Go语言中从PEM文件加载RSA私钥并执行签名操作

package main

import (
    "crypto/rsa"
    "crypto/x509"
    "encoding/pem"
    "fmt"
    "os"
)

// parsePrivateKeyFromPEM 从PEM文件路径读取并解析RSA私钥
// 该函数会尝试解析PKCS#1和PKCS#8格式的私钥
func parsePrivateKeyFromPEM(pemFilePath string) (*rsa.PrivateKey, error) {
    // 1. 读取PEM文件内容
    privateKeyPEM, err := os.ReadFile(pemFilePath)
    if err != nil {
        return nil, fmt.Errorf("failed to read private key file: %w", err)
    }

    // 2. 解码PEM块
    block, _ := pem.Decode(privateKeyPEM)
    if block == nil {
        return nil, fmt.Errorf("failed to decode PEM block containing private key")
    }

    // 3. 尝试解析PKCS#1格式的私钥
    privateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
    if err == nil {
        return privateKey, nil
    }

    // 4. 如果PKCS#1解析失败，尝试解析PKCS#8格式的私钥
    // 注意：ParsePKCS8PrivateKey返回的是interface{}，需要类型断言
    pkcs8Key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
    if err == nil {
        if pkcs8RSAKey, ok := pkcs8Key.(*rsa.PrivateKey); ok {
            return pkcs8RSAKey, nil
        }
        return nil, fmt.Errorf("parsed PKCS#8 key is not an RSA private key")
    }

    return nil, fmt.Errorf("failed to parse private key: %w", err)
}

package main

import (
    "crypto"
    "crypto/rand"
    "crypto/rsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/pem"
    "fmt"
    "os"
)

// parsePrivateKeyFromPEM ... (同上，省略重复代码)
func parsePrivateKeyFromPEM(pemFilePath string) (*rsa.PrivateKey, error) {
    privateKeyPEM, err := os.ReadFile(pemFilePath)
    if err != nil {
        return nil, fmt.Errorf("failed to read private key file: %w", err)
    }

    block, _ := pem.Decode(privateKeyPEM)
    if block == nil {
        return nil, fmt.Errorf("failed to decode PEM block containing private key")
    }

    privateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
    if err == nil {
        return privateKey, nil
    }

    pkcs8Key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
    if err == nil {
        if pkcs8RSAKey, ok := pkcs8Key.(*rsa.PrivateKey); ok {
            return pkcs8RSAKey, nil
        }
        return nil, fmt.Errorf("parsed PKCS#8 key is not an RSA private key")
    }

    return nil, fmt.Errorf("failed to parse private key: %w", err)
}

func main() {
    // --- 1. 为演示目的，生成一个临时的RSA私钥并保存为PEM文件 ---
    // 在实际应用中，您会使用已存在的privkey.pem文件
    privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
    if err != nil {
        fmt.Println("Error generating private key:", err)
        return
    }

    // 将PKCS#1格式的私钥保存到PEM文件
    privateKeyPEM := pem.EncodeToMemory(&pem.Block{
        Type:  "RSA PRIVATE KEY",
        Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
    })
    err = os.WriteFile("privkey.pem", privateKeyPEM, 0600) // 0600权限确保私钥安全
    if err != nil {
        fmt.Println("Error writing private key to file:", err)
        return
    }
    fmt.Println("Dummy 'privkey.pem' created for demonstration.")
    defer os.Remove("privkey.pem") // 演示结束后删除临时文件

    // --- 2. 从PEM文件加载私钥 ---
    loadedPrivateKey, err := parsePrivateKeyFromPEM("privkey.pem")
    if err != nil {
        fmt.Println("Error loading private key:", err)
        return
    }
    fmt.Println("Private key loaded successfully.")

    // --- 3. 准备要签名的数据 ---
    message := []byte("This is the data to be signed by the RSA private key.")
    // 对数据进行SHA256哈希
    hashed := sha256.Sum256(message)

    // --- 4. 使用私钥执行签名操作 (等同于C++/Python中的private_encrypt用于签名) ---
    // rsa.SignPKCS1v15 需要一个随机数源，私钥，哈希算法标识，以及哈希后的数据
    signature, err := rsa.SignPKCS1v15(rand.Reader, loadedPrivateKey, crypto.SHA256, hashed[:])
    if err != nil {
        fmt.Println("Error signing data:", err)
        return
    }
    fmt.Printf("Data signed successfully. Signature length: %d bytes\n", len(signature))

    // --- 5. (可选) 使用对应的公钥验证签名 ---
    // 验证签名需要公钥、哈希算法标识、原始哈希数据和生成的签名
    publicKey := &loadedPrivateKey.PublicKey
    err = rsa.VerifyPKCS1v15(publicKey, crypto.SHA256, hashed[:], signature)
    if err != nil {
        fmt.Println("Signature verification failed:", err)
    } else {
        fmt.Println("Signature verified successfully.")
    }

    // --- 6. (可选) 如果“私钥加密”指的是解密操作 ---
    // 假设数据是使用公钥加密的，现在用私钥解密
    // encryptedBytes, err := rsa.EncryptPKCS1v15(rand.Reader, publicKey, message)
    // if err != nil {
    //  fmt.Println("Error encrypting with public key:", err)
    //  return
    // }
    // fmt.Println("Data encrypted with public key.")

    // decryptedBytes, err := rsa.DecryptPKCS1v15(rand.Reader, loadedPrivateKey, encryptedBytes)
    // if err != nil {
    //  fmt.Println("Error decrypting with private key:", err)
    //  return
    // }
    // fmt.Printf("Data decrypted with private key: %s\n", string(decryptedBytes))
}