对于AES-GCM加密/解密,我试过这个,但它有一个问题。
ctx = EVP_CIPHER_CTX_new(); //Get the cipher. cipher = EVP_aes_128_gcm (); #define GCM_IV "000000000000" #define GCM_ADD "0000" #define TAG_SIZE 16 #define ENC_SIZE 64 //Encrypt the data first. //Set the cipher and context only. retv = EVP_EncryptInit (ctx, cipher, NULL, NULL); //Set the nonce and tag sizes. //Set IV length. [Optional for GCM]. retv = EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_IVLEN, strlen((const char *)GCM_IV), NULL); //Now initialize the context with key and IV. retv = EVP_EncryptInit (ctx, NULL, (const unsigned char *)keybuf, (const unsigned char *)GCM_IV); //Add Additional associated data (AAD). [Optional for GCM] retv = EVP_EncryptUpdate (ctx, NULL, (int *)&enclen, (const unsigned char *)GCM_ADD, strlen(GCM_ADD)); //Now encrypt the data. retv = EVP_EncryptUpdate (ctx, (unsigned char *)encm, (int *)&enclen, (const unsigned char *)msg, _tcslen (msg) *sizeof(Char)); //Finalize. retv = EVP_EncryptFinal (ctx, (unsigned char *)encm + enclen, (int *)&enclen2); enclen += enclen2; //Append authentication tag at the end. retv = EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_GET_TAG, TAG_SIZE, (unsigned char *)encm + enclen); //DECRYPTION PART //Now Decryption of the data. //Then decrypt the data. //Set just cipher. retv = EVP_DecryptInit(ctx, cipher, NULL, NULL); //Set Nonce size. retv = EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_IVLEN, strlen((const char *)GCM_IV), NULL); //Set Tag from the data. retv = EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_TAG, TAG_SIZE, (unsigned char *)encm + enclen); //Set key and IV (nonce). retv = EVP_DecryptInit (ctx, NULL, (const unsigned char*)keybuf, (const unsigned char *)GCM_IV); //Add Additional associated data (AAD). retv = EVP_DecryptUpdate (ctx, NULL, (int *)&declen, (const unsigned char *)GCM_ADD, strlen((const char *)GCM_ADD)); //Decrypt the data. retv = EVP_DecryptUpdate (ctx, decm, (int *)&declen, (const unsigned char *)encm, enclen); //Finalize. retv = EVP_DecryptFinal (ctx, (unsigned char*)decm + declen, (int *)&declen2);
此代码工作正常(经过一些修改)。 它正在加密和解密消息。 问题是,在解密之前修改密文时,它仍会解密文本(但是,错误)。 根据我对经过身份validation的加密的理解,在这种情况下,它不应该解密修改后的密文。
我哪里错了? 我可以使用OpenSSL的EVP接口获得任何合适的AES-GCM示例吗?
以下是每次更新调用时加密和解密128个字节的示例,例如:
int howmany, dec_success, len; const EVP_CIPHER *cipher; switch(key_len) { case 128: cipher = EVP_aes_128_gcm ();break; case 192: cipher = EVP_aes_192_gcm ();break; case 256: cipher = EVP_aes_256_gcm ();break; default:break; } // Encrypt EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); EVP_EncryptInit (ctx, cipher, KEY, IV); EVP_EncryptUpdate (ctx, NULL, &howmany, AAD, aad_len); len = 0; while(len <= in_len-128) { EVP_EncryptUpdate (ctx, CIPHERTEXT+len, &howmany, PLAINTEXT+len, 128); len+=128; } EVP_EncryptUpdate (ctx, CIPHERTEXT+len, &howmany, PLAINTEXT+len, in_len - len); EVP_EncryptFinal (ctx, TAG, &howmany); EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_GET_TAG, 16, TAG); EVP_CIPHER_CTX_free(ctx); // Decrypt ctx = EVP_CIPHER_CTX_new(); EVP_DecryptInit (ctx, cipher, KEY, IV); EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_SET_TAG, 16, ref_TAG); EVP_DecryptInit (ctx, NULL, KEY, IV); EVP_DecryptUpdate (ctx, NULL, &howmany, AAD, aad_len); len = 0; while(len <= in_len-128) { EVP_DecryptUpdate (ctx, decrypted_CT+len, &howmany, CIPHERTEXT+len, 128); len+=128; } EVP_DecryptUpdate (ctx, decrypted_CT+len, &howmany, CIPHERTEXT+len, in_len-len); dec_success = EVP_DecryptFinal (ctx, dec_TAG, &howmany); EVP_CIPHER_CTX_free(ctx);
最后,您应该检查dec_success的值是否为1.如果修改CIPHERTEXT,在解密之前,您应该获得值0。
为现代性编辑的答案:
您必须检查EVP_DecryptFinal()(或EVP_DecryptFinal_ex())调用的返回值,以确定您是否已成功解密密文。
OpenSSL现在提供了一个完美的AES GCM示例,用C语言编写。它甚至包括测试向量。 你可以在这里找到https://github.com/openssl/openssl/blob/master/demos/evp/aesgcm.c或搜索“openssl evp aesgcm.c”
最初的5年问题及其接受的答案显示了使用EVP_ * Init()和EVP_ * Final()API的代码。 这些已被弃用,并被EVP_ * Init_ex()和EVP_ * Final_ex()取代,因为它们可以重用现有的上下文,而无需在每次调用时分配和释放它。 ( openssl引用 )
根据我的经验,如果您正在为这些调用编写包装函数, 请不要为NULL调用EVP_EncryptUpdate_ex(),为AAD调用0。 这可能在较新版本的OpenSSL中发生了变化,但截至2013年,它导致加密失败。
它远远超出了这个问题的范围,但万一它可以帮助任何人,这里是一个使用OpenSSL API的工作iOS / Objective C实现。
#include #include #include #include #include #include #define AES_256_KEY_LENGTH 32 #define AES_256_KEY_LENGTH_BITS 256 #define AES_256_IVEC_LENGTH 12 #define AES_256_GCM_TAG_LENGTH 16 // encrypt plaintext. // key, ivec and tag buffers are required, aad is optional // depending on your use, you may want to convert key, ivec, and tag to NSData/NSMutableData + (BOOL) aes256gcmEncrypt:(NSData*)plaintext ciphertext:(NSMutableData**)ciphertext aad:(NSData*)aad key:(const unsigned char*)key ivec:(const unsigned char*)ivec tag:(unsigned char*)tag { int status = 0; *ciphertext = [NSMutableData dataWithLength:[plaintext length]]; if (! *ciphertext) return NO; // set up to Encrypt AES 256 GCM int numberOfBytes = 0; EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); EVP_EncryptInit_ex (ctx, EVP_aes_256_gcm(), NULL, NULL, NULL); // set the key and ivec EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, AES_256_IVEC_LENGTH, NULL); EVP_EncryptInit_ex (ctx, NULL, NULL, key, ivec); // add optional AAD (Additional Auth Data) if (aad) status = EVP_EncryptUpdate( ctx, NULL, &numberOfBytes, [aad bytes], [aad length]); unsigned char * ctBytes = [*ciphertext mutableBytes]; EVP_EncryptUpdate (ctx, ctBytes, &numberOfBytes, [plaintext bytes], (int)[plaintext length]); status = EVP_EncryptFinal_ex (ctx, ctBytes+numberOfBytes, &numberOfBytes); if (status && tag) { status = EVP_CIPHER_CTX_ctrl (ctx, EVP_CTRL_GCM_GET_TAG, AES_256_GCM_TAG_LENGTH, tag); } EVP_CIPHER_CTX_free(ctx); return (status != 0); // OpenSSL uses 1 for success } // decrypt ciphertext. // key, ivec and tag buffers are required, aad is optional // depending on your use, you may want to convert key, ivec, and tag to NSData/NSMutableData + (BOOL) aes256gcmDecrypt:(NSData*)ciphertext plaintext:(NSMutableData**)plaintext aad:(NSData*)aad key:(const unsigned char *)key ivec:(const unsigned char *)ivec tag:(unsigned char *)tag { int status = 0; if (! ciphertext || !plaintext || !key || !ivec) return NO; *plaintext = [NSMutableData dataWithLength:[ciphertext length]]; if (! *plaintext) return NO; // set up to Decrypt AES 256 GCM int numberOfBytes = 0; EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); EVP_DecryptInit_ex (ctx, EVP_aes_256_gcm(), NULL, NULL, NULL); // set the key and ivec EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, AES_256_IVEC_LENGTH, NULL); status = EVP_DecryptInit_ex (ctx, NULL, NULL, key, ivec); // Set expected tag value. A restriction in OpenSSL 1.0.1c and earlier requires the tag before any AAD or ciphertext if (status && tag) EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, AES_256_GCM_TAG_LENGTH, tag); // add optional AAD (Additional Auth Data) if (aad) EVP_DecryptUpdate(ctx, NULL, &numberOfBytes, [aad bytes], [aad length]); status = EVP_DecryptUpdate (ctx, [*plaintext mutableBytes], &numberOfBytes, [ciphertext bytes], (int)[ciphertext length]); if (! status) { //DDLogError(@"aes256gcmDecrypt: EVP_DecryptUpdate failed"); return NO; } EVP_DecryptFinal_ex (ctx, NULL, &numberOfBytes); EVP_CIPHER_CTX_free(ctx); return (status != 0); // OpenSSL uses 1 for success }
OpenSSL有一个关于使用AES-GCM密码的不错的wiki页面。 还提供了代码示例。 该页面的链接是Authenticated_Decryption_using_GCM_mode
我按照这个wiki编写了AES-GCM解密。 代码段复制如下
int decrypt(unsigned char *ciphertext, int ciphertext_len, unsigned char *aad, int aad_len, unsigned char *tag, unsigned char *key, unsigned char *iv, unsigned char *plaintext) { EVP_CIPHER_CTX *ctx; int len; int plaintext_len; int ret; /* Create and initialise the context */ if(!(ctx = EVP_CIPHER_CTX_new())) handleErrors(); /* Initialise the decryption operation. */ if(!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL)) handleErrors(); /* Set IV length. Not necessary if this is 12 bytes (96 bits) */ if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, 16, NULL)) handleErrors(); /* Initialise key and IV */ if(!EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv)) handleErrors(); /* Provide any AAD data. This can be called zero or more times as * required */ if(!EVP_DecryptUpdate(ctx, NULL, &len, aad, aad_len)) handleErrors(); /* Provide the message to be decrypted, and obtain the plaintext output. * EVP_DecryptUpdate can be called multiple times if necessary */ if(!EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len)) handleErrors(); plaintext_len = len; /* Set expected tag value. Works in OpenSSL 1.0.1d and later */ if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, tag)) handleErrors(); /* Finalise the decryption. A positive return value indicates success, * anything else is a failure - the plaintext is not trustworthy. */ ret = EVP_DecryptFinal_ex(ctx, plaintext + len, &len); /* Clean up */ EVP_CIPHER_CTX_free(ctx); if(ret > 0) { /* Success */ plaintext_len += len; return plaintext_len; } else { /* Verify failed */ return -1; } }
此外,正如人们所指出的,您应该检查从EVP_DecryptFinal_ex()返回的值。 如果您的密码文本被修改了一点,它仍然可以被解密,但最终的返回值将不是真的,因为无法validation身份validation标记(或mac)。
OpenSSL不负责身份validation。 您应该检查EVP_DecryptFinal
的返回值。 如果为1则解密数据的validationTAG等于您提供的TAG。
如果标签不同,则应将解密数据丢弃为伪造。 如果标签相同,那么数据就可以了。
由于身份validation是增量的,并且可以多次调用Update,因此必须先解密数据,然后才能完成身份validation。
需要了解更多c/c++开发分享使用EVP接口的AES-GCM的OpenSSL C示例,也可以关注C/ C++技术分享栏目---计算机技术网(www.ctvol.com)!
以上就是c/c++开发分享使用EVP接口的AES-GCM的OpenSSL C示例相关内容,想了解更多C/C++开发(异常处理)及C/C++游戏开发关注计算机技术网(www.ctvol.com)!)。
本文来自网络收集,不代表计算机技术网立场,如涉及侵权请联系管理员删除。
ctvol管理联系方式QQ:251552304
本文章地址:https://www.ctvol.com/c-cdevelopment/980275.html