Question

我使用此代码解密AES数据：

public static String decrypt(String ciphertext, String password)
{
    byte[] cipherdata = System.Convert.FromBase64String(ciphertext);

    byte[] iv = new byte[AESBlockSize * 4];
    Array.Copy(cipherdata, 0, iv, 0, iv.Length);

    byte[] input = new byte[cipherdata.Length - iv.Length];
    Array.Copy(cipherdata, iv.Length, input, 0, input.Length);

    Rfc2898DeriveBytes passwordDB = new Rfc2898DeriveBytes(password, iv, PBKDF2Iterations);
    byte[] keyBytes = passwordDB.GetBytes(256 / 8);

    RijndaelManaged symmetricKey = new RijndaelManaged();

    symmetricKey.Mode = CipherMode.CBC;
    symmetricKey.Padding = PaddingMode.ISO10126;

    ICryptoTransform decryptor = symmetricKey.CreateDecryptor(keyBytes, iv);

    MemoryStream memoryStream = new MemoryStream(input);
    CryptoStream cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read);

    byte[] plainTextBytes = new byte[input.Length];

    int decryptedByteCount = cryptoStream.Read(plainTextBytes, 0, plainTextBytes.Length);

    memoryStream.Close();
    cryptoStream.Close();

    return Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount);
}

如果提供了错误的密码，我会在调用Padding is invalid and cannot be removed时收到异常cryptoStream.Read。

使用错误的密码时是否有任何方法可以防止此异常，因为我正在尝试制作一个暴力破解者，并且处理异常的速度非常慢。

Answer 1

如果您只是强行进行并将PaddingMode设置为None，您将使用包含的填充解密最后一个块，您可以在识别明文时使用其他任何内容你在检查。

暴力强制时防止填充是无效的异常

1 个答案: