ios - 为什么 SecKeyEncrypt 会为超过 246 字节的输入字符串返回 paramErr (-50)？

Question

我正在使用 SecKeyEncrypt 将 JSON 格式的字符串作为输入。如果向 SecKeyEncrypt 传递一个小于 246 的 plainTextLength，它就可以工作。如果我传递给它的长度为 246 或更长，它将失败并返回值:paramErr (-50)。

这可能是字符串本身的问题。我可能会发送 SecKeyEncrypt 的示例是:

{"handle":"music-list","sym_key":"MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALeaEO7ZrjgOFGLBzBHZtQuzH2GNDYMLWP+fIFNu5Y+59C6HECY+jt0yOXXom2mzp/WYYI/9G+Ig8OD6YiKv2nMCAwEAAQ==","app_id":"xgfdt.LibraryTestApp","api_key":"7e080f74de3625b90dd293fc8be560a5cdfafc08"}

第 245 个字符是“0”。

在此工作之间发生变化的唯一输入是 plainTextLength。 SecKeyGetBlockSize() 向我返回 256，因此任何长度不超过 256 个字符的输入都应该有效。

这是我的加密方法:

+ (NSData*)encrypt:(NSString*)data usingPublicKeyWithTag:(NSString*)tag{    OSStatus status = noErr;    size_t cipherBufferSize;    uint8_t *cipherBuffer;    // [cipherBufferSize]    size_t dataSize = 246;//[data lengthOfBytesUsingEncoding:NSUTF8StringEncoding];    const uint8_t* textData = [[data dataUsingEncoding:NSUTF8StringEncoding] bytes];    SecKeyRef publicKey = [Encryption copyPublicKeyForTag:tag];    NSAssert(publicKey, @"The public key being referenced by tag must have been stored in the keychain before attempting to encrypt data using it!");    //  Allocate a buffer    cipherBufferSize = SecKeyGetBlockSize(publicKey);    // this value will not get modified, whereas cipherBufferSize may.    const size_t fullCipherBufferSize = cipherBufferSize;    cipherBuffer = malloc(cipherBufferSize);    NSMutableData* accumulatedEncryptedData = [NSMutableData dataWithCapacity:0];    //  Error handling    for (int ii = 0; ii*fullCipherBufferSize < dataSize; ii++) {        const uint8_t* dataToEncrypt = (textData+(ii*fullCipherBufferSize));        const size_t subsize = (((ii+1)*fullCipherBufferSize) > dataSize) ? fullCipherBufferSize-(((ii+1)*fullCipherBufferSize) - dataSize) : fullCipherBufferSize;        // Encrypt using the public key.        status = SecKeyEncrypt(    publicKey,                               kSecPaddingPKCS1,                               dataToEncrypt,                               subsize,                               cipherBuffer,                               &cipherBufferSize                               );        [accumulatedEncryptedData appendBytes:cipherBuffer length:cipherBufferSize];    }    if (publicKey) CFRelease(publicKey);    free(cipherBuffer);    return accumulatedEncryptedData;}

Answer 1

来自文档:

plainTextLen
Length in bytes of the data in the plainText buffer. This must be less than or equal to the value returned by the SecKeyGetBlockSize function. When PKCS1 padding is performed, the maximum length of data that can be encrypted is 11 bytes less than the value returned by the SecKeyGetBlockSize function (secKeyGetBlockSize() - 11).

(强调我的)

您正在使用 PKCS1 填充。因此，如果 block 大小为 256，则一次最多只能加密 245 个字节。