Question

我看到在RHEL7和Debian9上用cryptopp生成SHA3哈希的行为上有一个非常奇怪的差异。如果我使用SHA1或MD5哈希，则两个平台上的输出相同。我已将其简化为以下最低限度的程序：

#include <iostream>
#include <cryptopp/sha3.h>
#include <cryptopp/filters.h>
#include <cryptopp/hex.h>

using namespace CryptoPP;

int main(int argc, const char* argv[])
{
   {
      CryptoPP::SHA3_256 sha256;
      std::string hash = "";
      StringSource("", true, new HashFilter(sha256, new HexEncoder(new StringSink(hash))));
      std::cout << "hash='" << hash << "'\n";
   }
   {
      CryptoPP::SHA3_256 sha256;
      std::string hash = "";
      StringSource("{}", true, new HashFilter(sha256, new HexEncoder(new StringSink(hash))));
      std::cout << "hash='" << hash << "'\n";
   }
}

在Debian上，输出为：

hash='A7FFC6F8BF1ED76651C14756A061D662F580FF4DE43B49FA82D80A4B80F8434A'
hash='840EB7AA2A9935DE63366BACBE9D97E978A859E93DC792A0334DE60ED52F8E99'

根据https://emn178.github.io/online-tools/sha3_256.html上的在线转换器，这是正确的

但是在RHEL7上，输出是奇怪的：

hash='C5D2460186F7233C927E7DB2DCC703C0E500B653CA82273B7BFAD8045D85A470'
hash='B48D38F93EAA084033FC5970BF96E559C33C4CDC07D889AB00B4D63F9590739D'

所以我做错了什么，或者库中有错误或安装错误。

我滥用libcrytopp吗？像缺少的MessageEnd（）一样？

在RHEL7上：

>ldd ./hashtest 
    linux-vdso.so.1 =>  (0x00007ffecd1b1000)
    libcryptopp.so.6 => /lib64/libcryptopp.so.6 (0x00007f71c3707000)
    libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007f71c3400000)
    libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007f71c31ea000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f71c2e1d000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f71c2c01000)
    libm.so.6 => /lib64/libm.so.6 (0x00007f71c28ff000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f71c3e2e000)
>file /lib64/libcryptopp.so.6.0.0 
/lib64/libcryptopp.so.6.0.0: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=4a0941023c6e957077cb555536a509a0ef93bf04, stripped

在Debian上：

>ldd ./hashtest 
    linux-vdso.so.1 (0x00007ffedc5e6000)
    libcrypto++.so.6 => /usr/lib/x86_64-linux-gnu/libcrypto++.so.6 (0x00007f1d3b79a000)
    libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f1d3b418000)
    libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f1d3b201000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1d3ae62000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f1d3ac45000)
    libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f1d3a941000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f1d3bf35000)
>file /usr/lib/x86_64-linux-gnu/libcrypto++.so.6.0.0 
/usr/lib/x86_64-linux-gnu/libcrypto++.so.6.0.0: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5c6cb06479005d2ebfa40c75e5489c915d314b70, stripped

在两个平台上似乎都是v6.0.0，但是：

>apt-cache show crypto++
[snip]
Package: libcrypto++-dev
Source: libcrypto++
Version: 5.6.4-7

>yum info --enablerepo=epel cryptopp
Installed Packages
Name        : cryptopp
Arch        : x86_64
Version     : 5.6.2
Release     : 10.el7
Size        : 5.2 M
Repo        : installed
From repo   : epel
Summary     : C++ class library of cryptographic schemes
URL         : http://www.cryptopp.com/
Licence     : Boost
Description : Crypto++ Library is a free C++ class library of cryptographic schemes.
            : See http://www.cryptopp.com/ for a list of supported algorithms.
            : 
            : One purpose of Crypto++ is to act as a repository of public domain
            : (not copyrighted) source code. Although the library is copyrighted as a
            : compilation, the individual files in it are in the public domain.

Answer 1

您需要将RHEL盒至少设置为cryptopp版本5.6.4，因为这是“真实” SHA3实现的来源。在5.6.4之前，该实现使用的是“ Keccak”指定的原始填充方案被选择为SHA3基础的提案，而不是已批准的SHA3标准中定义的修改后的填充方案。

有关背景，请参见https://github.com/weidai11/cryptopp/issues/158，有关通知5.6.4中的更改，请参见https://github.com/weidai11/cryptopp底部的发行说明。

用cryptopp生成SHA3哈希的不正确行为

1 个答案: