python - 如何在不再次生成 key 对的情况下进行加密/解密？

Question

我自己一直在做一个项目并使用这个 website的代码作为指南。有什么办法，我可以将 key 的生成放入 1 个文件中，然后将加密/解密放入另一个文件中。如何在无需生成另一对 key 的情况下定义 bob_box？

Gen.PY:

import libnacl.public

def genkeys():

    bob = libnacl.public.SecretKey()
    alice = libnacl.public.SecretKey()

    bob_box = libnacl.public.Box(bob.sk, alice.pk)
    alice_box = libnacl.public.Box(alice.sk, bob.pk)

genkeys()

结束加密:

import libnacl.public
from GEN import genkeys

msg = '1234'

# Bob's box encrypts messages for Alice
bob_ctxt = bob_box.encrypt(msg)

# Alice's box decrypts messages from Bob
bclear = alice_box.decrypt(bob_ctxt)

# Alice can send encrypted messages which only Bob can decrypt
alice_ctxt = alice_box.encrypt(msg)
aclear = bob_box.decrypt(alice_ctxt)

运行 ENDEcrypt 时的输出:

Traceback (most recent call last):
File "/home/pi/Desktop/BOBALICE/endecrypt.py", line 7, in <module>
bob_ctxt = bob_box.encrypt(msg)
NameError: name 'bob_box' is not defined

Answer 1

libnacl API 的设计方式使得想要安全通信的两方必须以某种方式交换他们的公钥。假设 Alice 想给 Bob 发送消息。

# Alice's computer:                             Bob's computer:
alice_sign = libnacl.public.SecretKey()         bob_enc = libnacl.public.SecretKey()
alice_spk_h = alice_sign.hex_pk()               bob_epk_h = bob_enc.hex_pk()

# magic happens where alice_spk_h goes to Bob and bob_epk_h goes to alice (i.e. by phone)

bob_epk = libnacl.public.PublicKey(bob_epk_h)   alice_spk = libnacl.public.PublicKey(
                                                        alice_spk_h)
alice_box = libnacl.public.Box(                 bob_box = libnacl.public.Box(
        alice_sign.sk, bob_epk)                         bob_enc.sk, alice_spk)

# preparation is done, let's start encrypting...

ct = alice_box.encrypt(msg)

# send ct to Bob (the message is protected)

                                                msg = bob_box.decrypt(ct)

如您所见，您需要分别处理公钥和私钥，以便在通信双方的机器之间发送它们。不能将它们组合成一种方法，因为那样会与libnacl的公钥加密的使用场景相矛盾。

请记住，如果每一方使用一对 key ，则只能向一个方向发送加密消息。如果您需要发回消息，那么每一方都需要有两个 key (一个用于签名，一个用于加密；请注意，我以某种方式命名了 Alice 和 Bob 的 key 以明确这一点)。

---

Is there a way to do the generation of keys in one file and the storing of keys into a box + encryption/decryption into another file?

是的，但是这里你要想想这些文件是干什么的。 Python 文件就是代码。如果您从命令行运行生成 SecretKey 的代码，则需要以某种方式存储它，因为再次运行代码会更改 key 。

生成.py

import libnacl.public

def genkey():
    return libnacl.public.SecretKey()

def gen_keys_and_save():
    # Generate two key pairs and store them for later use
    enc = genkey()
    enc.save('myencsecret.key')
    with open('myencpublic.key', 'w') as pkf:
        pkf.write(enc.hex_pk())

    sign = genkey()
    sign.save('mysignsecret.key')
    with open('mysignpublic.key', 'w') as pkf:
        pkf.write(sign.hex_pk())

if __name__ == "__main__":
    # this code only runs when executed directly (i.e. from command line)
    gen_keys_and_save()

编码.py

import libnacl.public
import libnacl.utils

def encrypt(mysignsecret, theirencpublic, data):
    box = libnacl.public.Box(mysignsecret, theirencpublic)
    return box.encrypt(data)

def parse_and_encrypt(mysignsecretfile, theirencpublicfile, data):
    sk = libnacl.utils.load_key(mysignsecretfile)
    with open(theirencpublicfile, 'r') as pkf:
        pk = libnacl.public.PublicKey(pkf.read())
    return encrypt(sk, pk, data)

if __name__ == "__main__":
    parse_and_encrypt('mysignsecret.key', 'theirencpublic.key', 'some kind of msg')

dec.py

import libnacl.public

def decrypt(myencsecret, theirsignpublic, ciphertext):
    box = libnacl.public.Box(myencsecret, theirsignpublic)
    return box.decrypt(ciphertext)

# similar to enc.py ...

现在你可以像这样运行它:

$ python gen.py 

现在您需要接收他们的 rencpublic.key 并发送 mysignpublic.key。完成后，您可以这样做:

$ python enc.py