3


我需要在 Crypto++ 中实现与 BouncyCastle 的"ECIESwithAES-CBC/NONE/PKCS7Padding"等效的功能。

主要原因是我需要在 iOS 上加密数据并在后端使用 Java 中的 BouncyCastle 对其进行解密，我们希望使用这些特定的算法/配置。

我对 C++ 的经验为零，但这是我迄今为止在 Crypto++ 中的经验：

// loaded private key
const unsigned char* privateKey;
size_t keyLength;

AutoSeededRandomPool prng;

ECIES_BC<ECP>::Decryptor decryptor;
decryptor.AccessPrivateKey().Load(StringStore(privateKey, keyLength).Ref());
ECIES_BC<ECP>::Encryptor encryptor(decryptor);

std::string plain("a"); // the message
std::string cipher;

SecByteBlock key(AES::DEFAULT_KEYLENGTH);
prng.GenerateBlock( key, key.size() );

byte iv[ AES::BLOCKSIZE ];
prng.GenerateBlock( iv, sizeof(iv) );

CBC_Mode< AES >::Encryption e;
e.SetKeyWithIV( key, key.size(), iv );

StringSource ss1( plain, true,
        new StreamTransformationFilter( e,
                new StringSink( cipher ), StreamTransformationFilter::PKCS_PADDING
                                      ) // StreamTransformationFilter
                 ); // StringSource


std::string cryptogram;
StringSource ss2 (cipher, true,
                            new PK_EncryptorFilter(prng, encryptor, new StringSink(cryptogram) ) );
// ... decrypt cryptogram in bouncy castle

这是java部分：

private static final Provider SECURITY_PROVIDER = new BouncyCastleProvider();

public byte[] decryptMessage(byte[] message) throws Exception {
    KeyFactory keyFactory = KeyFactory.getInstance("EC", SECURITY_PROVIDER);
    PKCS8EncodedKeySpec privSpec = new PKCS8EncodedKeySpec(
            IOUtils.toByteArray(getClass().getResourceAsStream("/key.pkcs8")));
    PrivateKey privKey = keyFactory.generatePrivate(privSpec);

    Cipher cipher = Cipher.getInstance("ECIESwithAES-CBC/NONE/PKCS5Padding", SECURITY_PROVIDER);
    cipher.init(Cipher.DECRYPT_MODE, privKey);
    byte[] result = cipher.doFinal(message);
    return result;
}

目前，当我从 Crypto++ 获取输出并尝试在 BouncyCastle 中对其进行解密时，它会引发异常：

javax.crypto.BadPaddingException: pad block corrupted
  at org.bouncycastle.jcajce.provider.asymmetric.ec.IESCipher.engineDoFinal(Unknown Source)
  at javax.crypto.Cipher.doFinal(Cipher.java:2087)
  ...

我不确定这是否真的是一个填充问题，还是我做错了什么？

任何建议和帮助将不胜感激。
谢谢！

PS：我已经应用了CryptoWiki中提到的充气城堡补丁

4

1 回答 1

3

ECIES 有几种不同的加密方法，具体取决于所使用的标准。目前，Crypto++ 仅实现 P1363 XOR 方法（以下来自gfpcrypt.h）。这可能解释了大部分例外情况。

为了解决问题，我相信你有三个选择。首先，您可以使用 XOR 方法，因为 Bouncy Castle 和 Crypto++ 都有它。

其次，您也许可以使用Jack Lloyd's Botan。Botan 和 Crypto++ 都试图与 Bouncy Castle 结盟以促进互操作，但 Botan 有更多的加密方法。

第三，Crypto++需要添加另一种兼容Bouncy Castle的加密方式。我想它会被称为DL_EncryptionAlgorithm_AES_CBC. 我None不确定AES-CBC/NONE/PKCS7Padding.

Crypto++ 很乐意添加DL_EncryptionAlgorithm_AES_CBC. 要添加它，我需要与具有 Java/BC 经验的人一起工作。如果您有兴趣，请与我联系noloader，gmail 帐户。

关于“Botan 和 Crypto++ 试图与 Bouncy Castle 结盟以促进互操作” ......对于用户来说，事情是一团糟。Martínez、Encinas 和 Ávila 在椭圆曲线综合加密方案调查中的注释：

... 就特定操作以及允许的功能和算法列表而言，不可能实现与所有这些标准兼容的软件版本。

我可以指出无数互操作问题的例子，从你的问题到比特币和 Zcash 由于太多不兼容的选择而标准化其协议的问题。它会一直持续下去。

这些注释来自gfpcrypt.h，可在 ECIES 的Crypto++ 手册中找到：

//! \class DL_EncryptionAlgorithm_Xor
//! \brief P1363 based XOR Encryption Method
//! \tparam MAC MessageAuthenticationCode derived class used for MAC computation
//! \tparam DHAES_MODE flag indicating DHAES mode
//! \tparam LABEL_OCTETS flag indicating the label is octet count
//! \details DL_EncryptionAlgorithm_Xor is based on an early P1363 draft, which itself appears to be based on an
//!   early Certicom SEC-1 draft (or an early SEC-1 draft was based on a P1363 draft). Crypto++ 4.2 used it in its Integrated
//!   Ecryption Schemes with <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
//! \details If you need this method for Crypto++ 4.2 compatibility, then use the ECIES template class with
//!   <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
//! \details If you need this method for Bouncy Castle 1.54 and Botan 1.11 compatibility, then use the ECIES template class with
//!   <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=ture</tt> and <tt>LABEL_OCTETS=false</tt>.
//! \details Bouncy Castle 1.54 and Botan 1.11 compatibility are the default template parameters.
//! \since Crypto++ 4.0
template <class MAC, bool DHAES_MODE, bool LABEL_OCTETS=false>
class DL_EncryptionAlgorithm_Xor : public DL_SymmetricEncryptionAlgorithm
{
public:

    bool ParameterSupported(const char *name) const {return strcmp(name, Name::EncodingParameters()) == 0;}
    size_t GetSymmetricKeyLength(size_t plaintextLength) const
        {return plaintextLength + static_cast<size_t>(MAC::DIGESTSIZE);}
    size_t GetSymmetricCiphertextLength(size_t plaintextLength) const
        {return plaintextLength + static_cast<size_t>(MAC::DIGESTSIZE);}
    size_t GetMaxSymmetricPlaintextLength(size_t ciphertextLength) const
        {return SaturatingSubtract(ciphertextLength, static_cast<size_t>(MAC::DIGESTSIZE));}
    void SymmetricEncrypt(RandomNumberGenerator &rng, const byte *key, const byte *plaintext, size_t plaintextLength, byte *ciphertext, const NameValuePairs &parameters) const
    {
        CRYPTOPP_UNUSED(rng);
        const byte *cipherKey = NULL, *macKey = NULL;
        if (DHAES_MODE)
        {
            macKey = key;
            cipherKey = key + MAC::DEFAULT_KEYLENGTH;
        }
        else
        {
            cipherKey = key;
            macKey = key + plaintextLength;
        }

        ConstByteArrayParameter encodingParameters;
        parameters.GetValue(Name::EncodingParameters(), encodingParameters);

        if (plaintextLength)    // Coverity finding
            xorbuf(ciphertext, plaintext, cipherKey, plaintextLength);

        MAC mac(macKey);
        mac.Update(ciphertext, plaintextLength);
        mac.Update(encodingParameters.begin(), encodingParameters.size());
        if (DHAES_MODE)
        {
            byte L[8];
            PutWord(false, BIG_ENDIAN_ORDER, L, (LABEL_OCTETS ? word64(encodingParameters.size()) : 8 * word64(encodingParameters.size())));
            mac.Update(L, 8);
        }
        mac.Final(ciphertext + plaintextLength);
    }
    DecodingResult SymmetricDecrypt(const byte *key, const byte *ciphertext, size_t ciphertextLength, byte *plaintext, const NameValuePairs &parameters) const
    {
        size_t plaintextLength = GetMaxSymmetricPlaintextLength(ciphertextLength);
        const byte *cipherKey, *macKey;
        if (DHAES_MODE)
        {
            macKey = key;
            cipherKey = key + MAC::DEFAULT_KEYLENGTH;
        }
        else
        {
            cipherKey = key;
            macKey = key + plaintextLength;
        }

        ConstByteArrayParameter encodingParameters;
        parameters.GetValue(Name::EncodingParameters(), encodingParameters);

        MAC mac(macKey);
        mac.Update(ciphertext, plaintextLength);
        mac.Update(encodingParameters.begin(), encodingParameters.size());
        if (DHAES_MODE)
        {
            byte L[8];
            PutWord(false, BIG_ENDIAN_ORDER, L, (LABEL_OCTETS ? word64(encodingParameters.size()) : 8 * word64(encodingParameters.size())));
            mac.Update(L, 8);
        }
        if (!mac.Verify(ciphertext + plaintextLength))
            return DecodingResult();

        if (plaintextLength)    // Coverity finding
            xorbuf(plaintext, ciphertext, cipherKey, plaintextLength);

        return DecodingResult(plaintextLength);
    }
};
于 2016-12-02T17:22:33.153 回答