转换ColdFusion的加密code到C＃ [英] Converting Coldfusion encryption code to C#

问题描述

我有包括code的一节，加密变量这样的ColdFusion页：

I have a Coldfusion page that includes a section of code that encrypts a variable like this:

<cfset data64 = toBase64(key)>
<cfset encryptedID = encrypt(getUser.ID, data64, "BLOWFISH", "Base64")>

我们要搬到现场，基于.NET的CMS，我需要这个页面转换成C＃，但我遇到了麻烦。

We're moving the site to a .NET-based CMS, and I need to convert this page to C#, but I'm running into trouble.

我已经成功转换的第一行是：

I've successfully converted the first line to this:

byte[] keyBytes = System.Text.Encoding.UTF8.GetBytes(key);
string keyBase64 = System.Convert.ToBase64String(keyBytes);

我还添加在 https://defuse.ca/blowfish.htm <发现blowfish.cs类/ A>，但我对如何使用这跟键有点模糊（我是否要使用欧洲央行是，CBC，或CTR）。我也不能肯定模拟是在ColdFusion中使用base64编码是什么......这就是我目前正试图，它不产生相同的结果原来的code：

I've also added the blowfish.cs class found at https://defuse.ca/blowfish.htm, but I'm a little fuzzy on how to use this with the key (and whether I want to be using ECB, CBC, or CTR). I'm also not sure what the analog is to using the base64 encoding in Coldfusion... this is what I'm currently trying, which is not producing the same results as the original code:

BlowFish b = new BlowFish(keyBase64);
byte[] idBytes = System.Text.Encoding.UTF8.GetBytes(thisUser["ID"].ToString());
byte[] idBytesEncrypted = b.Encrypt_ECB(idBytes);
string idBase64 = System.Convert.ToBase64String(idBytesEncrypted);

我没有与一般的加密很多经验和ColdFusion的code的建立与其他开发谁不有C＃经验的帮助。任何建议将是多少AP preciated。谢谢！

I don't have much experience with encryption in general, and the Coldfusion code was set up with the help of another developer who doesn't have C# experience. Any suggestions would be much appreciated. Thank you!

推荐答案

您可能会想尝试 BouncyCastle的C＃API 。我跑了几个测试，POC，和它似乎产生相同的结果作为你的CF code。

You might want to try the BouncyCastle C# API. I ran a few tests, for POC, and it seemed to produce the same results as your CF code.

有几件事情要记住：如果你读这篇文章的强大的加密该解释说，ColdFusion的使用模式EBC和PKCS5Padding默认。所以，当你使用算法速记河豚，你实际上是使用河豚/ ECB / PKCS5Padding 。为了复制在C＃中的加密（或任何语言），则需要使用相同的设置。

A few things to keep in mind: If you read this article on Strong Encryption in ColdFusion it explains that ColdFusion uses EBC mode and PKCS5Padding by default. So when you use the algorithm shorthand Blowfish, you are actually using Blowfish/ECB/PKCS5Padding. In order to duplicate the encryption in C# (or any language), you need to use those same settings.

似乎没有被很多关于C＃的端口的文档，但是从我可以告诉 BlowfishEngine 默认为EBC模式。所以，如果你在 PaddedBufferedBlockCipher ，结果其包装应PKCS5填充。这应该给你相同的结果，你的CF code：

There does not seem to be a lot of documentation for the C# port, but from what I can tell the BlowfishEngine defaults to EBC mode. So if you wrap it in a PaddedBufferedBlockCipher the result should be PKCS5 padded. That should give you the same result as your CF code:

    byte[] inputBytes = System.Text.Encoding.UTF8.GetBytes(userIDString);
    byte[] keyBytes = System.Convert.FromBase64String(keyInBase64);

    // initialize for EBC mode and PKCS5/PKCS7 padding
    PaddedBufferedBlockCipher cipher = new PaddedBufferedBlockCipher(new BlowfishEngine());
    KeyParameter param = new KeyParameter(keyBytes);
    cipher.Init(true, param);

    // encrypt and encode as base64
    byte[] encryptedBytes =  cipher.DoFinal(inputBytes);
    string idBase64 = System.Convert.ToBase64String(encryptedBytes);

注：我不是加密的专家，但会说，使用ECB模式被劝阻。请参见维基为什么的一个很好的例证。所以，你应该认真考虑的choosing不同的模式。

NB: I am not an expert on encryption, but will say that use of "ECB" mode is discouraged. See wiki for a good illustration of why. So you should seriously consider choosing a different mode.

这篇关于转换ColdFusion的加密code到C＃的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！