Question

Based on关于stackoverflow的一些例子我创建了一个页面来破解和解密来自html表单的文本。但不知何故，有时候这种情况有时并非如此，通常情况下并非如此。

为什么会这样？ htmlencode是否修改了发布过程中的键？我该如何解决这个问题？我应该使用base64吗？

<?php
$key_size = mcrypt_get_key_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CFB);
$encryption_key = openssl_random_pseudo_bytes($key_size, $strong);

$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CFB);
$iv = mcrypt_create_iv($iv_size, MCRYPT_DEV_URANDOM); // 16 bytes output


if($_POST){
    $iv = $_POST["iv"];
    $encryption_key = $_POST["key"];
    $string = $_POST["msg"];


    if($_POST["do"]=="encrypt"){
        echo "crypted";
        $result = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $encryption_key, $string, MCRYPT_MODE_CFB, $iv);
    }else{
        echo "de-crypted";
        $result = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $encryption_key, $string, MCRYPT_MODE_CFB, $iv);
    }

}

?>
<div class="main" id="main">
    <form method="POST" action="">
    <input type="text" value="<?php echo $iv; ?>" name="iv"/> <br/>
    <input type="text" value="<?php echo $encryption_key; ?>" name="key"/><br/>

    <textarea name="msg"><?php echo $result; ?></textarea><br/>
    <select name="do"><option>encrypt</option><option>decrypt</option></select><br/>
    <input type="submit" value="GO"/>
    </form>

</div>

现场示例可以在@ http://lab.ohshiftlabs.com/crypt/

找到

Answer 1

以下是一些您可能会觉得有用的注释代码。我认为你的代码的主要问题是'mcrypt'例程的输出是'二进制'格式，需要以某种HTML'安全'格式编码。我用过base64。

代码已经过测试。

<?php
/*
 * PHP 5.3.18 on windows XP
 *
 * I don't have open_ssl active from PHP so used MCRYPT_RAND for the salt.
 * It is adequate for this exercise.
 *
 * As the encoded SALT and encrypted output are binary code i have converted all
 * the output to Base64 encoding to ensure it is HTML safe.
 *
 * It selects the appropriate default action in the 'do' select list.
 *
 * There is a new 'salt' generated at each encryption and the user is prevented from
 * changing it by making the display field as 'readonly'. Normally this would be a 'hidden' field'.
 *
 */

$isEncrypted = null; // used to set default output options
                     // i like to pre-declare the script 'global' variables


$key_size = mcrypt_get_key_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CFB);
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CFB);


if($_POST){ // we have some input...

    $encryption_key = $_POST["key"];
    $string = $_POST["msg"]; // this may be base64 encoded...


    if($_POST["do"]=="encrypt"){
        $isEncrypted = true; // used to set defaults

        $iv = mcrypt_create_iv($iv_size,  MCRYPT_RAND); // new salt with each encryption
        $result = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $encryption_key, $string, MCRYPT_MODE_CFB, $iv);
        $result = base64_encode($result); // $result is binary so encode as HTML safe.


    }else{
        $isEncrypted = false; // used to set defaults

        $iv = base64_decode($_POST["iv"]); // get current salt converted back to binary format
        $string = base64_decode($string); // convert encoded text back to binary string
        $result = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $encryption_key, $string, MCRYPT_MODE_CFB, $iv);
    }
}else{ // no input so create something useful...
  $isEncrypted = false; // used to set default actions

  $result = 'enter text to encrypt...'; // sample text
  $iv = mcrypt_create_iv($iv_size,  MCRYPT_RAND); // new salt
  $encryption_key = substr('testing!' . uniqid() . '!testing', 0, $key_size);
}
?>
<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>Test Encryption with base64 encoding.</title>
  </head>

  <body>
    <div class="main" id="main">

        <!-- heading -->
        <strong><?php echo $isEncrypted ? 'Encrypted' : 'Decrypted'; ?></strong><br/>

        <form method="POST" action="">

            <!-- do not allow the user to change the salt by setting 'readonly' -->
            <input type="text" value="<?php echo base64_encode($iv); ?>" readonly name="iv"/> <br/>

            <!-- supply a suggested password but the user can change it -->
            <input type="text" value="<?php echo $encryption_key; ?>" name="key"/><br/>

            <!-- either show the encoded text as HTML safe string -->
            <!--- or show as plain text -->
            <textarea name="msg" ><?php echo $result; ?></textarea><br/>

            <!-- set the appropriate action as the default -->
            <select name="do">
              <option <?php echo $isEncrypted ? 'selected' : ''; ?>>decrypt</option>
              <option <?php echo $isEncrypted ? '' : 'selected'; ?>>encrypt</option>
            </select><br/>

            <input type="submit" value="GO"/>
        </form>
    </div>
  </body>
</html>

mcrypt_encrypt或mcrypt_decrypt无法使用基本的html表单

1 个答案: