如何正确使用“PBEWithHmacSHA512AndAES_256”算法? [英] How do I properly use the "PBEWithHmacSHA512AndAES_256" algorithm?
问题描述
我正在做一些Java加密,无法找出正确使用PBEWithHmacSHA512AndAES_256算法的方法。
I'm doing some Java encryption, and cannot figure out a way to properly use the the PBEWithHmacSHA512AndAES_256 algorithm.
加密似乎工作正常,但我无法正确初始化解密密码。
Encryption seems to work fine, but I am unable to properly initialize a decryption cipher.
下面是一个演示该问题的简短程序。
特别是,请参阅问题评论。
Below is a short program that demonstrates the issue. In particular, see the "PROBLEM" comment.
注意:我已经看到这个非常有帮助的答案,我可以使用这个方案使事情工作,但我很好奇,知道我在这里做错了。
Note: I have seen this very helpful answer, and I can get things to work using that scheme, but I'm curious to know what I'm doing wrong here.
import java.nio.charset.StandardCharsets;
import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.PBEParameterSpec;
public final class CryptQuestion {
private static final String ALGORITHM = "PBEWithHmacSHA512AndAES_256";
private static final int ITERATIONS = 1000; // Aside: not sure what is a good number, here.
public static void main(final String[] args) throws Exception {
final String message = "This is the secret message... BOO!";
System.out.println("Original : " + message);
final byte[] messageBytes = message.getBytes(StandardCharsets.US_ASCII);
final String password = "some password";
final byte[] salt = "would be random".getBytes(StandardCharsets.US_ASCII);
// Create the Key
final SecretKeyFactory factory = SecretKeyFactory.getInstance(ALGORITHM);
final PBEKeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt, ITERATIONS);
SecretKey key = factory.generateSecret(keySpec);
// Build the encryption cipher.
final Cipher cipherEncrypt = Cipher.getInstance(ALGORITHM);
cipherEncrypt.init(Cipher.ENCRYPT_MODE, key);
// Encrypt!
final byte[] ciphertext = cipherEncrypt.doFinal(messageBytes);
final byte[] iv = cipherEncrypt.getIV();
// Now for decryption... The receiving end will have as input:
// * ciphertext
// * IV
// * password
// * salt
// We just re-use 'key' from above, since it will be identical.
final PBEParameterSpec pbeParamSpec = new PBEParameterSpec(salt, ITERATIONS);
final IvParameterSpec ivParamSpec = new IvParameterSpec(iv);
// Build the decryption cipher.
final Cipher cipherDecrypt = Cipher.getInstance(ALGORITHM);
// PROBLEM: If I pass "ivParamSpec", I get "java.security.InvalidAlgorithmParameterException: Wrong parameter type: PBE expected"
// Whereas if I pass pbeParamSpec, I get "java.security.InvalidAlgorithmParameterException: Missing parameter type: IV expected"
// What to do?
cipherDecrypt.init(
Cipher.DECRYPT_MODE,
key,
ivParamSpec
//pbeParamSpec
);
final String decrypted = new String(
cipherDecrypt.doFinal(ciphertext),
StandardCharsets.US_ASCII);
System.out.println("Decrypted: " + decrypted);
}
}
推荐答案
// PROBLEM: If I pass "ivParamSpec", I get "java.security.InvalidAlgorithmParameterException: Wrong parameter type: PBE expected"
// Whereas if I pass pbeParamSpec, I get "java.security.InvalidAlgorithmParameterException: Missing parameter type: IV expected"
// What to do?
cipherDecrypt.init(
Cipher.DECRYPT_MODE,
key,
ivParamSpec
//pbeParamSpec
);
使用 AlgorithmParameters
加密密码
:
cipherDecrypt.init(
Cipher.DECRYPT_MODE,
key,
cipherEncrypt.getParameters()
);
如果你想要一个更简洁的方法,不涉及 cipherEncrypt
在解密站点,将算法参数保存为字节,并将其与密钥数据一起传输:
If you want a cleaner way that doesn't involve cipherEncrypt
at the decrypting site, save the algorithm parameters as a byte and transmit them along with the key data:
byte[] algorithmParametersEncoded = cipherEncrypt.getParameters().getEncoded();
,然后在解密站点重构它们:
and reconstruct them at the decrypting site thus:
AlgorithmParameters algorithmParameters = AlgorithmParameters.getInstance(ALGORITHM);
algorithmParameters.init(algorithmParametersEncoded);
并使用 algorithmParameters
作为参数
参数 Cipher.init()
以上。
这篇关于如何正确使用“PBEWithHmacSHA512AndAES_256”算法?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!