如何在Java中对大数据进行RSA加解密

我正在尝试使用RSA和OAEP对实际更大的数据(例如10 KB)执行非对称加密和解密。

许多Stackoverflow文章都提到使用混合方法[不对称+对称]，但我并不希望这样。我特意要求使用非对称加密。

我对加密和解密密码进行了如下初始化：

mDecryptCipher = Cipher.getInstance("RSA/None/OAEPPadding", new BouncyCastleProvider());
mDecryptCipher.init(Cipher.DECRYPT_MODE, mPrivateKey);
Log.d(TAG, "Decrypt Cipher is successfully created");

mEncryptCipher = Cipher.getInstance("RSA/None/OAEPPadding", new BouncyCastleProvider());
mEncryptCipher.init(Cipher.ENCRYPT_MODE, mPublicKey);
Log.d(TAG, "Encrypt Cipher is successfully created");

以下是我尝试用来加密或解密大小为10 KB的大型数据的代码。

// Encrypt
byte[] encryptedPayload = mEncryptCipher.doFinal(payload);

// Decrypt
byte[] decryptedPayload = mDecryptCipher.doFinal(payload);

以下是我收到的异常：

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: too much data for RSA block
    at org.bouncycastle.jcajce.provider.asymmetric.rsa.CipherSpi.engineDoFinal(Unknown Source)
    at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2205)

请告诉我如何对大数据执行RSA加密和解密。

---

解决方案

Java Cipher对象允许我们检索块大小，并使用该对象执行一种重复的加密和解密，从而克服RSA块数据过多的异常。

加密逻辑如下：

public byte[] encrypt(String data) {
    Log.d(TAG, "Encryption begins");
    byte[] payload = data.getBytes(StandardCharsets.UTF_8);
    int payloadLength = payload.length;
    int blockSize = mEncryptCipher.getBlockSize();
    Log.d(TAG, "blockSize: " + blockSize + "; payloadLength: " + payloadLength);

    ByteArrayOutputStream stream = new ByteArrayOutputStream();
    int start = 0, end = 0;
    while (end < payloadLength) {
        end = end + blockSize;
        if (end > payloadLength) {
            end = payloadLength;
        }
        Log.d(TAG, "start: " + start + "; end: " + end + "; block: " + (end - start));
        try {
            byte[] encryptedSlice = mEncryptCipher.doFinal(payload, start, (end - start));
            Log.d(TAG, "Encrypted Slice Length: " + encryptedSlice.length);
            stream.write(encryptedSlice);
            start = end;
        } catch (IOException | BadPaddingException | IllegalBlockSizeException e) {
            Log.e(TAG, "update failed");
            e.printStackTrace();
            break;
        }
    }
    byte[] encryptedPayload = stream.toByteArray();
    try {
        stream.close();
    } catch (IOException e) {
        e.printStackTrace();
    }
    Log.d(TAG, "encryptedPayload length: " + encryptedPayload.length);
    byte[] base64EncryptedPayload = org.apache.commons.codec.binary.Base64.encodeBase64(encryptedPayload);
    Log.d(TAG, "base64EncryptedPayload length: " + base64EncryptedPayload.length);
    Log.d(TAG, "Encryption ends");
    return base64EncryptedPayload;
}

解密逻辑如下：

public String decrypt(byte[] base64EncodedData) {
    Log.d(TAG, "Decryption begins");
    Log.d(TAG, "base64EncodedData length: " + base64EncodedData.length);
    byte[] encryptedData = org.apache.commons.codec.binary.Base64.decodeBase64(base64EncodedData);
    Log.d(TAG, "encryptedData length: " + encryptedData.length);

    ByteArrayOutputStream stream = new ByteArrayOutputStream();
    int payloadLength = encryptedData.length;
    int blockSize = mDecryptCipher.getBlockSize();
    int start = 0, end = 0;
    while (start < payloadLength) {
        end = end + blockSize;
        if (end > payloadLength) {
            end = payloadLength;
        }

        Log.d(TAG, "start: " + start + "; end: " + end + "; block: " + (end - start));
        try {
            byte[] decryptedBlockData = mDecryptCipher.doFinal(encryptedData, start, (end - start));
            Log.d(TAG, "decryptedBlockData Length: " + decryptedBlockData.length);
            stream.write(decryptedBlockData);
            start = end;
        } catch (BadPaddingException | IllegalBlockSizeException | IOException e) {
            Log.e(TAG, "Slicing failed");
            e.printStackTrace();
            break;
        }
    }
    String payload = stream.toString();
    try {
        stream.close();
    } catch (IOException e) {
        e.printStackTrace();
    }
    Log.d(TAG, "Decryption ends");
    return payload;
}

请注意，在我的例子中，以下是Cipher对象的详细信息：

EncryptCipher：

getBlockSize: 470
getAlgorithm: RSA/None/OAEPPadding
getProvider Name: BC
getProvider Info: BouncyCastle Security Provider v1.70

解密密码：

getBlockSize: 512
getAlgorithm: RSA/None/OAEPPadding
getProvider Name: BC
getProvider Info: BouncyCastle Security Provider v1.70

我也愿意接受任何更好的解决方案。