AES-128-CBC Base64加密——OC,Java,Golang联调

https://www.jianshu.com/p/eaa3d9df3ef5

AES-128-CBC

这里首先说说AES加密原理
AES加密算法采用分组密码体制,每个分组数据的长度为128位16个字节,密钥长度可以是128位16个字节、192位或256位,一共有四种加密模式(ECB、CBC、CFB、OFB),我们通常采用需要初始向量IV的CBC模式,初始向量的长度规定是128位16个字节。另外就是Padding,这里面有大坑。。。。先说一下Padding的三种模式PKCS5、PKCS7和NOPADDING。PKCS5是指分组数据缺少几个字节,就在数据的末尾填充几个字节的几,比如缺少5个字节,就在末尾填充5个字节的5。PKCS7是指分组数据缺少几个字节,就在数据的末尾填充几个字节的0,比如缺少7个字节,就在末尾填充7个字节的0。NoPadding是指不需要填充,也就是说数据的发送方肯定会保证最后一段数据也正好是16个字节。而PKCS5如果正好是16个字节且最后是16的时候则会再填充16个16用来区分,PKC7则是为0时填充16个0。而在iOS的OC方法里压根没提供PKCS5,只有PKCS7更坑的是真正对接时发现iOS上的PKCS7和其他端PKCS5是一样的。。。。所以才有了现在的想法分享一下踩过的坑,具体啥原因恐怕只有苹果自家知道,系统方法是真的坑!Java可以直接用系统方法填好设置结束战斗。。。Go的话padding这块自己写实现其他的系统都能设置。最后说一下密钥长度这里只有iOS是要自己设置好位数再对应位数写密钥,其他平台直接对应位数写密钥即可,所以最好各平台自己在封装下判断密钥长度出事向量长度,不然各端对应起来还是要犯傻。

Base64

下面说一下Base64,这个也是个坑,iOS系统提供的base64可选类型压根就不是已知领域常用的,正常是padding和websafe,padding会填充=,而websafe则会替换”+”为”-“,”\”为”_“
而iOS提供的则是下边的,完全不常用的。。。

  1. NSDataBase64Encoding64CharacterLineLength 其作用是将生成的Base64字符串按照64个字符长度进行等分换行。
  2. NSDataBase64Encoding76CharacterLineLength 其作用是将生成的Base64字符串按照76个字符长度进行等分换行。
  3. NSDataBase64EncodingEndLineWithCarriageReturn 其作用是将生成的Base64字符串以回车结束。
  4. NSDataBase64EncodingEndLineWithLineFeed 其作用是将生成的Base64字符串以换行结束。

基本上GTMBase64用定了,然后还要扩展一下padding设置,原版只是把websafe模式开放了padding设置,内部其实有对应逻辑只需要自己加个方法调用一下即可。下面就是添加的和微改的两个方法

  1. +(NSString *)stringByEncodingData:(NSData *)data padded:(BOOL)padded{
  2. NSString *result = nil;
  3. NSData *converted = [self baseEncode:[data bytes]
  4. length:[data length]
  5. charset:kBase64EncodeChars
  6. padded:padded];
  7. if (converted) {
  8. result = [[[NSString alloc] initWithData:converted
  9. encoding:NSUTF8StringEncoding] autorelease];
  10. }
  11. return result;
  12. }
  13. +(NSData *)decodeString:(NSString *)string {
  14. NSData *result = nil;
  15. NSData *data = [string dataUsingEncoding:NSUTF8StringEncoding];
  16. if (data) {
  17. result = [self baseDecode:[data bytes]
  18. length:[data length]
  19. charset:kBase64DecodeChars
  20. requirePadding:NO];
  21. }
  22. return result;
  23. }

至于Java,android开发很爽直接用android.util.base64,里面直接可以设置nopadding和websafe等,而纯Java用java.util.base64就要自己写替换逻辑,具体代码见源码部分
最后说一下Go直接系统方法提供完美解决

  1. base64.StdEncoding
  2. base64.URLEncoding websafe模式
  3. base64.RawStdEncoding nopadding
  4. base64.RawURLEncoding websafe模式nopadding

AES-128-CBC +Base64-Nopadding源码

下面就是3中语言分别实现 AES-128-CBC +Base64-Nopadding,从编码体验和对应上很明显Java最清晰,Go要自己写点东西,OC则是连对应对和正常理解范围内有偏差。

OC

  1. #import <Foundation/Foundation.h>
  2. #import <CommonCrypto/CommonCryptor.h>
  3. @interface NSData (Encryption)
  4. - (NSData *)AES128EncryptWithKey:(NSString *)key Iv:(NSString *)Iv; //加密
  5. - (NSData *)AES128DecryptWithKey:(NSString *)key Iv:(NSString *)Iv; //解密
  6. @end
  7. @implementation NSData (Encryption)
  8. //(key和iv向量这里是16位的) 这里是CBC加密模式,安全性更高
  9. - (NSData *)AES128EncryptWithKey:(NSString *)key Iv:(NSString *)Iv{//加密
  10. // 'key' should be 32 bytes for AES128, will be null-padded otherwise
  11. char keyPtr[kCCKeySizeAES128+1]; // room for terminator (unused)
  12. bzero(keyPtr, sizeof(keyPtr)); // fill with zeroes (for padding)
  13. // fetch key data
  14. [key getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];
  15. char ivPtr[kCCKeySizeAES128+1];
  16. memset(ivPtr, 0, sizeof(ivPtr));
  17. [Iv getCString:ivPtr maxLength:sizeof(ivPtr) encoding:NSUTF8StringEncoding];
  18. NSUInteger dataLength = [self length];
  19. //See the doc: For block ciphers, the output size will always be less than or
  20. //equal to the input size plus the size of one block.
  21. //That's why we need to add the size of one block here
  22. size_t bufferSize = dataLength + kCCBlockSizeAES128;
  23. void *buffer = malloc(bufferSize);
  24. size_t numBytesEncrypted = 0;
  25. CCCryptorStatus cryptStatus = CCCrypt(kCCEncrypt, kCCAlgorithmAES128, kCCOptionPKCS7Padding,
  26. keyPtr, kCCKeySizeAES128,
  27. ivPtr /* initialization vector (optional) */,
  28. [self bytes], dataLength, /* input */
  29. buffer, bufferSize, /* output */
  30. &numBytesEncrypted);
  31. if (cryptStatus == kCCSuccess) {
  32. //the returned NSData takes ownership of the buffer and will free it on deallocation
  33. return [NSData dataWithBytesNoCopy:buffer length:numBytesEncrypted];
  34. }
  35. free(buffer); //free the buffer;
  36. return nil;
  37. }
  38. - (NSData *)AES128DecryptWithKey:(NSString *)key Iv:(NSString *)Iv{//解密
  39. char keyPtr[kCCKeySizeAES128+1]; // room for terminator (unused)
  40. bzero(keyPtr, sizeof(keyPtr)); // fill with zeroes (for padding)
  41. // fetch key data
  42. [key getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];
  43. char ivPtr[kCCKeySizeAES128+1];
  44. memset(ivPtr, 0, sizeof(ivPtr));
  45. [Iv getCString:ivPtr maxLength:sizeof(ivPtr) encoding:NSUTF8StringEncoding];
  46. NSUInteger dataLength = [self length];
  47. //See the doc: For block ciphers, the output size will always be less than or
  48. //equal to the input size plus the size of one block.
  49. //That's why we need to add the size of one block here
  50. size_t bufferSize = dataLength + kCCBlockSizeAES128;
  51. void *buffer = malloc(bufferSize);
  52. size_t numBytesDecrypted = 0;
  53. CCCryptorStatus cryptStatus = CCCrypt(kCCDecrypt, kCCAlgorithmAES128, kCCOptionPKCS7Padding,
  54. keyPtr, kCCKeySizeAES128,
  55. ivPtr /* initialization vector (optional) */,
  56. [self bytes], dataLength, /* input */
  57. buffer, bufferSize, /* output */
  58. &numBytesDecrypted);
  59. if (cryptStatus == kCCSuccess) {
  60. //the returned NSData takes ownership of the buffer and will free it on deallocation
  61. return [NSData dataWithBytesNoCopy:buffer length:numBytesDecrypted];
  62. }
  63. free(buffer); //free the buffer;
  64. return nil;
  65. }
  66. @end
  67. @interface SecurityCore
  68. + (NSString*)encryptAESString:(NSString*)string;
  69. + (NSString*)decryptAESString:(NSString*)string;
  70. @end
  71. @implementation SecurityCore
  72. #pragma mark - AES加密
  73. const NSString * skey=@"dde4b1f8a9e6b814"
  74. const NSString * ivParameter =@"dde4b1f8a9e6b814"
  75. //将string转成带密码的data
  76. +(NSString*)encryptAESString:(NSString*)string
  77. {
  78. //将nsstring转化为nsdata
  79. NSData *data = [string dataUsingEncoding:NSUTF8StringEncoding];
  80. //使用密码对nsdata进行加密
  81. NSData *encryptedData = [data AES128EncryptWithKey:skey Iv:ivParameter];
  82. NSString *encryptedString=[GTMBase64 stringByEncodingData:encryptedData padded:NO];
  83. return encryptedString;
  84. }
  85. + (NSString*)decryptAESString:(NSString*)string{
  86. //将nsstring转化为nsdata
  87. NSData *data = [GTMBase64 decodeString:string];
  88. NSData *decryptData = [data AES128DecryptWithKey:skey Iv:ivParameter];
  89. NSString *str = [[NSString alloc] initWithData:decryptData encoding:NSUTF8StringEncoding];
  90. return [str autorelease];
  91. }
  92. @end

Java

  1. import javax.crypto.Cipher;
  2. import javax.crypto.spec.IvParameterSpec;
  3. import javax.crypto.spec.SecretKeySpec;
  4. import java.util.Base64;
  5. public class SecurityCore {
  6. /*
  7. * 加密用的Key 可以用26个字母和数字组成 此处使用AES-128-CBC加密模式,key需要为16位。
  8. */
  9. private String sKey = "dde4b1f8a9e6b814";
  10. private String ivParameter = "dde4b1f8a9e6b814";
  11. private static SecurityCore instance = null;
  12. private SecurityCore() {
  13. }
  14. public static SecurityCore getInstance() {
  15. if (instance == null)
  16. instance = new SecurityCore();
  17. return instance;
  18. }
  19. public static String webSafeBase64StringEncoding(byte[] sSrc,boolean padded) throws Exception {
  20. String encodeString=Base64.getEncoder().encodeToString(sSrc);// 此处使用BASE64做转码。
  21. //websafe base64
  22. encodeString=encodeString.replace("+","-");
  23. encodeString=encodeString.replace("/","_");
  24. //nopadding base64
  25. if (!padded) {
  26. if (encodeString.endsWith("=")) {
  27. encodeString = encodeString.substring(0, encodeString.length() - 1);
  28. if (encodeString.endsWith("=")) {
  29. encodeString = encodeString.substring(0, encodeString.length() - 1);
  30. }
  31. }
  32. }
  33. return encodeString;
  34. }
  35. public static byte[] webSafeBase64StringDecoding(String sSrc) throws Exception {
  36. //websafe base64
  37. sSrc=sSrc.replace("-","+");
  38. sSrc=sSrc.replace("_","/");
  39. return Base64.getDecoder().decode(sSrc);
  40. }
  41. public static String base64StringEncoding(byte[] sSrc,boolean padded) throws Exception {
  42. String encodeString=Base64.getEncoder().encodeToString(sSrc);// 此处使用BASE64做转码。
  43. //nopadding base64
  44. if (!padded) {
  45. if (encodeString.endsWith("=")) {
  46. encodeString = encodeString.substring(0, encodeString.length() - 1);
  47. if (encodeString.endsWith("=")) {
  48. encodeString = encodeString.substring(0, encodeString.length() - 1);
  49. }
  50. }
  51. }
  52. return encodeString;
  53. }
  54. public static byte[] base64StringDecoding(String sSrc) throws Exception {
  55. return Base64.getDecoder().decode(sSrc);
  56. }
  57. public static byte[] AES128CBCStringEncoding(String encData ,String secretKey,String vector) throws Exception {
  58. if(secretKey == null) {
  59. return null;
  60. }
  61. if(secretKey.length() != 16) {
  62. return null;
  63. }
  64. if (vector != null && vector.length() != 16) {
  65. return null;
  66. }
  67. Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
  68. byte[] raw = secretKey.getBytes();
  69. SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
  70. IvParameterSpec iv = new IvParameterSpec(vector.getBytes());// 使用CBC模式,需要一个向量iv,可增加加密算法的强度
  71. cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);
  72. byte[] encrypted = cipher.doFinal(encData.getBytes("utf-8"));
  73. return encrypted;
  74. }
  75. public static String AES128CBCStringDecoding(byte[] sSrc,String key,String ivs) throws Exception {
  76. try {
  77. if(key == null) {
  78. return null;
  79. }
  80. if(key.length() != 16) {
  81. return null;
  82. }
  83. if (ivs != null && ivs.length() != 16) {
  84. return null;
  85. }
  86. byte[] raw = key.getBytes("ASCII");
  87. SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
  88. Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
  89. IvParameterSpec iv = new IvParameterSpec(ivs.getBytes());
  90. cipher.init(Cipher.DECRYPT_MODE, skeySpec, iv);
  91. byte[] original = cipher.doFinal(sSrc);
  92. String originalString = new String(original, "utf-8");
  93. return originalString;
  94. } catch (Exception ex) {
  95. return null;
  96. }
  97. }
  98. // 加密
  99. public String encrypt(String sSrc) throws Exception {
  100. try {
  101. String encodeString=base64StringEncoding(AES128CBCStringEncoding(sSrc,sKey,ivParameter),false);
  102. return encodeString;
  103. } catch (Exception ex) {
  104. return null;
  105. }
  106. }
  107. // 解密
  108. public String decrypt(String sSrc) throws Exception {
  109. try {
  110. String decodeString=AES128CBCStringDecoding(base64StringDecoding(sSrc),sKey,ivParameter);
  111. return decodeString;
  112. } catch (Exception ex) {
  113. return null;
  114. }
  115. }
  116. //test
  117. public static void main(String[] args) throws Exception {
  118. // 需要加密的字串
  119. String cSrc = "123";
  120. // 加密
  121. long lStart = System.currentTimeMillis();
  122. String enString = SecurityCore.getInstance().encrypt(cSrc);
  123. System.out.println("加密后的字串是:" + enString);
  124. long lUseTime = System.currentTimeMillis() - lStart;
  125. System.out.println("加密耗时:" + lUseTime + "毫秒");
  126. // 解密
  127. lStart = System.currentTimeMillis();
  128. String DeString = SecurityCore.getInstance().decrypt(enString);
  129. System.out.println("解密后的字串是:" + DeString);
  130. lUseTime = System.currentTimeMillis() - lStart;
  131. System.out.println("解密耗时:" + lUseTime + "毫秒");
  132. }
  133. }

Golang

  1. package main
  2. import(
  3. "fmt"
  4. "crypto/aes"
  5. "crypto/cipher"
  6. "encoding/base64"
  7. "bytes"
  8. )
  9. const (
  10. sKey = "dde4b1f8a9e6b814"
  11. ivParameter = "dde4b1f8a9e6b814"
  12. )
  13. /加密
  14. func PswEncrypt(src string)(string){
  15. key := []byte(sKey)
  16. iv := []byte(ivParameter)
  17. result, err := Aes128Encrypt([]byte(src), key, iv)
  18. if err != nil {
  19. panic(err)
  20. }
  21. return base64.RawStdEncoding.EncodeToString(result)
  22. }
  23. //解密
  24. func PswDecrypt(src string)(string) {
  25. key := []byte(sKey)
  26. iv := []byte(ivParameter)
  27. var result []byte
  28. var err error
  29. result,err=base64.RawStdEncoding.DecodeString(src)
  30. if err != nil {
  31. panic(err)
  32. }
  33. origData, err := Aes128Decrypt(result, key, iv)
  34. if err != nil {
  35. panic(err)
  36. }
  37. return string(origData)
  38. }
  39. func Aes128Encrypt(origData, key []byte,IV []byte) ([]byte, error) {
  40. if key == nil || len(key) != 16 {
  41. return nil, nil
  42. }
  43. if IV != nil && len(IV) != 16 {
  44. return nil, nil
  45. }
  46. block, err := aes.NewCipher(key)
  47. if err != nil {
  48. return nil, err
  49. }
  50. blockSize := block.BlockSize()
  51. origData = PKCS5Padding(origData, blockSize)
  52. blockMode := cipher.NewCBCEncrypter(block, IV[:blockSize])
  53. crypted := make([]byte, len(origData))
  54. // 根据CryptBlocks方法的说明,如下方式初始化crypted也可以
  55. blockMode.CryptBlocks(crypted, origData)
  56. return crypted, nil
  57. }
  58. func Aes128Decrypt(crypted, key []byte,IV []byte) ([]byte, error) {
  59. if key == nil || len(key) != 16 {
  60. return nil, nil
  61. }
  62. if IV != nil && len(IV) != 16 {
  63. return nil, nil
  64. }
  65. block, err := aes.NewCipher(key)
  66. if err != nil {
  67. return nil, err
  68. }
  69. blockSize := block.BlockSize()
  70. blockMode := cipher.NewCBCDecrypter(block,IV[:blockSize])
  71. origData := make([]byte, len(crypted))
  72. blockMode.CryptBlocks(origData, crypted)
  73. origData = PKCS5UnPadding(origData)
  74. return origData, nil
  75. }
  76. func PKCS5Padding(ciphertext []byte, blockSize int) []byte {
  77. padding := blockSize - len(ciphertext)%blockSize
  78. padtext := bytes.Repeat([]byte{byte(padding)}, padding)
  79. return append(ciphertext, padtext...)
  80. }
  81. func PKCS5UnPadding(origData []byte) []byte {
  82. length := len(origData)
  83. // 去掉最后一个字节 unpadding 次
  84. unpadding := int(origData[length-1])
  85. return origData[:(length - unpadding)]
  86. }
  87. func main(){
  88. encodingString := PswEncrypt("123")
  89. decodingString := PswDecrypt(encodingString);
  90. fmt.Printf("AES-128-CBC\n加密:%s\n解密:%s\n",encodingString,decodingString)
  91. }