iOS安全API实战指南：数据加密解密与数字签名技术详解

class CryptoGraphicOperationViewModel {
    var p12Data: Data
    var password: String
    
    init(fileName: String = "Certificate", ext: String = "p12", password: String = "1233") {
        self.p12Data = Self.insertCertificate() ?? Data()
        self.password = password
    }
    
    static func insertCertificate(fileName: String, ext: String, password: String) -> Data? {
        return Utils.dataFromFile(name: fileName, withExtension: ext)
    }
    
    public func encrypt(data: Data, algorithm: SecKeyAlgorithm = .rsaEncryptionOAEPSHA512AESGCM) -> Data? {
        guard let result = Utils.certificateDataFromP12(p12Data: self.p12Data, password: self.password) else { return nil }
        guard let publicAndPrivateKey = Utils.publicAndPrivateKey(pkcs12Entry: result.pkcs12Entry) else { return nil }
        return self.encrypt(value: data, publicKey: publicAndPrivateKey.publicKey, algorithm: algorithm)
    }
    
    public func decrypt(data: Data, algorithm: SecKeyAlgorithm = .rsaEncryptionOAEPSHA512AESGCM) -> Data? {
        guard let result = Utils.certificateDataFromP12(p12Data: self.p12Data, password: self.password) else { return nil }
        guard let publicAndPrivateKey = Utils.publicAndPrivateKey(pkcs12Entry: result.pkcs12Entry) else { return nil }
        return self.decrypt(encrypted: data, privateKey: publicAndPrivateKey.privateKey, algorithm: algorithm)
    }
    
    public func sign(dataToSign: Data, algorithm: SecKeyAlgorithm = .rsaSignatureMessagePKCS1v15SHA512) -> Data? {
        guard let result = Utils.certificateDataFromP12(p12Data: self.p12Data, password: self.password) else { return nil }
        guard let publicAndPrivateKey = Utils.publicAndPrivateKey(pkcs12Entry: result.pkcs12Entry) else { return nil }
        return self.signThe(data: dataToSign, privateKey: publicAndPrivateKey.privateKey, algorithm: algorithm)
    }
    
    public func verify(signedData: Data, signature: Data, algorithm: SecKeyAlgorithm = .rsaSignatureMessagePKCS1v15SHA512) -> Bool {
        guard let result = Utils.certificateDataFromP12(p12Data: self.p12Data, password: self.password) else { return false }
        guard let publicAndPrivateKey = Utils.publicAndPrivateKey(pkcs12Entry: result.pkcs12Entry) else { return false }
        return self.verifySigned(data: signedData, signature: signature, publicKey: publicAndPrivateKey.publicKey, algorithm: algorithm)
    }
    
    internal func encrypt(value: Data, publicKey: SecKey, algorithm: SecKeyAlgorithm) -> Data? {
        guard SecKeyIsAlgorithmSupported(publicKey, .encrypt, algorithm) else {
            debugPrint("Not supported encryption algorithm")
            return nil
        }
        var errorRef: Unmanaged<CFError>?
        guard let encryptedData = SecKeyCreateEncryptedData(publicKey, algorithm, value as CFData, &errorRef) else {
            let error = errorRef?.takeRetainedValue()
            debugPrint("error encrypting:\(String(describing: error))")
            return nil
        }
        return encryptedData as Data
    }
    
    internal func decrypt(encrypted: Data, privateKey: SecKey, algorithm: SecKeyAlgorithm) -> Data? {
        guard SecKeyIsAlgorithmSupported(privateKey, .decrypt, algorithm) else {
            debugPrint("Not supported decription algorithm")
            return nil
        }
        var errorRef: Unmanaged<CFError>?
        guard let decryptedData = SecKeyCreateDecryptedData(privateKey, algorithm, encrypted as CFData, &errorRef) as Data? else {
            let error = errorRef?.takeRetainedValue()
            debugPrint("error decrypting:\(String(describing: error))")
            return nil
        }
        return decryptedData
    }
    
    internal func signThe(data: Data, privateKey: SecKey, algorithm: SecKeyAlgorithm) -> Data? {
        guard SecKeyIsAlgorithmSupported(privateKey, .sign, algorithm) else {
            debugPrint("Not supported decription algorithm")
            return nil
        }
        var errorRef: Unmanaged<CFError>?
        guard let signature = SecKeyCreateSignature(privateKey, algorithm, data as CFData, &errorRef) as Data? else {
            let error = errorRef?.takeRetainedValue()
            debugPrint("error signing:\(String(describing: error))")
            debugPrint("Not supported decription algorithm")
            return nil
        }
        return signature as Data
    }
    
    internal func verifySigned(data: Data, signature: Data, publicKey: SecKey, algorithm: SecKeyAlgorithm) -> Bool {
        guard SecKeyIsAlgorithmSupported(publicKey, .verify, algorithm) else {
            debugPrint("Not supported encryption algorithm")
            return false
        }
        guard data.isNotEmpty else {
            debugPrint("Can not verify signature with empty signed data")
            return false
        }
        var errorRef: Unmanaged<CFError>?
        guard SecKeyVerifySignature(publicKey, algorithm, data as CFData, signature as CFData, &errorRef) else {
            debugPrint("error verifying:\(String(describing: errorRef?.takeRetainedValue() as Error?))")
            return false
        }
        return true
    }
}

// 创建访问控制对象
let access = SecAccessControlCreateWithFlags(
    kCFAllocatorDefault,                                 // 1
    kSecAttrAccessibleWhenUnlockedThisDeviceOnly,       // 2
    [.privateKeyUsage, .biometryAny],                   // 3
    nil                                                  // 4
)!

let secEnclaveTag = "YourKey".data(using: .utf8)!       // 5

let privateKeyParams: [String: AnyObject] = [
    kSecAttrIsPermanent as String: true as AnyObject,   // 6
    kSecAttrApplicationTag as String: secEnclaveTag as AnyObject, // 7
    kSecAttrAccessControl as String: access              // 8
]

let attributes = [
    kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom, // 9
    kSecAttrKeySizeInBits as String: 256,                // 10
    kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave, // 11
    kSecPrivateKeyAttrs as String: privateKeyParams
] as CFDictionary                                         // 12

var error: Unmanaged<CFError>?
guard let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) else {
    throw error!.takeRetainedValue() as Error
}

guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
    print("公钥生成错误")
    return ""
}

let message = "AshishAwasthi"
guard let messageData = message.data(using: String.Encoding.utf8) else {
    print("待签名的消息无效。")
}

// 1. 创建签名
guard let signData = SecKeyCreateSignature(privateKey, 
                                          SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256, 
                                          messageData as CFData, 
                                          nil) else {
    print("签名错误")
    return nil
}

// 2. 处理签名数据
let signedData = signData as Data
let signedString = signedData.base64EncodedString(options: [])
print("签名字符串", signedString)

// 3. 验证签名
let message = "AshishAwasthi"
guard let messageData = message.data(using: String.Encoding.utf8) else {
    print("ECC验证消息错误")
    return false
}

guard let signatureData = signedData else {
    print("待验证的消息无效。")
}

let verify = SecKeyVerifySignature(publicKey, 
                                  SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256, 
                                  messageData as CFData, 
                                  signatureData as CFData, 
                                  nil)