openssl - 加密/解密输出缓冲区大小以及何时多次调用 EVP_EncryptUpdate

Question

我正在尝试使用 openssl 使用 AES 加密/解密消息。
经过以下研究:
https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption
http://www.itc.edu.kh/bib/ebook/storage/Network%20Security%20with%20OpenSSL.pdf (第 6 章)

我可以成功加密/解密。

我的场景是这样的:

1. Encrypt : Input plain text => encrypt with aes 256 cbc => return result in encode with base64
2. Decrypt: Input encrypted base64 encoded string => decode base64 => decrypt with aes 256 cbc => return decrypted plain text

但我有一些疑问:

1. How to allocate the encrypted buffer size: char *out = (char *) malloc(inLength + EVP_MAX_BLOCK_LENGTH); Is this enough? I admit that i didn't goes through the detail of encryption logic even though i have some concept. If someone can give me a hint of the size of encrypted size logic, i really be appreciate. Like base64 data to data ratio is 4:3. It has 33% overhead. But for encryption, i don't find this kind of information.

2. How to allocate the decrypted buffer size: b64decodeLen = decode b64 encrypted text. It should the original binary encrypted data length. char *out = (char *) malloc(b64decodeLen + 1);
   According to the above malloc of encrypted buffer size. I think the plain text size would be less than the binary encrypted data length. Is this right?

3. EVP_EncryptUpdate can be called multiple times if necessary. When to call multiple times? In which case we need to call multiple times? https://stackoverflow.com/questions/29016193/block-cipher-in-openssl-how-to-correct-crypt-and-decrypt-in-c

while(1){
    EVP_EncryptUpdate(ctx, ciphertext + outlen_tot, &outlen, (unsigned   char*)msg + outlen_tot, block_size);
    outlen_tot += outlen;
    if( msg_len - outlen_tot < block_size ){
        break;
    }
}

In this example, it encrypt for the block_size. If i put the input string length, then i don't need to call multiple times even for every large message?

EVP_EncryptUpdate(ctx, out, &out_len, inString, strlen(inString));

非常感谢。

Answer 1

填充加密数据后，密文大小为plaintext_size + (block_size - plaintext_size % block_size) .所以你的缓冲区应该足够了。在此处查看更多信息:https://en.wikipedia.org/wiki/Padding_(cryptography)

您已经自己回答了 - base64 的比率 (enc/dec) 是 4:3。示例代码和所有解释可以在这里找到:https://en.wikipedia.org/wiki/Base64

例如，如果由于某些技术原因(多个数据包、大文件)而无法在一次运行中传递整个纯文本，则您需要进行多次更新。或者您不希望您的明文留在内存中(以保护它免受内存抓取)。如果您不是这种情况 - 使用单个更新。