Go语言实现OpenPGP公钥认证与数据加解密指南

package main

import (
    "bytes"
    "fmt"
    "io"
    "io/ioutil"
    "log"
    "strings"

    "golang.org/x/crypto/openpgp"
    "golang.org/x/crypto/openpgp/armor"
    "golang.org/x/crypto/openpgp/packet"
)

// 模拟生成一个密钥对，实际应用中会从文件加载
func generateTestKey(name, email, comment, passphrase string) (*openpgp.Entity, error) {
    config := &packet.Config{
        DefaultHash:            packet.HashSHA256,
        DefaultCipher:          packet.CipherAES256,
        DefaultCompressionAlgo: packet.CompressionZLIB,
    }
    entity, err := openpgp.NewEntity(name, comment, email, config)
    if err != nil {
        return nil, err
    }
    // 为私钥设置密码
    if passphrase != "" {
        err = entity.PrivateKey.Encrypt([]byte(passphrase))
        if err != nil {
            return nil, err
        }
    }
    return entity, nil
}

// loadKeyRingFromReader 从 io.Reader 加载密钥环
func loadKeyRingFromReader(reader io.Reader) (openpgp.EntityList, error) {
    return openpgp.ReadKeyRing(reader)
}

// loadArmoredKeyRingFromReader 从 io.Reader 加载 ASCII Armored 格式的密钥环
func loadArmoredKeyRingFromReader(reader io.Reader) (openpgp.EntityList, error) {
    return openpgp.ReadArmoredKeyRing(reader)
}

func main() {
    // 示例：生成一个密钥并将其序列化为 Armored 格式
    testKey, err := generateTestKey("Test User", "test@example.com", "Generated for demo", "test_passphrase")
    if err != nil {
        log.Fatalf("Failed to generate test key: %v", err)
    }

    // 将公钥序列化为 Armored 字符串
    publicKeyBuf := new(bytes.Buffer)
    pubWriter, err := armor.Encode(publicKeyBuf, openpgp.PublicKeyType, nil)
    if err != nil {
        log.Fatalf("Failed to create public key armor writer: %v", err)
    }
    if err := testKey.Serialize(pubWriter); err != nil {
        log.Fatalf("Failed to serialize public key: %v", err)
    }
    pubWriter.Close()
    armoredPublicKey := publicKeyBuf.String()
    fmt.Println("--- Generated Armored Public Key ---")
    fmt.Println(armoredPublicKey)

    // 将私钥序列化为 Armored 字符串
    privateKeyBuf := new(bytes.Buffer)
    privWriter, err := armor.Encode(privateKeyBuf, openpgp.PrivateKeyType, nil)
    if err != nil {
        log.Fatalf("Failed to create private key armor writer: %v", err)
    }
    // 注意：这里序列化私钥时不需要提供 passphrase，因为之前已经加密过
    if err := testKey.SerializePrivate(privWriter, nil); err != nil {
        log.Fatalf("Failed to serialize private key: %v", err)
    }
    privWriter.Close()
    armoredPrivateKey := privateKeyBuf.String()
    fmt.Println("\n--- Generated Armored Private Key ---")
    fmt.Println(armoredPrivateKey)


    // 从 Armored 字符串加载密钥环
    keyRingReader := strings.NewReader(armoredPublicKey + "\n" + armoredPrivateKey) // 模拟一个包含公私钥的密钥环
    loadedKeyRing, err := loadArmoredKeyRingFromReader(keyRingReader)
    if err != nil {
        log.Fatalf("Failed to load armored keyring: %v", err)
    }
    fmt.Printf("\nLoaded %d entities into keyring.\n", len(loadedKeyRing))
}

// findKeyByUserID 从密钥环中查找包含指定用户ID的Entity
func findKeyByUserID(keyRing openpgp.EntityList, userID string) *openpgp.Entity {
    for _, entity := range keyRing {
        for _, identity := range entity.Identities {
            if strings.Contains(identity.UserId.Id, userID) {
                return entity
            }
        }
    }
    return nil
}

// findPrivateKeyByUserID 从密钥环中查找包含指定用户ID且拥有私钥的Entity
func findPrivateKeyByUserID(keyRing openpgp.EntityList, userID string) *openpgp.Entity {
    for _, entity := range keyRing {
        if entity.PrivateKey != nil { // 确保有私钥
            for _, identity := range entity.Identities {
                if strings.Contains(identity.UserId.Id, userID) {
                    return entity
                }
            }
        }
    }
    return nil
}

/*
// 在 main 函数中调用示例：
func main() {
    // ... (加载密钥环代码) ...

    // 查找公钥
    publicKey := findKeyByUserID(loadedKeyRing, "Test User")
    if publicKey != nil {
        fmt.Printf("Found public key for: %s\n", publicKey.PrimaryIdentity().UserId.Id)
    } else {
        fmt.Println("Public key not found.")
    }

    // 查找私钥
    privateKey := findPrivateKeyByUserID(loadedKeyRing, "Test User")
    if privateKey != nil {
        fmt.Printf("Found private key for: %s\n", privateKey.PrimaryIdentity().UserId.Id)
    } else {
        fmt.Println("Private key not found.")
    }
}
*/

// encryptData 使用接收者的公钥加密字节数据
func encryptData(plaintext []byte, recipients openpgp.EntityList) ([]byte, error) {
    buf := new(bytes.Buffer)
    // 第一个参数是输出Writer，第二个是接收者公钥列表，第三个是签名者私钥列表（可选），第四个是提示信息，第五个是配置
    w, err := openpgp.Encrypt(buf, recipients, nil, nil, nil)
    if err != nil {