Rust加密与解密库picky的使用

picky是一个提供高效安全加密算法和数据处理功能的Rust库，实现了X.509、PKI、JOSE和HTTP签名等标准。

主要功能

X.509 / PKI

picky提供了X.509证书和PKI(公钥基础设施)的实现。

HTTP签名

支持HTTP消息签名功能。

JOSE

实现了JOSE标准(Javascript Object Signing and Encryption)，包括JWT等功能。

安装

在项目目录中运行以下Cargo命令：

cargo add picky

或者在Cargo.toml中添加：

picky = "6.3.0"

示例代码

生成RSA密钥对

use picky::key::PrivateKey;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // 生成2048位的RSA私钥
    let private_key = PrivateKey::generate_rsa(2048)?;
    
    // 导出PEM格式的私钥
    let private_key_pem = private_key.to_pem_str()?;
    println!("Private Key:\n{}", private_key_pem);
    
    // 获取对应的公钥
    let public_key = private_key.to_public_key();
    
    // 导出PEM格式的公钥
    let public_key_pem = public_key.to_pem_str()?;
    println!("Public Key:\n{}", public_key_pem);
    
    Ok(())
}

签名和验证

use picky::key::PrivateKey;
use picky::signature::SignatureAlgorithm;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // 生成RSA密钥对
    let private_key = PrivateKey::generate_rsa(2048)?;
    let public_key = private_key.to_public_key();
    
    // 要签名的数据
    let data = b"Hello, world!";
    
    // 使用SHA-256和PKCS#1 v1.5填充方案创建签名
    let signature = private_key.sign(SignatureAlgorithm::RsaPkcs1v15Sha256, data)?;
    
    // 验证签名
    let is_valid = public_key.verify(SignatureAlgorithm::RsaPkcs1v15Sha256, data, &signature)?;
    println!("Signature is valid: {}", is_valid);
    
    Ok(())
}

JWT创建和验证

use picky::jose::jwt::{Jwt, JwtValidator, JwtHeader, JwtPayload};
use picky::key::PrivateKey;
use serde::{Deserialize, Serialize};

#[derive(Debug, Serialize, Deserialize)]
struct CustomClaims {
    user_id: String,
    is_admin: bool,
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // 生成RSA密钥对
    let private_key = PrivateKey::generate_rsa(2048)?;
    let public_key = private_key.to_public_key();
    
    // 创建JWT头部
    let header = JwtHeader::rs256();
    
    // 创建自定义claims
    let claims = CustomClaims {
        user_id: "12345".to_string(),
        is_admin: false,
    };
    
    // 创建JWT payload
    let payload = JwtPayload::new_custom(claims)?;
    
    // 签名并生成JWT
    let jwt = Jwt::sign(&private_key, &header, &payload)?;
    let jwt_str = jwt.to_string();
    println!("JWT: {}", jwt_str);
    
    // 验证JWT
    let validator = JwtValidator::new().validate_issued_at(false);
    let verified_jwt = Jwt::parse_and_verify(&jwt_str, &public_key, &validator)?;
    println!("Verified JWT: {:?}", verified_jwt);
    
    Ok(())
}

完整示例：X.509证书生成与验证

use picky::x509::certificate::{Certificate, CertificateBuilder, Name};
use picky::key::PrivateKey;
use picky::hash::HashAlgorithm;
use picky::signature::SignatureAlgorithm;
use time::{Duration, OffsetDateTime};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // 生成RSA密钥对
    let private_key = PrivateKey::generate_rsa(2048)?;
    let public_key = private_key.to_public_key();

    // 创建证书主题名称
    let subject = Name::new_builder()
        .country("CN")
        .organization("Example Inc")
        .common_name("example.com")
        .build()?;

    // 设置证书有效期（当前时间到1年后）
    let valid_from = OffsetDateTime::now_utc();
    let valid_to = valid_from + Duration::days(365);

    // 创建X.509证书
    let cert = CertificateBuilder::new()
        .validity(valid_from, valid_to)
        .self_signed(
            &subject,
            SignatureAlgorithm::RsaPkcs1v15Sha256,
            &private_key,
        )?
        .build();

    // 导出PEM格式的证书
    let cert_pem = cert.to_pem_str()?;
    println!("Certificate:\n{}", cert_pem);

    // 验证证书签名
    let is_valid = cert.verify_signature(&public_key)?;
    println!("Certificate signature is valid: {}", is_valid);

    Ok(())
}

完整示例：HTTP消息签名

use picky::http::{
    HttpMessageSigner, HttpMessageVerifier, HttpMessage, HttpSignatureAlgorithm
};
use picky::key::PrivateKey;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // 生成RSA密钥对
    let private_key = PrivateKey::generate_rsa(2048)?;
    let public_key = private_key.to_public_key();

    // 创建HTTP消息
    let mut message = HttpMessage::new();
    message.insert_header("Host", "example.com");
    message.insert_header("Date", "Tue, 20 Apr 2021 02:07:55 GMT");
    message.set_body(b"Hello, world!");

    // 创建签名器
    let signer = HttpMessageSigner::new(
        HttpSignatureAlgorithm::RsaPkcs1v15Sha256,
        "key1",
        &private_key,
    );

    // 签名HTTP消息
    signer.sign(&mut message)?;
    println!("Signed message:\n{:?}", message);

    // 创建验证器
    let verifier = HttpMessageVerifier::new(&public_key);

    // 验证签名
    let is_valid = verifier.verify(&message)?;
    println!("Signature is valid: {}", is_valid);

    Ok(())
}

许可证

picky采用MIT或Apache-2.0双许可证发布。