Question

我遇到命令行工具openssl的问题，或者我的C ++代码有问题。我不知道哪个是不正确的，但是当我使用两种方法从passphase和salt生成一个密钥和IV时，我得不到相同的key / IV值。你能看到的代码或命令行是否有任何拼写错误或问题？ openssl 0.9.8i的版本是否已损坏？我使用的nround值为1，因为命令行无法传递迭代计数值。它应该匹配，但它不是，我无法发现我的错误。

-----------------以下代码正确加密字符串XYZ为2OG7CNt / SjFEZ4RM3ZS4ZA ==使用密钥：eaa4d33f9f6a9a8e543c0ae80eef651b675ef50682e5f144f1c140269531ddb2 IV：e94c989252a82fcb6b934752c0f3702b ----

EVP_CIPHER_CTX ctx;
unsigned char acOutbuf[cMaxEncryptLen + EVP_MAX_BLOCK_LENGTH + 1];
int nOutLen;
std::string strDecrypt;

// Key and IV values.
const unsigned char pcCode[] = "f7bUtborBWdBIUkZuLr9oVGzGsc7Y6AMMe7U3z+AQo8";
const unsigned char pcSalt[] = {0x78,0x01,0x3E,0x00,0xD8,0x04,0x3E,0x00};
unsigned char acKey[EVP_MAX_KEY_LENGTH + 1];
unsigned char acIV[EVP_MAX_IV_LENGTH + 1];

// Load all the encryption ciphers and lookup the one we want to use.
OpenSSL_add_all_algorithms();
const EVP_CIPHER *cipher = EVP_get_cipherbyname("aes-256-cbc");

// Generate HashKey for the password.
int nrounds = 1;
int nCnt = EVP_BytesToKey(cipher, EVP_sha1(), pcSalt, pcCode, sizeof(pcCode), nrounds, acKey, acIV);

char *pcPassword = const_cast<char *> (strPassword.c_str());
nBase64DecodeCnt = strPassword.length();

EVP_CIPHER_CTX_init(&ctx);

EVP_CipherInit_ex(&ctx, cipher, NULL, acKey, acIV, 1);
if(!EVP_CipherUpdate(&ctx, acOutbuf, &nOutLen, (const unsigned char *) pcPassword, nBase64DecodeCnt))
{
    EVP_CIPHER_CTX_cleanup(&ctx);
    return strDecrypt;
}
if(!EVP_CipherFinal_ex(&ctx, acOutbuf, &nOutLen))
{
    EVP_CIPHER_CTX_cleanup(&ctx);
    return strDecrypt;
}

strDecrypt.assign((const char *) acOutbuf, nOutLen);

EVP_CIPHER_CTX_cleanup(&ctx);
return strDecrypt;

-----------------以下代码解密2OG7CNt / SjFEZ4RM3ZS4ZA ==作为XYZ ------------------- ----

EVP_CIPHER_CTX ctx;
unsigned char acOutbuf[cMaxEncryptLen + EVP_MAX_BLOCK_LENGTH + 1];
int nOutLen;
std::string strDecrypt;

// Key and IV values.
const unsigned char pcCode[] = "f7bUtborBWdBIUkZuLr9oVGzGsc7Y6AMMe7U3z+AQo8";
const unsigned char pcSalt[] = {0x78,0x01,0x3E,0x00,0xD8,0x04,0x3E,0x00};
unsigned char acKey[EVP_MAX_KEY_LENGTH + 1];
unsigned char acIV[EVP_MAX_IV_LENGTH + 1];

// Load all the encryption ciphers and lookup the one we want to use.
OpenSSL_add_all_algorithms();
const EVP_CIPHER *cipher = EVP_get_cipherbyname("aes-256-cbc");

// Generate HashKey for the password.
int nrounds = 1;
int nCnt = EVP_BytesToKey(cipher, EVP_sha1(), pcSalt, pcCode, sizeof(pcCode), nrounds, acKey, acIV);

// Convert the base64 password string back into a real password.
int nBase64DecodeCnt;
char *pcPassword = Base64ToByteStream ((char *) strPassword.c_str(), (int) strPassword.length(), &nBase64DecodeCnt);

EVP_CIPHER_CTX_init(&ctx);

EVP_CipherInit_ex(&ctx, cipher, NULL, acKey, acIV, 0);
if(!EVP_CipherUpdate(&ctx, acOutbuf, &nOutLen, (const unsigned char *) pcPassword, nBase64DecodeCnt))
{
    EVP_CIPHER_CTX_cleanup(&ctx);
    return strDecrypt;
}
if(!EVP_CipherFinal_ex(&ctx, acOutbuf, &nOutLen))
{
    EVP_CIPHER_CTX_cleanup(&ctx);
    return strDecrypt;
}

strDecrypt.assign((const char *) acOutbuf, nOutLen);

EVP_CIPHER_CTX_cleanup(&ctx);
return strDecrypt;

请注意，尽管我可以使用openssl命令行工具进行解密和加密，但我似乎无法使用命令行正确生成密钥和iv。

---- Encrypts correct -----
echo -n XYZ | openssl enc -e -a -aes-256-cbc -K eaa4d33f9f6a9a8e543c0ae80eef651b675ef50682e5f144f1c140269531ddb2 -iv e94c989252a82fcb6b934752c0f3702b

Produces : 2OG7CNt/SjFEZ4RM3ZS4ZA==

---- Decrypts correct to XYZ ----

echo 2OG7CNt/SjFEZ4RM3ZS4ZA== | openssl.exe enc -d -a -aes-256-cbc -K eaa4d33f9f6a9a8e543c0ae80eef651b675ef50682e5f144f1c140269531ddb2 -iv e94c989252a82fcb6b934752c0f3702b

Produces : XYZ

-----  Does not produce the correct key and IV --------
openssl enc -aes-256-cbc -md sha1 -S 78013E00D8043E00 -P -pass pass:f7bUtborBWdBIUkZuLr9oVGzGsc7Y6AMMe7U3z+AQo8

salt=78013E00D8043E00
key=718D65A221F0B2F12B6C92B7E54501DD63A8E156E03CA0E98E73653B1D0F58E5
iv =A5FDF910766E727E2100FA09B7578685

Answer 1

似乎openssl命令行工具使用了字符指针和字符串长度。我使用的是字符数组和字符数组的大小。这从我的计算中取消了最后一个'\ 0'字符，导致我生成不同的键和IV值。更正的代码是：

{
...
    // Key and IV values.
    const char *pcCode = "f7bUtborBWdBIUkZuLr9oVGzGsc7Y6AMMe7U3z+AQo8";
    unsigned char acKey[EVP_MAX_KEY_LENGTH + 1];
    unsigned char acIV[EVP_MAX_IV_LENGTH + 1];

    // Load all the encryption ciphers and lookup the one we want to use.
    OpenSSL_add_all_algorithms();
    const EVP_CIPHER *cipher = EVP_get_cipherbyname("aes-256-cbc");
    const EVP_MD *digest = EVP_get_digestbyname("sha1");

    // Generate HashKey for the password.
    int nrounds = 1;
    int nCnt = EVP_BytesToKey(cipher, digest, Global::acDecryptSalt, (const unsigned char *) pcCode, strlen(pcCode), nrounds, acKey, acIV);

...
}

从C ++代码和命令行生成相同的Key和IV

1 个答案: