java - 没有身份验证标签的 AES GCM 解密

Question

我有一个问题。以我在密码学方面的有限经验。

如何在没有身份验证标签的情况下解密 AES-128-GCM。

我找到了 AES GCM decryption bypassing authentication in JAVA好像解决了一些问题。但只有 iv 等于 96 位才能工作。

shadowsocksr OpenSSL support aes-128-gcm .不同于其他使用认证标签的aes-128-gcm加密或解密。

我写了一个测试脚本并得到了结果。

脚本:

from shadowsocks import encrypt
import binascii
ivLength = 16
key, iv = encrypt.EVP_BytesToKey(b"killer",16,12,None)
print("key: ",binascii.hexlify(key))
print("iv: ",binascii.hexlify(iv))

cipher = encrypt.Encryptor("killer","aes-128-gcm",iv=iv)
hello = cipher.encrypt(bytes("hello","utf-8"))

dehello = cipher.decrypt(hello)
print("origin: " ,binascii.hexlify(b'hello'))
print("Ciphertext: ",binascii.hexlify(hello))
print("Cleartext: ",binascii.hexlify(dehello))

当 ivLength 设置为 12 时:

key:  b'b36d331451a61eb2d76860e00c347396'
iv:  b'271d7f17d03ed7cd1f443274'
origin:  b'68656c6c6f'
Ciphertext:  b'e0fc2227c40bc9ea9343a1faafa4e23da750a9ad00'
Cleartext:  b'68656c6c6f'

当 ivLength 设置为 16 时:

key:  b'b36d331451a61eb2d76860e00c347396'
iv:  b'271d7f17d03ed7cd1f44327456aebfa2'
origin:  b'68656c6c6f'
Ciphertext:  b'271d7f17d03ed7cd1f44327456aebfa215988b0365'
Cleartext:  b'68656c6c6f'

我想用Java解密。正如提到的方法 Maarten Bodewes。我写了一个Java代码来解密上面的结果:

环境:

操作系统环境:window 10

jdk版本:JDK11

依赖:

<dependency>
    <groupId>commons-codec</groupId>
    <artifactId>commons-codec</artifactId>
    <version>1.11</version>
</dependency>
<dependency>
    <groupId>com.google.guava</groupId>
    <artifactId>guava</artifactId>
    <version>27.0.1-jre</version>
</dependency>
<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-lang3</artifactId>
    <version>3.8.1</version>
</dependency>

代码:

package server;

import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Hex;
import org.apache.commons.lang3.ArrayUtils;
import org.junit.Test;

import javax.crypto.*;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.List;

public class StackOverflow {
    @Test
    public void AES_128_GCM_DECRYPT_TEST() throws IOException, NoSuchAlgorithmException, InvocationTargetException, NoSuchMethodException, InvalidKeyException, InvalidAlgorithmParameterException, NoSuchPaddingException, BadPaddingException, IllegalAccessException, DecoderException, ShortBufferException, IllegalBlockSizeException, ClassNotFoundException {
        String ciphertext_with_iv_12 = "e0fc2227c40bc9ea9343a1faafa4e23da750a9ad00";
        String ciphertext_with_iv_16 = "a54a0301968953c0b45288f4d78c4011800f974c2d";
        System.out.println("--------------- descript with iv 12 ---------------");
        AES_128_GCM_DECRYPT(ciphertext_with_iv_12, "killer", 16, 12);
        System.out.println("--------------- descript with iv 16 ---------------");
        AES_128_GCM_DECRYPT(ciphertext_with_iv_12, "killer", 16, 16);
    }

    public static void AES_128_GCM_DECRYPT(String ciphertext,String password,int keyLength,int ivLength) throws DecoderException, NoSuchPaddingException, NoSuchAlgorithmException, IOException, InvalidAlgorithmParameterException, InvalidKeyException, ShortBufferException, BadPaddingException, IllegalBlockSizeException, ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException {
        byte[] cipherdata = Hex.decodeHex(ciphertext);
        Cipher cipher = Cipher.getInstance("AES/CTR/NoPadding");
        Object[] item = EVP_BytesToKey(password, keyLength, ivLength);
        byte[] key = (byte[]) item[0];
        byte[] iv = ArrayUtils.subarray(cipherdata, 0, ivLength);
        //byte[] counter = Bytes.concat(iv, new byte[4]);
        byte[] counter = getJ0Proxy(iv, key);
        inc(counter);
        final IvParameterSpec gcmParameterSpec = new IvParameterSpec(counter);
        final SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
        cipher.init(Cipher.DECRYPT_MODE, keySpec, gcmParameterSpec);
        byte[] data = ArrayUtils.subarray(cipherdata, 16, cipherdata.length);
        byte[] result = cipher.doFinal(data, 0, data.length);
        System.out.println(String.format("key: %s", Hex.encodeHexString(key)));
        System.out.println(String.format("iv: %s", Hex.encodeHexString(iv)));
        System.out.println(String.format("origin: %s", Hex.encodeHexString("hello".getBytes())));
        System.out.println(String.format("Ciphertext: %s", Hex.encodeHexString(data)));
        System.out.println(String.format("Cleartext: %s", Hex.encodeHexString(result)));
    }

    /**
     * if iv is not 96 bit,it need more complex approach to generate iv
     *
     * @param key
     * @return
     */
    public static final byte[] getSubKey(byte[] key) throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException {
        Class<?> galoisCounterMode = Class.forName("com.sun.crypto.provider.GaloisCounterMode");
        Class<?> aesCrypt = Class.forName("com.sun.crypto.provider.AESCrypt");
        Constructor constructor = aesCrypt.getDeclaredConstructor();
        constructor.setAccessible(true);
        Object aesCryptInstance = constructor.newInstance();
        Method aesInstanceInit = aesCrypt.getDeclaredMethod("init", boolean.class, String.class, byte[].class);
        aesInstanceInit.setAccessible(true);
        aesInstanceInit.invoke(aesCryptInstance, false, "AES", key);

        byte[] subKey = new byte[16];
        Method aesInstanceEncryptBlock = aesCrypt.getDeclaredMethod("encryptBlock", byte[].class, int.class, byte[].class, int.class);
        aesInstanceEncryptBlock.setAccessible(true);
        aesInstanceEncryptBlock.invoke(aesCryptInstance, new byte[16], 0, subKey, 0);
        return subKey;
    }

    /**
     * generator iv for CTR use.
     *
     * @param iv
     * @param subkey
     * @return
     */
    public static final byte[] getJ0Proxy(byte[] iv, byte[] subkey) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
        Class<?> galoisCounterMode = Class.forName("com.sun.crypto.provider.GaloisCounterMode");
        Method getJ0 = galoisCounterMode.getDeclaredMethod("getJ0", byte[].class, byte[].class);
        getJ0.setAccessible(true);
        return (byte[]) getJ0.invoke(null, iv, subkey);
    }

    /**
     * invok jdk com.sun.crypto.provider.GaloisCounterMode static method increment32
     *
     * @param counter iv
     */
    private static final void inc(byte[] counter) throws InvocationTargetException, IllegalAccessException, ClassNotFoundException, NoSuchMethodException {
        Class<?> galoisCounterMode = Class.forName("com.sun.crypto.provider.GaloisCounterMode");
        Method getJ0 = galoisCounterMode.getDeclaredMethod("increment32", byte[].class);
        getJ0.setAccessible(true);
        getJ0.invoke(null, counter);
    }

    /**
     * for generator key and iv
     *
     * @param password  password
     * @param keyLength keyLength
     * @param ivLength  ivLength
     * @return array have 2 element the index of 0 is key and index of 1 is iv.
     * @throws NoSuchAlgorithmException
     * @throws UnsupportedEncodingException
     */
    public static Object[] EVP_BytesToKey(String password, int keyLength, int ivLength) throws NoSuchAlgorithmException, UnsupportedEncodingException {
        ArrayList<byte[]> m = new ArrayList();
        int i = 0;
        while (getByteArray(m) < keyLength + ivLength) {
            String data = password;
            if (i > 0) {
                data = new String(m.get(i - 1), "ISO-8859-1") + password;
            }
            MessageDigest digest = MessageDigest.getInstance("MD5");

            byte[] dataDigest = digest.digest(data.getBytes("ISO-8859-1"));
            m.add(dataDigest);
            i += 1;
        }
        byte[] ms = joinByteArray(m);
        byte[] key = ArrayUtils.subarray(ms, 0, keyLength);
        byte[] iv = ArrayUtils.subarray(ms, keyLength, keyLength + ivLength);
        return new Object[]{key, iv};
    }

    public static int getByteArray(List<byte[]> array) {
        int length = 0;
        for (byte[] item : array) {
            length += item.length;
        }
        return length;
    }

    public static byte[] joinByteArray(List<byte[]> array) {
        int length = getByteArray(array);
        byte[] result = new byte[length];
        int pos = 0;
        for (byte[] item : array) {
            System.arraycopy(item, 0, result, pos, item.length);
            pos += item.length;
        }
        return result;
    }
}

结果:

--------------- descript with iv 12 ---------------
key: b36d331451a61eb2d76860e00c347396
iv: e0fc2227c40bc9ea9343a1fa
origin: 68656c6c6f
Ciphertext: a750a9ad00
Cleartext: 68656c6c6f
--------------- descript with iv 16 ---------------
key: b36d331451a61eb2d76860e00c347396
iv: e0fc2227c40bc9ea9343a1faafa4e23d
origin: 68656c6c6f
Ciphertext: a750a9ad00
Cleartext: dead0c78cf

当iv的长度不是96bit时，结果是错误的。

我希望有人能告诉我哪里出了问题。

提前致谢。

Answer 1

这是预期的结果。如果您查看 Nist 800-38D ，第 15 页，您会看到:

if len(IV)=96 then 
   Y0=IV||0^31||1 
else 
   Y0=GHASH(H,{},IV).

因此，较大的 IV 不会被修剪，因此建议进行额外的操作。通过这种方式，您的 IV 可以获得更高的熵。