SignContext asymmetricSign(String keyId, String algorithm, String message, String messageType) throws Exception {

        SignRequest signRequest = new SignRequest();
        signRequest.setKeyId(keyId);
        signRequest.setAlgorithm(algorithm);
        signRequest.setMessage(getDigest(message));
        signRequest.setMessageType(messageType);
        try {
            // Jika Anda ingin mengabaikan sertifikat server, Anda dapat menggunakan kode yang dikomentari berikut untuk memanggil operasi.
            //RuntimeOptions runtimeOptions = new RuntimeOptions();
            //runtimeOptions.setIgnoreSSL(true);
            //SignResponse signResponse = client.signWithOptions(signRequest, runtimeOptions);
            SignResponse signResponse = client.sign(signRequest);
            // Nilai tanda tangan.
            byte[] signature = signResponse.getSignature();
            System.out.println("================sign================");
            System.out.printf("KeyId: %s%n", signResponse.getKeyId());
            System.out.printf("Tanda tangan: %s%n", Arrays.toString(signature));
            System.out.println("================sign================");
            return new SignContext(signResponse.getKeyId(), signResponse.getSignature(), signResponse.getAlgorithm(), signResponse.getMessageType());
        } catch (TeaException e) {
            System.out.printf("Kode: %s%n", ((TeaException) e).getCode());
            System.out.printf("Pesan: %s%n", ((TeaException) e).getMessage());
            System.out.printf("HttpCode: %s%n", ((TeaException) e).getData().get("httpCode"));
            System.out.printf("HostId: %s%n", ((TeaException) e).getData().get("hostId"));
            System.out.printf("RequestId: %s%n", ((TeaException) e).getData().get("requestId"));
            e.printStackTrace();
            throw new RuntimeException(e);
        } catch (Exception e) {
            System.out.printf("Pesan kesalahan sign: %s%n", e.getMessage());
            e.printStackTrace();
            throw new RuntimeException(e);
        }
    }

    /**
     * Gunakan KMS untuk memverifikasi tanda tangan pesan.
     *
     * @param signContext
     * @throws Exception
     */
    public static void asymmetricVerify(final SignContext signContext, String message) throws Exception {
        VerifyRequest verifyRequest = new VerifyRequest();
        verifyRequest.setKeyId(signContext.getKeyId());
        verifyRequest.setAlgorithm(signContext.getAlgorithm());
        verifyRequest.setMessage(getDigest(message));
        verifyRequest.setMessageType(signContext.getMessageType());
        verifyRequest.setSignature(signContext.getSignature());
        try {
            // Jika Anda ingin mengabaikan sertifikat server, Anda dapat menggunakan kode yang dikomentari berikut untuk memanggil operasi.
            //RuntimeOptions runtimeOptions = new RuntimeOptions();
            //runtimeOptions.setIgnoreSSL(true);
            //VerifyResponse verifyResponse = client.verifyWithOptions(verifyRequest, runtimeOptions);
            VerifyResponse verifyResponse = client.verify(verifyRequest);
            System.out.println("================verify================");
            System.out.printf("KeyId: %s%n", verifyResponse.getKeyId());
            System.out.printf("Nilai: %s%n", verifyResponse.getValue());
            System.out.println("================verify================");
        } catch (TeaException e) {
            System.out.printf("Kode: %s%n", ((TeaException) e).getCode());
            System.out.printf("Pesan: %s%n", ((TeaException) e).getMessage());
            System.out.printf("HttpCode: %s%n", ((TeaException) e).getData().get("httpCode"));
            System.out.printf("HostId: %s%n", ((TeaException) e).getData().get("hostId"));
            System.out.printf("RequestId: %s%n", ((TeaException) e).getData().get("requestId"));
            e.printStackTrace();
        } catch (Exception e) {
            System.out.printf("Pesan kesalahan verify: %s%n", e.getMessage());
            e.printStackTrace();
        }
    }

    private static byte[] getDigest(String message) throws Exception {
        MessageDigest sha256 = MessageDigest.getInstance("SHA-256");
        return sha256.digest(message.getBytes(StandardCharsets.UTF_8));
    }

    /**
     * Konteks tanda tangan mungkin disimpan.
     */
    static class SignContext implements Serializable {
        public String keyId;
        public byte[] signature;
        /**
         * Gunakan nilai algoritma default, jika nilai tidak diatur.
         */
        public String algorithm;
        public String messageType;

        public SignContext() {
        }

        public SignContext(String keyId, byte[] signature, String algorithm, String messageType) {
            this.keyId = keyId;
            this.signature = signature;
            this.algorithm = algorithm;
            this.messageType = messageType;
        }

        public String getKeyId() {
            return keyId;
        }

        public void setKeyId(String keyId) {
            this.keyId = keyId;
        }

        public byte[] getSignature() {
            return signature;
        }

        public void setSignature(byte[] signature) {
            this.signature = signature;
        }

        public String getAlgorithm() {
            return algorithm;
        }

        public void setAlgorithm(String algorithm) {
            this.algorithm = algorithm;
        }

        public String getMessageType() {
            return messageType;
        }

        public void setMessageType(String messageType) {
            this.messageType = messageType;
        }
    }
}