Question

我是Golang的新手，我已经坚持了一天这个问题。我正在尝试编写一个小代码片段，用于解密（使用AWS go sdk）之前加密的密文（使用AWS python sdk）。我没有看到任何问题这样做，因为加密值只是一个base64编码的字符串，但在尝试解密时我一直遇到此错误InvalidCiphertextException。

这是我的GO代码：

package main

import (
    "github.com/aws/aws-sdk-go/aws/session"
    "github.com/aws/aws-sdk-go/service/kms"

    "fmt"
    "os"
    "github.com/aws/aws-sdk-go/aws"
    b64 "encoding/base64"
)

func main() {
    // Initialize a session in us-west-2 that the SDK will use to load
    // credentials from the shared credentials file ~/.aws/credentials.
    sess, err := session.NewSession(&aws.Config{
        Region: aws.String("us-east-1")},
    )
    fmt.Println(err)
    // Create KMS service client
    svc := kms.New(sess)
    ciphertext_regular := "AYADeGDoLfFyXv59h9zNJFR+QcgAXwABABVhd3MtY3J5cHRvLXB1YmxpYy1rZXkAREF4ZFRKNjhiZmM3eTNoUTR3S2JsVjNwMHprNFh6NnVrUVdXRUxvMTFuVEpPRnZLODhTMm5CWUdERm85WU5XeGVaZz09AAEAB2F3cy1rbXMAS2Fybjphd3M6a21zOnVzLWVhc3QtMTo0ODIyMzQ4MTEwMDQ6a2V5L2Y0ZWFhOWZjLThlMTYtNGFkNi1iMjVkLWE2NzM3Y2E2NDg4ZQC4AQIBAHiqDEdiAJHv6/rKQOUfXvXVzNboRyJDQ7oz+NqStcjb1AGvjNtfT8oLIQ9Ju7i5TD0HAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMhZXqEceZ0lRyt8ehAgEQgDuhJmDyZ9RJS6+lPy7qSarpaXC7v1MVV0EH3r5XVpwbhTMy0/f2Clyu/OMeSfib/n5Kdkm9AjtSDLaiDgIAAAAADAAAEAAAAAAAAAAAAAAAAABOq2YQN4xM3e9IsJVfPIgi/////wAAAAEAAAAAAAAAAAAAAAEAAAAGEqHCS0KXzFEqy+P7DnpM+c82rApjbQBnMGUCMBlbseoO/TU0Ap2UZ8XTO29sErz90jRdyv/k0j/i2NNXKyYrLHSpm5+hUkSokRvgAwIxAMTt3y/x4bzv5GMmNuIoZduElik538c72dEDX43z/AQc/QKjFHm6omhuBVD+sZo9UA=="
    data, err1 := b64.StdEncoding.DecodeString(ciphertext_regular)

    // Decrypt the data
    result1, err1 := svc.Decrypt(&kms.DecryptInput{CiphertextBlob: data})

    if err1 != nil {
        fmt.Println("Got error decrypting data: ", err1)
        os.Exit(1)
    }

    blob_string := string(result1.Plaintext)

    fmt.Println(blob_string)
}

我试图在网上查找，似乎人们和我做同样的事情。（here）

完整的错误消息：

Got error decrypting data:  InvalidCiphertextException: 
    status code: 400, request id: 35f1ec73-18e3-11e8-9f54-8793fe969339

任何人都知道为什么？

Answer 1

Go开发指南分别在Go：https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/kms-example-encrypt-data.html和https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/kms-example-decrypt-blob.html中提供了加密/解密的KMS示例。

Answer 2

道格的评论不正确。

无论如何，您是否在加密期间设置加密上下文？如果是这样，这将使您的解密失败。你能发布一些加密的示例代码吗？

Answer 3

从您发布的密文中，我可以看到您使用加密上下文（如@Xibz所述）对数据进行了加密。解密数据时，需要提供相同的加密上下文。 https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#encryption-context

使用AWS解密sdk

3 个答案: