目錄

一、對稱加密
?1、對稱加密是什么
?2、對稱加密的優點
?3、對稱加密的問題
?4、對稱加密的應用場景
?5、對稱加密AES的代碼
二、非對稱加密
?1、非對稱加密是什么
?2、非對稱加密的優點
?3、非對稱加密的問題
?4、非對稱加密的應用場景
?5、非對稱加密RSA的代碼

一、對稱加密

1、對稱加密是什么

對稱加密是指加密和解密用的是同一個密鑰的加密方式。

2、對稱加密的優點

對稱加密的特點是加密計算量小、速度快。

3、對稱加密的問題

對稱加密的問題是密鑰傳輸問題，因為對稱加密的做法一般是解密方生成密鑰傳輸給加密方，加密方對明文加密，然后把密文發送給解密方，解密方使用密鑰對密文解密，得到明文，而密鑰在傳輸過程中很可能被攻擊者截獲，因此對稱加密的安全性就不僅僅取決于加密算法本身的強度，更取決于密鑰是否被安全地傳輸。

4、對稱加密的應用場景

對稱加密適用于對大量數據進行加密的場景。

5、對稱加密AES的代碼

AES（Advanced Encryption Standard），高級加密標準，是對稱加密的一種，用來代替DES、3DES。AES采用分組密碼體制，密鑰長度可以是128位16個字節、192位或256位，一共有四種加密模式。

• 分組密碼體制：所謂分組密碼體制是指AES會首先把明文切成一段一段的，每段的長度必須是128位16個字節，如果最后一段不夠16個字節了，就要用Padding來把這段數據填滿16個字節，然后分別對每段數據進行加密，最后再把每段加密數據拼接起來形成最終的密文。而Padding也有三種模式PKCS5、PKCS7和NOPADDING，PKCS5和PKCS7是指分組數據缺少幾個字節，就在數據的末尾填充幾個字節的幾，比如缺少5個字節，就在末尾填充5個字節的5；NoPadding是指不需要填充，也就是說數據的發送方肯定會保證最后一段數據也正好是16個字節。那如果在PKCS5模式下，最后一段數據的內容剛好就是16個16怎么辦？那解密端就不知道這一段數據到底是有效數據還是填充數據了，因此對于這種情況，PKCS5模式會自動幫我們在最后一段數據后再添加16個字節的數據，而且填充數據也是16個16，這樣解密段就能知道誰是有效數據誰是填充數據了。解密方需要使用和加密方同樣的Padding模式，才能準確的識別有效數據和填充數據，我們開發通常采用PKCS7 Padding模式。

• 密鑰：AES要求密鑰長度可以是128位16個字節、192位或者256位，位數越高，加密強度自然越大，但是加密的效率自然會低一些。我們開發通常采用128位16個字節的密鑰，密鑰來源為服務端隨機生成、然后發送給客戶端，解密方需要使用和加密方同樣的密鑰。

• 加密模式：AES一共有四種加密模式，分別是ECB（電子密碼本模式）、CBC（密碼分組鏈接模式）、CFB、OFB，我們通常采用CBC加密模式，解密方需要使用和加密方同樣的加密模式。

ECB模式：最基本的加密模式，即僅僅使用明文和密鑰來加密數據，相同的明文塊會被加密成相同的密文塊，這樣明文和密文的結構將是完全一樣的，就會更容易被破解，相對來說不是那么安全，因此很少使用。

CBC模式：比ECB模式多了一個初始向量IV，加密的時候，第一個明文塊會首先和初始向量IV做異或操作，然后再經過密鑰加密，然后第一個密文塊又會作為第二個明文塊的加密向量來異或，依次類推下去，這樣相同的明文塊加密出的密文塊就是不同的，明文的結構和密文的結構也將是不同的，因此更加安全，我們常用的就是CBC加密模式。

//
//  EncryptUtil.h
//

#import <Foundation/Foundation.h>

@interface EncryptUtil : NSObject

/**
 * AES128加密，輸出Base64編碼
 *
 * @param plainText 明文
 * @param secretKey 密鑰
 *
 * @return 密文
 */
+ (NSString *)aes128CiphertextFromString:(NSString *)plainText secretKey:(NSString *)secretKey iv:(NSString *)iv;

/**
 * AES128解密，輸入Base64編碼
 *
 * @param ciphertext 密文
 * @param secretKey 密鑰
 *
 * @return 明文
 */
+ (NSString *)aes128PlainTextFromString:(NSString *)ciphertext secretKey:(NSString *)secretKey iv:(NSString *)iv;

@end

//
//  EncryptUtil.m
//

#import "EncryptUtil.h"
#import <CommonCrypto/CommonCryptor.h>

@implementation EncryptUtil

+ (NSString *)aes128CiphertextFromString:(NSString *)plainText secretKey:(NSString *)secretKey {
    
    char keyPtr[kCCKeySizeAES128 + 1];
    memset(keyPtr, 0, sizeof(keyPtr));
    [secretKey getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];
    
    NSData *data = [plainText dataUsingEncoding:NSUTF8StringEncoding];
    NSUInteger dataLength = [data length];
    
    int diff = kCCKeySizeAES128 - (dataLength % kCCKeySizeAES128);
    NSUInteger newSize = 0;
    
    if(diff > 0) {
        
        newSize = dataLength + diff;
    }
    
    char dataPtr[newSize];
    memcpy(dataPtr, [data bytes], [data length]);
    for(int i = 0; i < diff; i ++) {
        
        dataPtr[i + dataLength] = 0x00;
    }
    
    size_t bufferSize = newSize + kCCBlockSizeAES128;
    void *buffer = malloc(bufferSize);
    memset(buffer, 0, bufferSize);
    
    size_t numBytesCrypted = 0;
    
    CCCryptorStatus cryptStatus = CCCrypt(kCCEncrypt, // 加密
                                          kCCAlgorithmAES128, // AES128加密
                                          kCCOptionPKCS7Padding, // PKCS7 Padding模式，默認CBC加密模式
                                          keyPtr, // 密鑰
                                          kCCKeySizeAES128, // 密鑰長度
                                          NULL, // 初始向量
                                          dataPtr,
                                          sizeof(dataPtr),
                                          buffer,
                                          bufferSize,
                                          &numBytesCrypted);
    if (cryptStatus == kCCSuccess) {
        
        NSData *resultData = [NSData dataWithBytesNoCopy:buffer length:numBytesCrypted];
        // 轉換成Base64并返回
        return [resultData base64EncodedStringWithOptions:NSDataBase64EncodingEndLineWithLineFeed];
    }
    free(buffer);
    return nil;
}

+ (NSString *)aes128PlainTextFromString:(NSString *)ciphertext secretKey:(NSString *)secretKey {
    
    char keyPtr[kCCKeySizeAES128 + 1];
    memset(keyPtr, 0, sizeof(keyPtr));
    [secretKey getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];
    
    NSData *data = [[NSData alloc] initWithBase64EncodedData:[ciphertext dataUsingEncoding:NSUTF8StringEncoding] options:NSDataBase64DecodingIgnoreUnknownCharacters];
    NSUInteger dataLength = [data length];
    size_t bufferSize = dataLength + kCCBlockSizeAES128;
    void *buffer = malloc(bufferSize);
    
    size_t numBytesCrypted = 0;
    CCCryptorStatus cryptStatus = CCCrypt(kCCDecrypt, // 解密
                                          kCCAlgorithmAES128,
                                          kCCOptionPKCS7Padding,
                                          keyPtr,
                                          kCCBlockSizeAES128,
                                          NULL,
                                          [data bytes],
                                          dataLength,
                                          buffer,
                                          bufferSize,
                                          &numBytesCrypted);
    if (cryptStatus == kCCSuccess) {
        
        NSData *resultData = [NSData dataWithBytesNoCopy:buffer length:numBytesCrypted];
        // 轉換成普通字符串并返回
        return [[NSString alloc] initWithData:resultData encoding:NSUTF8StringEncoding];
    }
    free(buffer);
    return nil;
}

@end

二、非對稱加密

1、非對稱加密是什么

非對稱加密是指加密和解密用的不是同一個密鑰的加密方式。

2、非對稱加密的優點

非對稱加密的特點是不存在密鑰傳輸問題，因為非對稱加密的做法一般是解密方生成一對兒公私鑰，自己保留私鑰，把公鑰公開，加密方拿到公鑰對明文加密，然后把密文發送給解密方，解密方使用私鑰對密文解密，得到明文，所以公鑰是隨便你什么人來拿都行、反正也是用來加密的、又不是用來解密的——即就算被截獲了也不怕，只要保管好私鑰就可以了。

3、非對稱加密的問題

非對稱加密的問題是加密計算量大、速度慢。

4、非對稱加密的應用場景

非對稱加密適用于對少量數據進行加密的場景。

5、非對稱加密RSA的代碼

RSA加密是非對稱加密的一種，密鑰長度一般是1024位或2048位。iOS中使用RSA加密解密，需要用到.der文件和.p12文件。其中.der文件存放的是公鑰、用于加密，.p12文件存放的是私鑰、用于解密。首先我們需要生成這些必要的文件（openssl是SSL/TLS協議的開源實現，可以用來生成公鑰私鑰、自簽名證書等）：

// 1、指定文件的存儲路徑
打開終端，cd一個文件夾

// 2、生成模長為1024位的私鑰文件private_key.pem
openssl genrsa -out private_key.pem 1024

// 3、生成證書請求文件rsaCertReq.csr    
// 注意：這一步會提示輸入國家、省份、郵箱等信息，可以根據實際情況選擇性填寫
openssl req -new -key private_key.pem -out rsaCerReq.csr

// 4、生成證書rsaCert.crt，并設置有效時間為10年
openssl x509 -req -days 3650 -in rsaCerReq.csr -signkey private_key.pem -out rsaCert.crt

// 5、生成供iOS使用的公鑰文件public_key.der
openssl x509 -outform der -in rsaCert.crt -out public_key.der

// 6、生成供iOS使用的私鑰文件private_key.p12  
// 注意：這一步會提示給私鑰文件設置密碼，保存下來。iOS代碼里在解密時，private_key.p12文件需要和這里設置的密碼配合使用
openssl pkcs12 -export -out private_key.p12 -inkey private_key.pem -in rsaCert.crt

// 7、生成供Java使用的公鑰rsa_public_key.pem
openssl rsa -in private_key.pem -out rsa_public_key.pem -pubout

// 8、生成供Java使用的私鑰pkcs8_private_key.pem
openssl pkcs8 -topk8 -in private_key.pem -out pkcs8_private_key.pem -nocrypt

// 9、使用文件
這時到指定的文件夾下就可以看到七個文件，
其中public_key.der和private_key.p12這對兒公私鑰是供iOS使用的，拖到項目里，
rsa_public_key.pem和pkcs8_private_key.pem這對兒公私鑰是供Java使用的，發給他們
它們的根源都來自一個私鑰private_key.pem，所以iOS端加密的數據后臺可以解密，反過來同理。

//
//  WYRSAEncryptTools.h
//  WYEncryptDemo
//
//  Created by Mac mini on 16/8/23.
//  Copyright ? 2016年 yiyi. All rights reserved.
//

#import <Foundation/Foundation.h>

@interface WYRSAEncryptTools : NSObject

// 當我們使用 openssl 生成公鑰和私鑰之后, 把我們前端需要持有那對文件拖進工程里, 然后使用這個工具類里的幾個方法操作起來就 ok 了


#pragma mark - 加載公鑰和私鑰
/**
 *  加載公鑰
 *
 *  @param  string  公鑰文件路徑
 */
+ (void)loadPublicKeyWithFilePathString:(NSString *)string;

/**
 *  加載私鑰
 *
 *  @param  string  私鑰文件路徑
 *  @param  string  創建私鑰時的密碼
 */
+ (void)loadPrivateKeyWithFilePathString:(NSString *)string
                                password:(NSString*)password;


#pragma mark - 公鑰加密

/**
 *  用來加密字符串
 *
 *  @param  string  明文
 *
 *  return  密文, base64 碼
 */
+ (NSString *)rsaEncryptSourceString:(NSString *)string;

/**
 *  用來加密二進制數據
 *
 *  @param  string  明文
 *
 *  return  密文
 */
+ (NSData *)rsaEncryptSourceData:(NSData *)data;


#pragma mark - 私鑰解密

/**
 *  用來解密字符串密文
 *
 *  @param  string  密文
 *
 *  return  明文
 */
+ (NSString *)rsaDecryptDecryptString:(NSString *)string;

/**
 *  用來解密二進制數據密文
 *
 *  @param  data    密文
 *
 *  return  明文
 */
+ (NSData *)rsaDecryptDecryptData:(NSData *)data;

@end

//
//  WYRSAEncryptTools.m
//  WYEncryptDemo
//
//  Created by Mac mini on 16/8/23.
//  Copyright ? 2016年 yiyi. All rights reserved.
//

#import "WYRSAEncryptTools.h"
#import <Security/Security.h>

static SecKeyRef publicKeyRef = nil;
static SecKeyRef privateKeyRef = nil;

@implementation WYRSAEncryptTools

+ (void)loadPublicKeyWithFilePathString:(NSString *)string {
    
    NSData *derData = [[NSData alloc] initWithContentsOfFile:string];
    
    [WYRSAEncryptTools getPublicKeyRefrenceFromeData:derData];
}

+ (void)loadPrivateKeyWithFilePathString:(NSString *)string
                                password:(NSString*)password {
    
    NSData *p12Data = [NSData dataWithContentsOfFile:string];
    
    [WYRSAEncryptTools getPrivateKeyRefrenceFromData:p12Data password:password];
}

+ (NSString *)rsaEncryptSourceString:(NSString *)string {
    
    NSData *data = [WYRSAEncryptTools rsaEncryptSourceData:[string dataUsingEncoding:NSUTF8StringEncoding]];
    
    NSString *encryptString = base64_encode_data(data);
    
    return encryptString;
}

+ (NSData *)rsaEncryptSourceData:(NSData *)data {
    
    if (!data){
        
        return nil;
    }

    if (!publicKeyRef) {
        
        return nil;
    }
    
    return [WYRSAEncryptTools encryptData:data withKeyRef:publicKeyRef];
}

+ (NSString *)rsaDecryptDecryptString:(NSString *)string {
    
    NSData *data = [[NSData alloc] initWithBase64EncodedString:string options:NSDataBase64DecodingIgnoreUnknownCharacters];
    data = [WYRSAEncryptTools rsaDecryptDecryptData:data];
    
    NSString *decryptString = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    
    return decryptString;
}

+ (NSData *)rsaDecryptDecryptData:(NSData *)data {
    
    if (!data){
        
        return nil;
    }

    if (!privateKeyRef) {
        
        return nil;
    }
    
    return [WYRSAEncryptTools decryptData:data withKeyRef:privateKeyRef];
}

+ (NSString *)rsaVerifyDecryptString:(NSString *)string {
    
    NSData *data = [[NSData alloc] initWithBase64EncodedString:string options:NSDataBase64DecodingIgnoreUnknownCharacters];
    
    data = [WYRSAEncryptTools rsaVerifyDecryptData:data];
    
    NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    
    return ret;
}

+ (NSData *)rsaVerifyDecryptData:(NSData *)data {
    
    if (!data) {
        
        return nil;
    }

    if (!publicKeyRef) {
        
        return nil;
    }
    
    return [WYRSAEncryptTools decryptData:data withKeyRef:publicKeyRef];
}

//static NSString *base64_encode(NSString *str){
//    NSData* data = [str dataUsingEncoding:NSUTF8StringEncoding];
//    if(!data){
//        return nil;
//    }
//    return base64_encode_data(data);
//}

static NSString *base64_encode_data(NSData *data){
    data = [data base64EncodedDataWithOptions:0];
    NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    return ret;
}

static NSData *base64_decode(NSString *str){
    NSData *data = [[NSData alloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters];
    return data;
}

+ (NSData *)stripPublicKeyHeader:(NSData *)d_key{
    // Skip ASN.1 public key header
    if (d_key == nil) return(nil);
    
    unsigned long len = [d_key length];
    if (!len) return(nil);
    
    unsigned char *c_key = (unsigned char *)[d_key bytes];
    unsigned int  idx    = 0;
    
    if (c_key[idx++] != 0x30) return(nil);
    
    if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
    else idx++;
    
    // PKCS #1 rsaEncryption szOID_RSA_RSA
    static unsigned char seqiod[] =
    { 0x30,   0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
        0x01, 0x05, 0x00 };
    if (memcmp(&c_key[idx], seqiod, 15)) return(nil);
    
    idx += 15;
    
    if (c_key[idx++] != 0x03) return(nil);
    
    if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
    else idx++;
    
    if (c_key[idx++] != '\0') return(nil);
    
    // Now make a new NSData from this buffer
    return([NSData dataWithBytes:&c_key[idx] length:len - idx]);
}

//credit: http://hg.mozilla.org/services/fx-home/file/tip/Sources/NetworkAndStorage/CryptoUtils.m#l1036
+ (NSData *)stripPrivateKeyHeader:(NSData *)d_key{
    // Skip ASN.1 private key header
    if (d_key == nil) return(nil);
    
    unsigned long len = [d_key length];
    if (!len) return(nil);
    
    unsigned char *c_key = (unsigned char *)[d_key bytes];
    unsigned int  idx    = 22; //magic byte at offset 22
    
    if (0x04 != c_key[idx++]) return nil;
    
    //calculate length of the key
    unsigned int c_len = c_key[idx++];
    int det = c_len & 0x80;
    if (!det) {
        c_len = c_len & 0x7f;
    } else {
        int byteCount = c_len & 0x7f;
        if (byteCount + idx > len) {
            //rsa length field longer than buffer
            return nil;
        }
        unsigned int accum = 0;
        unsigned char *ptr = &c_key[idx];
        idx += byteCount;
        while (byteCount) {
            accum = (accum << 8) + *ptr;
            ptr++;
            byteCount--;
        }
        c_len = accum;
    }
    
    // Now make a new NSData from this buffer
    return [d_key subdataWithRange:NSMakeRange(idx, c_len)];
}

+ (SecKeyRef)addPublicKey:(NSString *)key{
    NSRange spos = [key rangeOfString:@"-----BEGIN PUBLIC KEY-----"];
    NSRange epos = [key rangeOfString:@"-----END PUBLIC KEY-----"];
    if(spos.location != NSNotFound && epos.location != NSNotFound){
        NSUInteger s = spos.location + spos.length;
        NSUInteger e = epos.location;
        NSRange range = NSMakeRange(s, e-s);
        key = [key substringWithRange:range];
    }
    key = [key stringByReplacingOccurrencesOfString:@"\r" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\n" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\t" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@" "  withString:@""];
    
    // This will be base64 encoded, decode it.
    NSData *data = base64_decode(key);
    data = [WYRSAEncryptTools stripPublicKeyHeader:data];
    if(!data){
        return nil;
    }
    
    //a tag to read/write keychain storage
    NSString *tag = @"WYRSAEncryptTools_PubKey";
    NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];
    
    // Delete any old lingering key with the same tag
    NSMutableDictionary *publicKey = [[NSMutableDictionary alloc] init];
    [publicKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
    [publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    [publicKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
    SecItemDelete((__bridge CFDictionaryRef)publicKey);
    
    // Add persistent version of the key to system keychain
    [publicKey setObject:data forKey:(__bridge id)kSecValueData];
    [publicKey setObject:(__bridge id) kSecAttrKeyClassPublic forKey:(__bridge id)
     kSecAttrKeyClass];
    [publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)
     kSecReturnPersistentRef];
    
    CFTypeRef persistKey = nil;
    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)publicKey, &persistKey);
    if (persistKey != nil){
        CFRelease(persistKey);
    }
    if ((status != noErr) && (status != errSecDuplicateItem)) {
        return nil;
    }
    
    [publicKey removeObjectForKey:(__bridge id)kSecValueData];
    [publicKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
    [publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
    [publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    
    // Now fetch the SecKeyRef version of the key
    SecKeyRef keyRef = nil;
    status = SecItemCopyMatching((__bridge CFDictionaryRef)publicKey, (CFTypeRef *)&keyRef);
    if(status != noErr){
        return nil;
    }
    return keyRef;
}

+ (SecKeyRef)addPrivateKey:(NSString *)key{
    NSRange spos = [key rangeOfString:@"-----BEGIN RSA PRIVATE KEY-----"];
    NSRange epos = [key rangeOfString:@"-----END RSA PRIVATE KEY-----"];
    if(spos.location != NSNotFound && epos.location != NSNotFound){
        NSUInteger s = spos.location + spos.length;
        NSUInteger e = epos.location;
        NSRange range = NSMakeRange(s, e-s);
        key = [key substringWithRange:range];
    }
    key = [key stringByReplacingOccurrencesOfString:@"\r" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\n" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\t" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@" "  withString:@""];
    
    // This will be base64 encoded, decode it.
    NSData *data = base64_decode(key);
    data = [WYRSAEncryptTools stripPrivateKeyHeader:data];
    if(!data){
        return nil;
    }
    
    //a tag to read/write keychain storage
    NSString *tag = @"WYRSAEncryptTools_PrivKey";
    NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];
    
    // Delete any old lingering key with the same tag
    NSMutableDictionary *privateKey = [[NSMutableDictionary alloc] init];
    [privateKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
    [privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    [privateKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
    SecItemDelete((__bridge CFDictionaryRef)privateKey);
    
    // Add persistent version of the key to system keychain
    [privateKey setObject:data forKey:(__bridge id)kSecValueData];
    [privateKey setObject:(__bridge id) kSecAttrKeyClassPrivate forKey:(__bridge id)
     kSecAttrKeyClass];
    [privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)
     kSecReturnPersistentRef];
    
    CFTypeRef persistKey = nil;
    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)privateKey, &persistKey);
    if (persistKey != nil){
        CFRelease(persistKey);
    }
    if ((status != noErr) && (status != errSecDuplicateItem)) {
        return nil;
    }
    
    [privateKey removeObjectForKey:(__bridge id)kSecValueData];
    [privateKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
    [privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
    [privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    
    // Now fetch the SecKeyRef version of the key
    SecKeyRef keyRef = nil;
    status = SecItemCopyMatching((__bridge CFDictionaryRef)privateKey, (CFTypeRef *)&keyRef);
    if(status != noErr){
        return nil;
    }
    return keyRef;
}

/* START: Encryption & Decryption with RSA private key */

+ (NSData *)encryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef{
    const uint8_t *srcbuf = (const uint8_t *)[data bytes];
    size_t srclen = (size_t)data.length;
    
    size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
    void *outbuf = malloc(block_size);
    size_t src_block_size = block_size - 11;
    
    NSMutableData *ret = [[NSMutableData alloc] init];
    for(int idx=0; idx<srclen; idx+=src_block_size){
        //NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
        size_t data_len = srclen - idx;
        if(data_len > src_block_size){
            data_len = src_block_size;
        }
        
        size_t outlen = block_size;
        OSStatus status = noErr;
        status = SecKeyEncrypt(keyRef,
                               kSecPaddingPKCS1,
                               srcbuf + idx,
                               data_len,
                               outbuf,
                               &outlen
                               );
        if (status != 0) {
            NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
            ret = nil;
            break;
        }else{
            [ret appendBytes:outbuf length:outlen];
        }
    }
    
    free(outbuf);
    CFRelease(keyRef);
    return ret;
}

+ (NSString *)encryptString:(NSString *)str privateKey:(NSString *)privKey{
    NSData *data = [WYRSAEncryptTools encryptData:[str dataUsingEncoding:NSUTF8StringEncoding] privateKey:privKey];
    NSString *ret = base64_encode_data(data);
    return ret;
}

+ (NSData *)encryptData:(NSData *)data privateKey:(NSString *)privKey{
    if(!data || !privKey){
        return nil;
    }
    SecKeyRef keyRef = [WYRSAEncryptTools addPrivateKey:privKey];
    if(!keyRef){
        return nil;
    }
    return [WYRSAEncryptTools encryptData:data withKeyRef:keyRef];
}

+ (NSData *)decryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef{
    const uint8_t *srcbuf = (const uint8_t *)[data bytes];
    size_t srclen = (size_t)data.length;
    
    size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
    UInt8 *outbuf = malloc(block_size);
    size_t src_block_size = block_size;
    
    NSMutableData *ret = [[NSMutableData alloc] init];
    for(int idx=0; idx<srclen; idx+=src_block_size){
        //NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
        size_t data_len = srclen - idx;
        if(data_len > src_block_size){
            data_len = src_block_size;
        }
        
        size_t outlen = block_size;
        OSStatus status = noErr;
        status = SecKeyDecrypt(keyRef,
                               kSecPaddingNone,
                               srcbuf + idx,
                               data_len,
                               outbuf,
                               &outlen
                               );
        if (status != 0) {
            NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
            ret = nil;
            break;
        }else{
            //the actual decrypted data is in the middle, locate it!
            int idxFirstZero = -1;
            int idxNextZero = (int)outlen;
            for ( int i = 0; i < outlen; i++ ) {
                if ( outbuf[i] == 0 ) {
                    if ( idxFirstZero < 0 ) {
                        idxFirstZero = I;
                    } else {
                        idxNextZero = I;
                        break;
                    }
                }
            }
            
            [ret appendBytes:&outbuf[idxFirstZero+1] length:idxNextZero-idxFirstZero-1];
        }
    }
    
    free(outbuf);
    CFRelease(keyRef);
    return ret;
}

+ (void)getPublicKeyRefrenceFromeData:(NSData*)derData {
    
    SecCertificateRef myCertificate = SecCertificateCreateWithData(kCFAllocatorDefault, (__bridge CFDataRef)derData);
    SecPolicyRef myPolicy = SecPolicyCreateBasicX509();
    SecTrustRef myTrust;
    OSStatus status = SecTrustCreateWithCertificates(myCertificate,myPolicy,&myTrust);
    SecTrustResultType trustResult;
    if (status == noErr) {
        status = SecTrustEvaluate(myTrust, &trustResult);
    }
    SecKeyRef securityKey = SecTrustCopyPublicKey(myTrust);
    CFRelease(myCertificate);
    CFRelease(myPolicy);
    CFRelease(myTrust);
    
    publicKeyRef = securityKey;
}

+ (void) getPrivateKeyRefrenceFromData: (NSData*)p12Data password:(NSString*)password{
    SecKeyRef securityKey = NULL;
    NSMutableDictionary * options = [[NSMutableDictionary alloc] init];
    [options setObject: password forKey:(__bridge id)kSecImportExportPassphrase];
    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
    OSStatus securityError = SecPKCS12Import((__bridge CFDataRef) p12Data, (__bridge CFDictionaryRef)options, &items);
    if (securityError == noErr && CFArrayGetCount(items) > 0) {
        CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items, 0);
        SecIdentityRef identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
        securityError = SecIdentityCopyPrivateKey(identityApp, &securityKey);
        if (securityError != noErr) {
            securityKey = NULL;
        }
    }
    CFRelease(items);
    
    privateKeyRef = securityKey;
}

@end

參考

1、AES加密原理：十分鐘讀懂AES加密算法
2、RSA加密原理：RSA加密算法原理（一）、RSA加密算法原理（二）