c# - C# 中的 Rijndael 密文不会在 PHP 中反序列化

Question

我们有以下 C# 和 PHP 代码，但结果不匹配。我们需要使用 PHP 脚本对来自 C# 的编码字符串进行解码。这可能吗？

C#代码

class Program
{

  public string CKey = "HELLOSECRETTEXT";
  public string EnText = "Hello World";

  static void Main(string[] args)
    {
        Functions fn = new Functions();
        Program pr = new Program();
        Console.Write(fn.Encrypt(EnText, pr.CBDKey));
    }

}


class Functions
{

    //Encrypts plaintext using AES 128bit key and a Chain Block Cipher and returns a base64 encoded string
    public String Encrypt(String plainText, String key)
    {
        var plainBytes = Encoding.UTF8.GetBytes(plainText);
        return Convert.ToBase64String(Encrypt(plainBytes, GetRijndaelManaged(key)));
    }

    //Decrypts encrypted string and returns a base64 encoded string
    public String Decrypt(String encryptedText, String key)
    {
        var encryptedBytes = Convert.FromBase64String(encryptedText);
        return Encoding.UTF8.GetString(Decrypt(encryptedBytes, GetRijndaelManaged(key)));
    }

    private RijndaelManaged GetRijndaelManaged(String secretKey)
    {
        var keyBytes = new byte[16];
        var secretKeyBytes = Encoding.UTF8.GetBytes(secretKey);
        Array.Copy(secretKeyBytes, keyBytes, Math.Min(keyBytes.Length, secretKeyBytes.Length));
        return new RijndaelManaged
        {
            Mode = CipherMode.CBC,
            Padding = PaddingMode.PKCS7,
            KeySize = 128,
            BlockSize = 128,
            Key = keyBytes,
            IV = keyBytes
        };
    }

    public byte[] Encrypt(byte[] plainBytes, RijndaelManaged rijndaelManaged)
    {
        return rijndaelManaged.CreateEncryptor()
            .TransformFinalBlock(plainBytes, 0, plainBytes.Length);
    }

    public byte[] Decrypt(byte[] encryptedData, RijndaelManaged rijndaelManaged)
    {
        return rijndaelManaged.CreateDecryptor()
            .TransformFinalBlock(encryptedData, 0, encryptedData.Length);
    }

}

结果:DeM0gfGHLzuSLtx4siKdVg==

这会解密为文本“Hello World”。

PHP代码

<?php
//Encryption function

function encryptAPIData($data) {

    $key = "HELLOWORLDHELLO"; //Key with 15 characters

    //Serialize data before encryption
    $encrypt_data = serialize($data);

    //Find out what size is supported for IV
    $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);

    #Create a random IV to use with CBC encoding
    $iv = mcrypt_create_iv($iv_size, MCRYPT_DEV_URANDOM);

    //Create a cipher text compatible with AES (Rijndael block size = 128) with CBC Mode
    $encrypted_data = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $encrypt_data, MCRYPT_MODE_CBC, $iv);

    //Encode data to send it and attach IV with it for decryption - pipe delimited
    $encoded = base64_encode($encrypted_data) . '|' . base64_encode($iv);

    return $encoded;
  }


//Decryption function 

function decryptAPIData($data) {   

    $key = "HELLOWORLDHELLO"; //Key with 15 characters

    $decrypt_data = explode('|', $data . '|');
    $decoded = base64_decode($decrypt_data[0]);    
    $iv = base64_decode($decrypt_data[1]);

    if (strlen($iv) !== mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC)) {
      return false;
    }

    $decrypted = trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $decoded, MCRYPT_MODE_CBC, $iv));
    $decrypted = unserialize($decrypted);
    return $decrypted;
  }


    $text_to_encrypt = "Hello World";
    echo "<br><br>";
    echo "Original text: \t\t\t{$text_to_encrypt}\n";
    echo "<br><br>";
    $encrypted_data = encryptAPIData($text_to_encrypt);
    echo "Text after encryption: \t\t" . $encrypted_data . "\n";
    echo "<br><br>";
    echo "Text after decryption: \t\t" . decryptAPIData($encrypted_data) . "\n";
    echo "<br><br>";


?>

结果:

原文: Hello World

加密后的文本:

iKIlK70iSWtSMgT0ld/UuhT9/Aa5dZBEUKDQ57jiF9w=|L8oIcim4jphVim8SYdJRwQ== 

解密后的文本:“Hello World”

---

现在，当尝试使用上述 PHP 代码解密 C# 输出的文本时，它会返回以下错误/警告。

注意:unserialize(): 16 字节的偏移量 0 处出错

关于为什么会发生此错误的任何想法？

Answer 1

您正在尝试反序列化尚未序列化的数据。编码/解码和序列化/反序列化不是一回事。编码是指以描述的方式对数据进行(二进制)表示；编码通常与系统无关。然而，序列化是将系统特定对象存储为二进制表示；它通常包含类型标识符等。因此，您需要摆脱该功能才能进行互操作。

除此之外，您确实需要为 PHP 实现符合 PKCS#7 的填充/取消填充。 mcrypt 的 PHP 页面在 API 文档的评论中展示了这样做的方法，但您最好完全删除 mcrypt，因为 zaph 已经在他的评论中提到过。