c - openssl:使用 3gpp testvectors 的 128 位 key 的 c 中 aes ctr 方法的解密输出问题

Question

我正在使用 openssl AES-CTR 方法使用 128 位 key 进行加密/解密。加密很好，但解密后我无法获得原始输入。我在 c 的 linux 环境中测试 3GPP 测试 vector 。我得到以下输出:

    actual indata =
     fd40a41d 370a1f65 74509568 7d47ba1d 36d2349e 23f64439 2c8ea9c4 9d40c132 71aff264 d0f24800

    Enc indata =
     75750d37 b4bba2a4 dedb3423 5bd68c66 45acdaac a48138a3 b0c471e2 a7041a57 6423d292 7287f0f5


    decryption function is called

    Dec indata =
     c80f33a5 b884f2a4 489d2048 bc133a25 b9fad603 4c09f888 8ac7d546 1c359f1b f3c4ff3b b3bf19d1

解密后输出必须与实际输入数据相匹配。但在这里我无法获得正确的输出。 你能在这方面提供帮助吗？提前致谢。

    #include <openssl/aes.h>
    #include <openssl/rand.h>
    #include <openssl/hmac.h>
    #include <openssl/buffer.h>
    #include <stdio.h>
    #include <string.h>
    #include <stdlib.h>
    #include <math.h>

    #define u32 unsigned int
    #define u8 unsigned char
    #define MAX_SIZE 2048
    #define BIT_SIZE 128
    #define INPUT_LENGTH   40  /*set 3*/

    struct ctr_state
    {
            unsigned char ivec[AES_BLOCK_SIZE];
            unsigned int  num;
            unsigned char ecount[AES_BLOCK_SIZE];
    };

    AES_KEY key;

    unsigned char indata[MAX_SIZE];
    unsigned char outdata[MAX_SIZE];
    unsigned char iv[AES_BLOCK_SIZE];
    struct ctr_state state;


    int init_ctr(struct ctr_state *state, const unsigned char iv[16])
    {
        /* aes_ctr128_encrypt requires 'num' and 'ecount' set to zero on the * first call. */
        state->num = 0;
        memset(state->ecount, 0, AES_BLOCK_SIZE);

        /* Initialise counter in 'ivec' to 0 */
        memset(state->ivec + 8, 0, 8);

        /* Copy IV into 'ivec' */
        memcpy(state->ivec, iv, 8);
    }


    void cipher_aes_128(const unsigned char *enckey, int count, int bearer, int dir, u8 *indata, int length )
    {
        int n,i,flag=1,n1,padbit,padded[16];

        n=length/BIT_SIZE;
        if(length%BIT_SIZE!=0)
        {
          flag=0;
          n=n+1;
        }

        printf("\nn=%d\n",n);
        iv[0] = (count >> 24) & 0xff ;
        iv[1] = (count >> 16) & 0xff ;
        iv[2] = (count >> 8)  & 0xff;
       iv[3] = count & 0xff;
       iv[4] = htonl((( (bearer << 27) | ((dir & 0x1) << 26))));
       iv[5] = iv[6]= iv[7] = 0;


      //Initializing the encryption KEY
      if (AES_set_encrypt_key(enckey, BIT_SIZE, &key) < 0)
       {
            printf(stderr, "Could not set decryption key.");
           exit(1);
       }

       init_ctr(&state, iv);//Counter call
        //Encrypting Blocks of 16 bytes and writing the output with ciphertext
        for(i=0;i<n;i++)
        {
            AES_ctr128_encrypt(&indata[AES_BLOCK_SIZE*i], &outdata[AES_BLOCK_SIZE*i],AES_BLOCK_SIZE, &key, state.ivec, state.ecount, &state.num);
        }
        for(i=0;i<(AES_BLOCK_SIZE*n);i++)
        {
           indata[i] = outdata[i];
        }
        printf("\n");
    }


    void cipher_aes_128_decode(const unsigned char *enckey, int count, int bearer, int dir, u8 *indata, int length )
    {
            printf("\ndecryption function is called\n");
            cipher_aes_128(  enckey, count, bearer,  dir, indata, length );
            printf("\n");
    }


    int main(int argc, char *argv[])
    {
        /*Test data 3 */
     u8 key1[16] = {
            0x0a,0x8b,0x6b,0xd8,0xd9,0xb0,0x8b,0x08,
            0xd6,0x4e,0x32,0xd1,0x81,0x77,0x77,0xfb
      };
      u8 count[4] ={0x54,0x4d,0x49,0xcd };
      u32 tempCount = 0;
      u8 bearer = 0x04;
      u8 dir =0,i;
      u32 length = 310 ;
      u8 indata[INPUT_LENGTH] = {
            0xfd,0x40,0xa4,0x1d,0x37,0x0a,0x1f,0x65,
            0x74,0x50,0x95,0x68,0x7d,0x47,0xba,0x1d,
            0x36,0xd2,0x34,0x9e,0x23,0xf6,0x44,0x39,
            0x2c,0x8e,0xa9,0xc4,0x9d,0x40,0xc1,0x32,
            0x71,0xaf,0xf2,0x64,0xd0,0xf2,0x48,0x00
    };
      tempCount = htonl((count[0] | (count[1] << 8) | count[2]<< 16 | count[3] << 24));

      printf("actual indata =\n");
      for(i=0;i<INPUT_LENGTH;i++)
      {
         if((i%4)==0)
         printf(" ");
           printf("%02x",indata[i]);
      }

      cipher_aes_128( key1, tempCount, bearer,  dir, indata, length );

      printf("Enc indata =\n");
      for(i=0;i<INPUT_LENGTH;i++)
      {
         if((i%4)==0)
         printf(" ");
           printf("%02x",indata[i]);
      }
      cipher_aes_128_decode(key1,tempCount,bearer,dir,indata,length);

      printf("\nDec indata =\n");
      for(i=0;i<INPUT_LENGTH;i++)
      {
         if((i%4)==0)
         printf(" ");
           printf("%02x",indata[i]);
      }
    }

Answer 1

首先，我建议使用不同的加密库，例如 NaCl对于 C/C++ 或 crypto++对于 C++，因为它们提供了更容易实现的原语，在 openssl 中很容易搞砸实现。其次，我建议阅读 how to pick iv in ctr mode .另一件事是你没有增加每个 block 的计数器。

我编译了代码，我的输出是:

actual indata =
 fd40a41d 370a1f65 74509568 7d47ba1d 36d2349e 23f64439 2c8ea9c4 9d40c132 71aff264 d0f24800
n=3

Enc indata =
 75750d37 b4bba2a4 dedb3423 5bd68c66 45acdaac a48138a3 b0c471e2 a7041a57 6423d292 7287f0f5
decryption function is called

n=3



Dec indata =
 fd40a41d 370a1f65 74509568 7d47ba1d 36d2349e 23f64439 2c8ea9c4 9d40c132 71aff264 d0f2480