我正在尝试使用Openssl编写一个示例程序来进行AES加密.我试过通过Openssl文档(这是一个痛苦),无法弄清楚.我仔细检查了代码并发现了API的使用方法,我编写了一个小程序,如下所示(请省略行号).我没有看到任何加密发生...我错过了什么？
PS:编译时我没有遇到任何错误.
1 #include <stdio.h>
2 #include <openssl/aes.h>
3
4 static const unsigned char key[] = {
5 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
6 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
7 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
8 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
9 };
10
11 void main()
12 {
13 unsigned char text[]="virident";
14 unsigned char out[10];
15 unsigned char decout[10];
16
17 AES_KEY wctx;
18
19 AES_set_encrypt_key(key, 128, &wctx);
20 AES_encrypt(text, out, &wctx);
21
22 printf("encryp data = %s\n", out);
23
24 AES_decrypt(out, decout, &wctx);
25 printf(" Decrypted o/p: %s \n", decout);
26
27
28 }
请帮我解决这个问题......
abh*_*bhi 34
查看此链接,它有一个示例代码,使用AES256CBC使用EVP API加密/解密数据.
https://github.com/saju/misc/blob/master/misc/openssl_aes.c
您也可以在https://github.com/llubu/mpro上开发的详细开源项目中查看AES256 CBC的使用情况.
代码很详细,带有注释,如果你仍然需要关于API本身的很多解释,我建议你查看这本书的网络安全与OpenSSL by Viega/Messier/Chandra(google it你很容易找到这个的pdf ..)阅读章节6这是特定于使用EVP API的对称密码.这帮助我实际了解使用EVP的各种功能和结构背后的原因.
如果你想深入了解Openssl加密库,我建议从openssl网站(你的机器上安装的版本)下载代码,然后查看EVP和aeh api实现的实现.
你在上面发布的代码中再提出一个建议,我看到你正在使用aes.h中的api而不是使用EVP.check在这里做这个的原因OpenSSL使用EVP与算法API进行对称加密很好地解释了Daniel在其中一个我问的问题..
jww*_*jww 26
我正在尝试使用Openssl编写一个示例程序来进行AES加密.
这个答案很受欢迎,所以我会提供更新的东西,因为OpenSSL增加了一些可能对你有帮助的操作模式.
首先,不要使用AES_encrypt和AES_decrypt.它们水平低,使用起来比较困难.此外,它是一个纯软件程序,它永远不会使用硬件加速,如AES-NI.最后,它涉及一些不起眼的平台上的结束问题.
相反,使用EVP_*接口.这些EVP_*功能使用硬件加速,如AES-NI(如果可用).并且它不会在模糊的平台上遭受endianess问题.
其次,您可以使用类似CBC的模式,但密文将缺乏完整性和真实性保证.所以你通常需要一个像EAX,CCM或GCM这样的模式.(或者您在单独密钥下加密后手动必须应用HMAC.)
第三,OpenSSL有一个你可能感兴趣的维基页面:EVP Authenticated Encryption and Decryption.它使用GCM模式.
最后,这是使用AES/GCM加密的程序.OpenSSL wiki示例基于它.
#include <openssl/evp.h>
#include <openssl/aes.h>
#include <openssl/err.h>
#include <string.h>
int main(int arc, char *argv[])
{
OpenSSL_add_all_algorithms();
ERR_load_crypto_strings();
/* Set up the key and iv. Do I need to say to not hard code these in a real application? :-) */
/* A 256 bit key */
static const unsigned char key[] = "01234567890123456789012345678901";
/* A 128 bit IV */
static const unsigned char iv[] = "0123456789012345";
/* Message to be encrypted */
unsigned char plaintext[] = "The quick brown fox jumps over the lazy dog";
/* Some additional data to be authenticated */
static const unsigned char aad[] = "Some AAD data";
/* Buffer for ciphertext. Ensure the buffer is long enough for the
* ciphertext which may be longer than the plaintext, dependant on the
* algorithm and mode
*/
unsigned char ciphertext[128];
/* Buffer for the decrypted text */
unsigned char decryptedtext[128];
/* Buffer for the tag */
unsigned char tag[16];
int decryptedtext_len = 0, ciphertext_len = 0;
/* Encrypt the plaintext */
ciphertext_len = encrypt(plaintext, strlen(plaintext), aad, strlen(aad), key, iv, ciphertext, tag);
/* Do something useful with the ciphertext here */
printf("Ciphertext is:\n");
BIO_dump_fp(stdout, ciphertext, ciphertext_len);
printf("Tag is:\n");
BIO_dump_fp(stdout, tag, 14);
/* Mess with stuff */
/* ciphertext[0] ^= 1; */
/* tag[0] ^= 1; */
/* Decrypt the ciphertext */
decryptedtext_len = decrypt(ciphertext, ciphertext_len, aad, strlen(aad), tag, key, iv, decryptedtext);
if(decryptedtext_len < 0)
{
/* Verify error */
printf("Decrypted text failed to verify\n");
}
else
{
/* Add a NULL terminator. We are expecting printable text */
decryptedtext[decryptedtext_len] = '\0';
/* Show the decrypted text */
printf("Decrypted text is:\n");
printf("%s\n", decryptedtext);
}
/* Remove error strings */
ERR_free_strings();
return 0;
}
void handleErrors(void)
{
unsigned long errCode;
printf("An error occurred\n");
while(errCode = ERR_get_error())
{
char *err = ERR_error_string(errCode, NULL);
printf("%s\n", err);
}
abort();
}
int encrypt(unsigned char *plaintext, int plaintext_len, unsigned char *aad,
int aad_len, unsigned char *key, unsigned char *iv,
unsigned char *ciphertext, unsigned char *tag)
{
EVP_CIPHER_CTX *ctx = NULL;
int len = 0, ciphertext_len = 0;
/* Create and initialise the context */
if(!(ctx = EVP_CIPHER_CTX_new())) handleErrors();
/* Initialise the encryption operation. */
if(1 != EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
handleErrors();
/* Set IV length if default 12 bytes (96 bits) is not appropriate */
if(1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, 16, NULL))
handleErrors();
/* Initialise key and IV */
if(1 != EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv)) handleErrors();
/* Provide any AAD data. This can be called zero or more times as
* required
*/
if(aad && aad_len > 0)
{
if(1 != EVP_EncryptUpdate(ctx, NULL, &len, aad, aad_len))
handleErrors();
}
/* Provide the message to be encrypted, and obtain the encrypted output.
* EVP_EncryptUpdate can be called multiple times if necessary
*/
if(plaintext)
{
if(1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
handleErrors();
ciphertext_len = len;
}
/* Finalise the encryption. Normally ciphertext bytes may be written at
* this stage, but this does not occur in GCM mode
*/
if(1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len)) handleErrors();
ciphertext_len += len;
/* Get the tag */
if(1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, 16, tag))
handleErrors();
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
return ciphertext_len;
}
int decrypt(unsigned char *ciphertext, int ciphertext_len, unsigned char *aad,
int aad_len, unsigned char *tag, unsigned char *key, unsigned char *iv,
unsigned char *plaintext)
{
EVP_CIPHER_CTX *ctx = NULL;
int len = 0, plaintext_len = 0, ret;
/* Create and initialise the context */
if(!(ctx = EVP_CIPHER_CTX_new())) handleErrors();
/* Initialise the decryption operation. */
if(!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
handleErrors();
/* Set IV length. Not necessary if this is 12 bytes (96 bits) */
if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, 16, NULL))
handleErrors();
/* Initialise key and IV */
if(!EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv)) handleErrors();
/* Provide any AAD data. This can be called zero or more times as
* required
*/
if(aad && aad_len > 0)
{
if(!EVP_DecryptUpdate(ctx, NULL, &len, aad, aad_len))
handleErrors();
}
/* Provide the message to be decrypted, and obtain the plaintext output.
* EVP_DecryptUpdate can be called multiple times if necessary
*/
if(ciphertext)
{
if(!EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
handleErrors();
plaintext_len = len;
}
/* Set expected tag value. Works in OpenSSL 1.0.1d and later */
if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, tag))
handleErrors();
/* Finalise the decryption. A positive return value indicates success,
* anything else is a failure - the plaintext is not trustworthy.
*/
ret = EVP_DecryptFinal_ex(ctx, plaintext + len, &len);
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
if(ret > 0)
{
/* Success */
plaintext_len += len;
return plaintext_len;
}
else
{
/* Verify failed */
return -1;
}
}
小智 20
我不知道你的问题是什么,但有一点可以确定你需要AES_set_decrypt_key()在解密邮件之前打电话.也不要尝试打印为%s,因为加密的消息不再由ascii字符组成..例如:
static const unsigned char key[] = {
0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
};
int main()
{
unsigned char text[]="hello world!";
unsigned char enc_out[80];
unsigned char dec_out[80];
AES_KEY enc_key, dec_key;
AES_set_encrypt_key(key, 128, &enc_key);
AES_encrypt(text, enc_out, &enc_key);
AES_set_decrypt_key(key,128,&dec_key);
AES_decrypt(enc_out, dec_out, &dec_key);
int i;
printf("original:\t");
for(i=0;*(text+i)!=0x00;i++)
printf("%X ",*(text+i));
printf("\nencrypted:\t");
for(i=0;*(enc_out+i)!=0x00;i++)
printf("%X ",*(enc_out+i));
printf("\ndecrypted:\t");
for(i=0;*(dec_out+i)!=0x00;i++)
printf("%X ",*(dec_out+i));
printf("\n");
return 0;
}
U1:你的钥匙是192位不是吗......
我的建议是跑
openssl enc -aes-256-cbc -in plain.txt -out encrypted.bin
在调试器下,看看它到底在做什么.openssl.c是OpenSSL唯一真正的教程/入门/参考指南.所有其他文档只是一个API参考.
U1:我的猜测是你没有设置一些其他必需的选项,比如操作模式(填充).
U2:这可能是这个问题的重复: AES CTR 256加密OpenSSL上的操作模式 和答案可能会有所帮助.