提高加密数据的安全性 - Jasypt 初试

package me.test.jasypt;

import java.math.BigDecimal;

import org.apache.commons.codec.binary.Base64;
import org.jasypt.util.binary.BasicBinaryEncryptor;
import org.jasypt.util.digest.Digester;
import org.jasypt.util.numeric.BasicDecimalNumberEncryptor;
import org.jasypt.util.password.ConfigurablePasswordEncryptor;
import org.jasypt.util.text.BasicTextEncryptor;

/**
 * Jasypt
 *
 *
 * 在应用 WebLogic、学习 Maven 的时候都碰到过设置密码的情况，且发现他们对同样密码的
 * 2次加密结果还都不一致，但却能验证成功，看过了 Maven 使用的加密的源码。但是作为
 * 可独立使用类库就有点牵强了。于是，就用 google 百度了一下，发现了类似组件，先按照
 * 官网上的例子给写出个 sample 吧。
 *
 * 注意：虽然该组件可以提高加密数据被破解的几率，但是对于系统密码的保护仍需要重视。
 * 系统密码被泄露后，更新系统密码引发的加密数据需要使用原密码解密、再使用新密码加密
 * 也是一个问题（即，加密密码的版本管理问题）。
 *
 * @author [e-mail]
 */

/* 附上一份结果吧：
========= test general digesting
input=[zhang3], output=[5LMF/mIwdfqhesdCUWujzFYtwng=]
input=[zhang3], output=[5LMF/mIwdfqhesdCUWujzFYtwng=]

========= test password encryption (digesting).
userPassword=[123456], encryptedPassword=[XC4QDvKS72xtYPmTB51Z1/Qy1mVK5+wcSQ2dAg==], inputPassword=[123456], matched=[true]
userPassword=[123456], encryptedPassword=[thOIZMc7odNXhH1vZ93dKfBLwo+5xdnAxN56FA==], inputPassword=[123456], matched=[true]

========= test text encryption.
password=[123456], text=[zhang3], encryptedText=[UE37aP0KvFWWL9ZkCFBW3g==], plainText=[zhang3]
password=[123456], text=[zhang3], encryptedText=[aWNQza1NdQxjRdy3DJQr8g==], plainText=[zhang3]

========= test number encryption.
password=[123456], number=[123456789.1229999959468841552734375], encryptedNumber=[-367267622180946584689892873201427575447347.0297720356016226605989864], plainNumber=[123456789.1229999959468841552734375]
password=[123456], number=[123456789.1229999959468841552734375], encryptedNumber=[177858823843249227001381950717244348460500.9116956255239482869022744], plainNumber=[123456789.1229999959468841552734375]

========= test binary encryption.
password=[123456], binaryStr=[zhang3], encryptedBinaryBase64=[3SA3+eH3mpX+8vnePCLaxw==], plainBinaryStr=[zhang3]
password=[123456], binaryStr=[zhang3], encryptedBinaryBase64=[EOOCLZaVESaG5lYj6E/lBg==], plainBinaryStr=[zhang3]
 */

public class Test {

    public static void main(String[] args) {
        testGeneralDigest();
        testPasswordEncryption();
        testTextEncryption();
        testNumberEncryption();
        testBinaryEncryption();
    }

    /**
     * 进行正常的摘要。称不上为加密，只能用于检测是否数据被改窜。
     */
    public static void testGeneralDigest() {
        System.out.println("========= test general digesting");

        Digester digester = new Digester();
        digester.setAlgorithm("SHA-1");

        // 第一次
        String msg = "zhang3";
        byte[] digest = digester.digest(msg.getBytes());
        String digestBase64 = Base64.encodeBase64String(digest).trim();
        System.out.printf("msg=[%s], digest=[%s]\n", msg, digestBase64);

        // 第二次
        msg = "zhang3";
        digest = digester.digest(msg.getBytes());
        digestBase64 = Base64.encodeBase64String(digest).trim();
        System.out.printf("msg=[%s], digest=[%s]\n", msg, digestBase64);

        System.out.println();
    }

    /**
     * 对密码进行加密。一般都使用单向加密（其实也摘要的一种）。
     */
    public static void testPasswordEncryption() {
        System.out.println("========= test password encryption (digesting).");
        ConfigurablePasswordEncryptor encryptor = new ConfigurablePasswordEncryptor();
        encryptor.setAlgorithm("SHA-1");
        encryptor.setPlainDigest(false);

        // 第一次
        String userPassword = "123456";
        String encryptedPassword = encryptor.encryptPassword(userPassword);
        String inputPassword = userPassword;
        boolean matched = encryptor.checkPassword(inputPassword,
                encryptedPassword);
        System.out.printf("userPassword=[%s], encryptedPassword=[%s], "
                + "inputPassword=[%s], matched=[%s]\n", userPassword,
                encryptedPassword, inputPassword, matched);

        // 第二次
        userPassword = "123456";
        encryptedPassword = encryptor.encryptPassword(userPassword);
        inputPassword = userPassword;
        matched = encryptor.checkPassword(inputPassword, encryptedPassword);
        System.out.printf("userPassword=[%s], encryptedPassword=[%s], "
                + "inputPassword=[%s], matched=[%s]\n", userPassword,
                encryptedPassword, inputPassword, matched);

        System.out.println();
    }

    /**
     * 对文本进行加密。可对大量数据进行加密。
     */
    public static void testTextEncryption() {
        System.out.println("========= test text encryption.");

        BasicTextEncryptor encryptor = new BasicTextEncryptor();
        String password = "123456";
        encryptor.setPassword(password);

        // 第一次
        String text = "zhang3";
        String encryptedText = encryptor.encrypt(text);
        String plainText = encryptor.decrypt(encryptedText);
        System.out.printf("password=[%s], text=[%s], encryptedText=[%s], "
                + "plainText=[%s]\n", password, text, encryptedText, plainText);

        // 第二次
        text = "zhang3";
        encryptedText = encryptor.encrypt(text);
        plainText = encryptor.decrypt(encryptedText);
        System.out.printf("password=[%s], text=[%s], encryptedText=[%s], "
                + "plainText=[%s]\n", password, text, encryptedText, plainText);

        System.out.println();
    }

    /**
     * 对数值型 BasicDecimal 进行加密。加密前后均为 BasicDecimal 类型。
     */
    public static void testNumberEncryption() {
        System.out.println("========= test number encryption.");

        BasicDecimalNumberEncryptor encryptor = new BasicDecimalNumberEncryptor();

        String password = "123456";
        encryptor.setPassword(password);

        // 第一次
        BigDecimal number = new BigDecimal(123456789.123D);
        BigDecimal encryptedNumber = encryptor.encrypt(number);
        BigDecimal plainNumber = encryptor.decrypt(encryptedNumber);
        System.out.printf("password=[%s], number=[%s], encryptedNumber=[%s], "
                + "plainNumber=[%s]\n", password, number, encryptedNumber,
                plainNumber);

        // 第二次
        number = new BigDecimal(123456789.123D);
        encryptedNumber = encryptor.encrypt(number);
        plainNumber = encryptor.decrypt(encryptedNumber);
        System.out.printf("password=[%s], number=[%s], encryptedNumber=[%s], "
                + "plainNumber=[%s]\n", password, number, encryptedNumber,
                plainNumber);

        System.out.println();
    }

    /**
     * 对二进制进行加密。
     */
    public static void testBinaryEncryption() {
        System.out.println("========= test binary encryption.");

        BasicBinaryEncryptor encryptor = new BasicBinaryEncryptor();

        String password = "123456";
        encryptor.setPassword(password);

        // 第一次
        String binaryStr = "zhang3";
        byte[] encryptedBinary = encryptor.encrypt(binaryStr.getBytes());
        String encryptedBinaryBase64 = Base64.encodeBase64String(
                encryptedBinary).trim();
        byte[] plainBinary = encryptor.decrypt(encryptedBinary);
        String plainBinaryStr = new String(plainBinary);
        System.out.printf("password=[%s], binaryStr=[%s], "
                + "encryptedBinaryBase64=[%s], plainBinaryStr=[%s]\n",
                password, binaryStr, encryptedBinaryBase64, plainBinaryStr);

        // 第二次
        binaryStr = "zhang3";
        encryptedBinary = encryptor.encrypt(binaryStr.getBytes());
        encryptedBinaryBase64 = Base64.encodeBase64String(encryptedBinary)
                .trim();
        plainBinary = encryptor.decrypt(encryptedBinary);
        plainBinaryStr = new String(plainBinary);
        System.out.printf("password=[%s], binaryStr=[%s], "
                + "encryptedBinaryBase64=[%s], plainBinaryStr=[%s]\n",
                password, binaryStr, encryptedBinaryBase64, plainBinaryStr);

        System.out.println();
    }
}