feat: 新增安全设备 Demo 及 Android 端 TEE 加解密模块

springboot-server/src/main/java/com/secure/demo/crypto/RsaUtil.java

@@ -0,0 +1,61 @@
+package com.secure.demo.crypto;
+
+import java.security.KeyFactory;
+import java.security.PublicKey;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.Base64;
+import javax.crypto.Cipher;
+
+/**
+ * RSA 工具类
+ * 
+ * 与 Android 端 DeviceCrypto 配套：
+ * - Android Keystore 生成 RSA-2048 密钥对
+ * - 私钥在 TEE 中不可导出
+ * - 公钥上传服务端，用于加密下发数据
+ * 
+ * 用途：
+ * - 加密 Recovery Token（设备恢复时下发）
+ * - 加密 DEK（恢复后逐张照片下发）
+ */
+public class RsaUtil {
+
+    private static final String KEY_ALGO = "RSA";
+    private static final String TRANSFORMATION = "RSA/ECB/OAEPWithSHA-256AndMGF1Padding";
+
+    private RsaUtil() {}
+
+    /**
+     * Base64 公钥 → PublicKey 对象
+     */
+    public static PublicKey publicKeyFromBase64(String publicKeyBase64) {
+        try {
+            byte[] keyBytes = Base64.getDecoder().decode(publicKeyBase64);
+            X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
+            KeyFactory kf = KeyFactory.getInstance(KEY_ALGO);
+            return kf.generatePublic(spec);
+        } catch (Exception e) {
+            throw new RuntimeException("Parse RSA public key failed", e);
+        }
+    }
+
+    /**
+     * 用设备 RSA 公钥加密数据
+     */
+    public static byte[] encryptWithPublicKey(byte[] data, PublicKey publicKey) {
+        try {
+            Cipher cipher = Cipher.getInstance(TRANSFORMATION);
+            cipher.init(Cipher.ENCRYPT_MODE, publicKey);
+            return cipher.doFinal(data);
+        } catch (Exception e) {
+            throw new RuntimeException("RSA encrypt failed", e);
+        }
+    }
+
+    /**
+     * 用设备 RSA 公钥加密 → Base64 字符串
+     */
+    public static String encryptBase64(byte[] data, PublicKey publicKey) {
+        return Base64.getEncoder().encodeToString(encryptWithPublicKey(data, publicKey));
+    }
+}