问题描述
以下示例在64位桌面Ubuntu 16.04上正确地加密和解密为相同的原始字符串,但是当在Raspberry Pi(ARM)(以及另一个自定义Linux ARM板)上编译并运行相同的代码时,它将失败解密为原始字符串. Raspberry Pi和另一块ARM板都解密为相同但不正确的值.
The following example encrypts and decrypts to the same original string properly on a 64-bit Desktop Ubuntu 16.04, but when the same code is compiled and run on Raspberry Pi ( ARM ) ( and also another custom Linux ARM board ) it fails to decrypt to the original string. Both the Raspberry Pi and the other ARM board decrypt to the same, but incorrect, value.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/aes.h>
#include <openssl/crypto.h>
/* AES key for Encryption and Decryption */
const static unsigned char aes_key[]={0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF};
/* Print Encrypted and Decrypted data packets */
void print_data(const char *tittle, const void* data, int len);
int main( )
{
/* Input data to encrypt */
unsigned char aes_input[]={0x0,0x1,0x2,0x3,0x4,0x5};
fprintf(stderr,"%s\n",SSLeay_version(SSLEAY_VERSION));
/* Init vector */
unsigned char iv[AES_BLOCK_SIZE];
memset(iv, 0x00, AES_BLOCK_SIZE);
/* Buffers for Encryption and Decryption */
unsigned char enc_out[sizeof(aes_input)];
unsigned char dec_out[sizeof(aes_input)];
/* AES-128 bit CBC Encryption */
AES_KEY enc_key, dec_key;
AES_set_encrypt_key(aes_key, sizeof(aes_key)*8, &enc_key);
AES_cbc_encrypt(aes_input, enc_out, sizeof(aes_input), &enc_key, iv, AES_ENCRYPT);
/* AES-128 bit CBC Decryption */
memset(iv, 0x00, AES_BLOCK_SIZE); // don't forget to set iv vector again, else you can't decrypt data properly
AES_set_decrypt_key(aes_key, sizeof(aes_key)*8, &dec_key); // Size of key is in bits
AES_cbc_encrypt(enc_out, dec_out, sizeof(aes_input), &dec_key, iv, AES_DECRYPT);
/* Printing and Verifying */
print_data("\n Original ",aes_input, sizeof(aes_input)); // you can not print data as a string, because after Encryption its not ASCII
print_data("\n Encrypted",enc_out, sizeof(enc_out));
print_data("\n Decrypted",dec_out, sizeof(dec_out));
return 0;
}
void print_data(const char *tittle, const void* data, int len)
{
printf("%s : ",tittle);
const unsigned char * p = (const unsigned char*)data;
int i = 0;
for (; i<len; ++i)
printf("%02X ", *p++);
printf("\n");
}
Ubuntu结果:
OpenSSL 1.0.1f 6 Jan 2014
Original : 00 01 02 03 04 05
Encrypted : D5 40 D0 BB 16 1D
Decrypted : 00 01 02 03 04 05
Raspberry Pi结果:
Raspberry Pi result:
OpenSSL 1.0.2l 25 May 2017
Original : 00 01 02 03 04 05
Encrypted : D5 40 D0 BB 16 1D
Decrypted : D3 87 81 20 2B B9
自定义论坛结果:
OpenSSL 1.1.0f 25 May 2017
Original : 00 01 02 03 04 05
Encrypted : D5 40 D0 BB 16 1D
Decrypted : D3 87 81 20 2B B9
自定义面板(已更新OpenSSL以与Ubuntu匹配):
Custom Board ( Updated OpenSSL to match Ubuntu ):
OpenSSL 1.0.1f 6 Jan 2014
Original : 00 01 02 03 04 05
Encrypted : D5 40 D0 BB 16 1D
Decrypted : D3 87 81 20 2B B9
为什么开源libcrypto在Ubuntu和2台不同的ARM机器上的行为不同?
Why does open source libcrypto not behave the same on Ubuntu and 2 different ARM machines?
推荐答案
通常在CBC模式下,您使用的缓冲区大小是密码的块大小的倍数.这是CBC的本质,在CBC类型例程的每个openssl手册页中都提到了这一点(不幸的是,我在AES_cbc_encrypt
上找不到手册页或任何文档).
Normally with the CBC mode, you use a buffer of size which is a multiple of the block size of your cipher. This is the nature of CBC and it is mentioned in every openssl man page on CBC type routines (unfortunately I couldn't find a man page or any documentation on AES_cbc_encrypt
).
运气不好,似乎在某些平台上可以使用错误的缓冲区大小.若要查看实际情况,请为enc_out
多分配一个字节,并在加密后将该多余的字节清零.解密将失败.
The wrong buffer size appears to work on some platforms by sheer luck. To see what really happens, allocate one byte more for enc_out
and zero out that extra byte after encryption. Decryption will fail.
unsigned char enc_out[sizeof(aes_input) + 1];
...
AES_cbc_encrypt(aes_input, enc_out, sizeof(aes_input), &enc_key, iv, AES_ENCRYPT);
enc_out[sizeof(aes_input)] = 0;
在我的机器上输出修改后的代码:
Output of the modified code on my machine:
Original : 00 01 02 03 04 05
Encrypted : D5 40 D0 BB 16 1D 00
Decrypted : 89 FB 06 F4 CD 6A
未经修改的代码将产生正确的"输出.
Unmodified code produces the "correct" output.
这篇关于Linux libcrypto AES-128 CBC加密/解密只能在Ubuntu上使用,而不能在Raspberry Pi上使用的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持!