java - 努力存储生成的盐以进行 aes 加密/解密

Question

所以我对加密几乎一无所知 - 但我正在努力弄清楚这一切。我从 here 得到了一些示例代码但当我重新启动程序并且实例重置时，我无法弄清楚如何调用解密方法。我猜我需要某种方法来存储盐并将其解析为解密方法？任何帮助表示赞赏。

这是代码:

public class AES {

    private static final String password = "encrypt";
    private static String salt;
    private static final int pswdIterations = 65536;
    private static final int keySize = 128;
    private byte[] ivBytes;

    public String encrypt(String plainText) throws Exception {

        //get salt
        salt = generateSalt();
        byte[] saltBytes = salt.getBytes("UTF-8");

        // Derive the key
        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
        PBEKeySpec spec = new PBEKeySpec(
                password.toCharArray(),
                saltBytes,
                pswdIterations,
                keySize
        );

        SecretKey secretKey = factory.generateSecret(spec);
        SecretKeySpec secret = new SecretKeySpec(secretKey.getEncoded(), "AES");

        //encrypt the message
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, secret);
        AlgorithmParameters params = cipher.getParameters();
        ivBytes = params.getParameterSpec(IvParameterSpec.class).getIV();
        byte[] encryptedTextBytes = cipher.doFinal(plainText.getBytes("UTF-8"));
        return new Base64().encodeAsString(encryptedTextBytes);
    }

    @SuppressWarnings("static-access")
    public String decrypt(String encryptedText) throws Exception {

        byte[] saltBytes = salt.getBytes("UTF-8");
        byte[] encryptedTextBytes = new Base64().decodeBase64(encryptedText);

        // Derive the key
        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
        PBEKeySpec spec = new PBEKeySpec(
                password.toCharArray(),
                saltBytes,
                pswdIterations,
                keySize
        );

        SecretKey secretKey = factory.generateSecret(spec);
        SecretKeySpec secret = new SecretKeySpec(secretKey.getEncoded(), "AES");

        // Decrypt the message
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        cipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(ivBytes));

        byte[] decryptedTextBytes = null;
        try {
            decryptedTextBytes = cipher.doFinal(encryptedTextBytes);
        } catch (IllegalBlockSizeException | BadPaddingException e) {
        }

        return new String(decryptedTextBytes);
    }

    public String generateSalt() {
        SecureRandom random = new SecureRandom();
        byte bytes[] = new byte[20];
        random.nextBytes(bytes);
        String s = new String(bytes);
        return s;
    }
}

Answer 1

一种常见的方法是直接使用生成的随机盐作为 byte[] 并将其连接在密文前面，然后将其编码为 Base 64。这对于给定的代码来说是一个非常好的主意，如以下行:

String s = new String(bytes);

generateSalt 方法中存在错误，可能会丢失信息。这意味着生成了错误的 key ，这意味着明文丢失(除非通过暴力破解盐来恢复)。为了让事情变得有趣，这只发生在盐字节的特定值上，即不规则地发生。

提示:不要依赖互联网上找到的随机代码来学习加密货币。您只会学到如何错误地执行此操作(有超过 100 票的 stackoverflow 答案包含不安全的加密技术!)。