java - 在 Crypto++ 中使用 AES 和 CBC 的 ECIES

Question

我需要在 Crypto++ 中实现相当于 BouncyCaSTLe 的 "ECIESwithAES-CBC/NONE/PKCS7Padding"。

主要原因是我需要在 iOS 上加密数据并在后端使用 Java 中的 BouncyCaSTLe 对其进行解密，我们希望使用那些特定的算法/配置。

我对 C++ 的经验为零，但这是我到目前为止在 Crypto++ 方面的经验:

// loaded private key
const unsigned char* privateKey;
size_t keyLength;

AutoSeededRandomPool prng;

ECIES_BC<ECP>::Decryptor decryptor;
decryptor.AccessPrivateKey().Load(StringStore(privateKey, keyLength).Ref());
ECIES_BC<ECP>::Encryptor encryptor(decryptor);

std::string plain("a"); // the message
std::string cipher;

SecByteBlock key(AES::DEFAULT_KEYLENGTH);
prng.GenerateBlock( key, key.size() );

byte iv[ AES::BLOCKSIZE ];
prng.GenerateBlock( iv, sizeof(iv) );

CBC_Mode< AES >::Encryption e;
e.SetKeyWithIV( key, key.size(), iv );

StringSource ss1( plain, true,
        new StreamTransformationFilter( e,
                new StringSink( cipher ), StreamTransformationFilter::PKCS_PADDING
                                      ) // StreamTransformationFilter
                 ); // StringSource


std::string cryptogram;
StringSource ss2 (cipher, true,
                            new PK_EncryptorFilter(prng, encryptor, new StringSink(cryptogram) ) );
// ... decrypt cryptogram in bouncy castle

这是java部分:

private static final Provider SECURITY_PROVIDER = new BouncyCastleProvider();

public byte[] decryptMessage(byte[] message) throws Exception {
    KeyFactory keyFactory = KeyFactory.getInstance("EC", SECURITY_PROVIDER);
    PKCS8EncodedKeySpec privSpec = new PKCS8EncodedKeySpec(
            IOUtils.toByteArray(getClass().getResourceAsStream("/key.pkcs8")));
    PrivateKey privKey = keyFactory.generatePrivate(privSpec);

    Cipher cipher = Cipher.getInstance("ECIESwithAES-CBC/NONE/PKCS5Padding", SECURITY_PROVIDER);
    cipher.init(Cipher.DECRYPT_MODE, privKey);
    byte[] result = cipher.doFinal(message);
    return result;
}

目前，当我从 Crypto++ 获取输出并尝试在 BouncyCaSTLe 中对其进行解密时，它会抛出异常:

javax.crypto.BadPaddingException: pad block corrupted
  at org.bouncycastle.jcajce.provider.asymmetric.ec.IESCipher.engineDoFinal(Unknown Source)
  at javax.crypto.Cipher.doFinal(Cipher.java:2087)
  ...

我不确定这是否真的是填充问题，还是我做错了什么？

如有任何建议和帮助，我们将不胜感激。
谢谢!

PS:我已经应用了 CryptoWiki 中提到的充气城堡补丁

Answer 1

ECIES 有几种不同的加密方法，具体取决于所使用的标准。目前，Crypto++ 仅实现了 P1363 XOR 方法(以下来自 gfpcrypt.h)。这可能解释了大部分异常。

为了解决问题，我相信您有三个选择。首先，您可以使用 XOR 方法，因为 Bouncy CaSTLe 和 Crypto++ 都有它。

其次，您可以使用 Jack Lloyd's Botan . Botan 和 Crypto++ 都试图与 Bouncy CaSTLe 结盟以促进互操作，但 Botan 有更多的加密方法。

第三，Crypto++需要增加另一种兼容Bouncy CaSTLe的加密方式。我想它会被称为 DL_EncryptionAlgorithm_AES_CBC。我不确定 None 在 AES-CBC/NONE/PKCS7Padding 。

Crypto++ 很乐意添加 DL_EncryptionAlgorithm_AES_CBC。要添加它，我需要与具有 Java/BC 经验的人一起工作。如果您有兴趣，请与我联系noloader，gmail 帐户。

---

关于 “Botan 和 Crypto++ 试图与 Bouncy CaSTLe 结盟以促进互操作” ... 对用户而言，事情一团糟。 Martínez、Encinas 和 Ávila 在 A Survey of the Elliptic Curve Integrated Encryption Scheme 中注明:

... it is not possible to implement a software version compatible with all those standards, regarding both the specific operations and the list of allowed functions and algorithms.

我可以举出无数互操作性问题的例子，从你的问题到比特币和 Zcash 由于太多不兼容的选择而标准化他们的协议(protocol)的问题。它一直在继续。

---

这些评论来自gfpcrypt.h ，并在 Crypto++ Manual for ECIES 中可用:

//! \class DL_EncryptionAlgorithm_Xor
//! \brief P1363 based XOR Encryption Method
//! \tparam MAC MessageAuthenticationCode derived class used for MAC computation
//! \tparam DHAES_MODE flag indicating DHAES mode
//! \tparam LABEL_OCTETS flag indicating the label is octet count
//! \details DL_EncryptionAlgorithm_Xor is based on an early P1363 draft, which itself appears to be based on an
//!   early Certicom SEC-1 draft (or an early SEC-1 draft was based on a P1363 draft). Crypto++ 4.2 used it in its Integrated
//!   Ecryption Schemes with <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
//! \details If you need this method for Crypto++ 4.2 compatibility, then use the ECIES template class with
//!   <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=false</tt> and <tt>LABEL_OCTETS=true</tt>.
//! \details If you need this method for Bouncy Castle 1.54 and Botan 1.11 compatibility, then use the ECIES template class with
//!   <tt>NoCofactorMultiplication</tt>, <tt>DHAES_MODE=ture</tt> and <tt>LABEL_OCTETS=false</tt>.
//! \details Bouncy Castle 1.54 and Botan 1.11 compatibility are the default template parameters.
//! \since Crypto++ 4.0
template <class MAC, bool DHAES_MODE, bool LABEL_OCTETS=false>
class DL_EncryptionAlgorithm_Xor : public DL_SymmetricEncryptionAlgorithm
{
public:

    bool ParameterSupported(const char *name) const {return strcmp(name, Name::EncodingParameters()) == 0;}
    size_t GetSymmetricKeyLength(size_t plaintextLength) const
        {return plaintextLength + static_cast<size_t>(MAC::DIGESTSIZE);}
    size_t GetSymmetricCiphertextLength(size_t plaintextLength) const
        {return plaintextLength + static_cast<size_t>(MAC::DIGESTSIZE);}
    size_t GetMaxSymmetricPlaintextLength(size_t ciphertextLength) const
        {return SaturatingSubtract(ciphertextLength, static_cast<size_t>(MAC::DIGESTSIZE));}
    void SymmetricEncrypt(RandomNumberGenerator &rng, const byte *key, const byte *plaintext, size_t plaintextLength, byte *ciphertext, const NameValuePairs &parameters) const
    {
        CRYPTOPP_UNUSED(rng);
        const byte *cipherKey = NULL, *macKey = NULL;
        if (DHAES_MODE)
        {
            macKey = key;
            cipherKey = key + MAC::DEFAULT_KEYLENGTH;
        }
        else
        {
            cipherKey = key;
            macKey = key + plaintextLength;
        }

        ConstByteArrayParameter encodingParameters;
        parameters.GetValue(Name::EncodingParameters(), encodingParameters);

        if (plaintextLength)    // Coverity finding
            xorbuf(ciphertext, plaintext, cipherKey, plaintextLength);

        MAC mac(macKey);
        mac.Update(ciphertext, plaintextLength);
        mac.Update(encodingParameters.begin(), encodingParameters.size());
        if (DHAES_MODE)
        {
            byte L[8];
            PutWord(false, BIG_ENDIAN_ORDER, L, (LABEL_OCTETS ? word64(encodingParameters.size()) : 8 * word64(encodingParameters.size())));
            mac.Update(L, 8);
        }
        mac.Final(ciphertext + plaintextLength);
    }
    DecodingResult SymmetricDecrypt(const byte *key, const byte *ciphertext, size_t ciphertextLength, byte *plaintext, const NameValuePairs &parameters) const
    {
        size_t plaintextLength = GetMaxSymmetricPlaintextLength(ciphertextLength);
        const byte *cipherKey, *macKey;
        if (DHAES_MODE)
        {
            macKey = key;
            cipherKey = key + MAC::DEFAULT_KEYLENGTH;
        }
        else
        {
            cipherKey = key;
            macKey = key + plaintextLength;
        }

        ConstByteArrayParameter encodingParameters;
        parameters.GetValue(Name::EncodingParameters(), encodingParameters);

        MAC mac(macKey);
        mac.Update(ciphertext, plaintextLength);
        mac.Update(encodingParameters.begin(), encodingParameters.size());
        if (DHAES_MODE)
        {
            byte L[8];
            PutWord(false, BIG_ENDIAN_ORDER, L, (LABEL_OCTETS ? word64(encodingParameters.size()) : 8 * word64(encodingParameters.size())));
            mac.Update(L, 8);
        }
        if (!mac.Verify(ciphertext + plaintextLength))
            return DecodingResult();

        if (plaintextLength)    // Coverity finding
            xorbuf(plaintext, ciphertext, cipherKey, plaintextLength);

        return DecodingResult(plaintextLength);
    }
};