为什么 OpenSSL EVP C 库和 Python 之间生成的密文存在差异？

Question

我看到生成的密文有所不同（解密也失败了，但那是另一回事了——我首先需要加密输出正确/符合预期）。我运行使用 Python ( Pycryptodome) 加密，看到标签和加密数据的不同结果。我不确定在假设 OpenSSL 库需要什么时哪里出错了。

为清楚起见，我使用的是 AES-256 GCM 模式。

我也试过使用这个网站来动态生成加密数据，虽然它不允许添加 aad，但密文与我通过 Python 脚本得到的相匹配。

C代码

int gcm_enc_dec( cipher_params_t * params) {
  int out_len, ret;
  EVP_CIPHER_CTX *ctx;
  const EVP_CIPHER *cipher_type;

  switch(params->cipher_sel) {
    case 0: cipher_type  = EVP_aes_128_gcm();
        break;
    case 1: cipher_type  = EVP_aes_256_gcm();
        break;
    case 2: cipher_type  = EVP_aes_192_gcm();
        break;
    default: cipher_type  = EVP_aes_128_gcm();
         break;
  }

  if(!(ctx = EVP_CIPHER_CTX_new()))
    handleErrors();

  if(1 != (EVP_CipherInit_ex(ctx, cipher_type, NULL, NULL, NULL, params->encryption_mode)))
      handleErrors();
  if(!EVP_CipherInit_ex(ctx, NULL, NULL, params->key, params->iv, params->encryption_mode))
     handleErrors();


if(1 != EVP_CipherUpdate(ctx, NULL, &out_len, params->aad, params->aad_len))
  handleErrors();

if(params->encryption_mode) {
  if(1 != EVP_CipherUpdate(ctx, params->ct, &out_len, params->pt, params->pt_len))
    handleErrors();
    params->ct_len = out_len;
   } else {
     if(1 != EVP_CipherUpdate(ctx, params->pt, &out_len, params->ct, params->ct_len))
        handleErrors();
      params->pt_len = out_len;
   }

额外的 C 代码

  char key[32] = { 0xfe, 0xff,0xe9,0x92,0x86,0x65,0x73,0x1c,0x6d,0x6a,0x8f,0x94,0x67,0x30,0x83,0x08,0xfe,0xff,0xe9,0x92,0x86,0x65,0x73,0x1c,0x6d,0x6a,0x8f,0x94,0x67,0x30,0x83,0x08 };
  char iv[16] = {0xca,0xfe,0xba,0xbe,0xfa,0xce,0xdb,0xad,0xde,0xca,0xf8,0x88};
  char pt[1024] = { 0xd9,0x31,0x32,0x25,0xf8,0x84,0x16,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,0x86,0xa7,0xa9,0x53,
0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,
0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39 };
  char aad[20] = { 0xfe,0xed,0xfa,0xce,0xde,0xad,0xbe,0xef,0xfe,0xed,0xfa,0xce,0xde,0xad,0xbe,0xef,0xab,0xad,0xda,0xd2 };

...
...

    void gcm_encrypt( char *pt_in, int pt_len, char *aad, int aad_len, char *key, int cipher_sel,
                char *iv, int iv_len, char *ct_out, int *ct_len, char *tag_out){

  cipher_params_t *params = (cipher_params_t *)malloc(sizeof(cipher_params_t));
  if (!params) {
    /* Unable to allocate memory on heap*/
    fprintf(stderr, "ERROR: malloc error for cipher_params_t: %s\n", strerror(errno));
    abort();
  }

  params->cipher_sel = cipher_sel;
  params->iv = (unsigned char*)iv;
  params->iv_len = iv_len;
  params->pt = (unsigned char*)pt_in;
  params->pt_len = pt_len;
  params->ct = (unsigned char*)ct_out;
  *ct_len = params->ct_len;
  params->aad = (unsigned char*)aad;
  params->aad_len = aad_len;
  params->key = (unsigned char*)key;
  params->tag = tag_out;
  params->encryption_mode = 1; // encrypt
  gcm_encrypt_data(&params);
}

Python 测试代码

key = binascii.unhexlify('feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308')
aad = binascii.unhexlify('feedfacedeadbeeffeedfacedeadbeefabaddad2')
iv = binascii.unhexlify('cafebabefacedbaddecaf888')
pt = binascii.unhexlify('d9313225f88416e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39')
cipher = AES.new(key, AES.MODE_GCM, nonce=iv)
cipher.update(aad)
ciphertext, tag = cipher.encrypt_and_digest(pt)
nonce = cipher.nonce

# Print all the components of the message
print ("\nCOMPONENTS OF TRANSMITTED MESSAGE")
print ("AAD: " + binascii.hexlify(aad).decode())
print ("Ciphertext: " + binascii.hexlify(ciphertext).decode())
print ("Authentication tag: " + binascii.hexlify(tag).decode())
print ("Nonce: " + binascii.hexlify(nonce).decode())

我看到 C 的密文输出为： 3980cab3c0f841eb6fac4872a2757859e1ceaa6efd984628593b4ca1e19c7d773d0c144c525ac619d18c84a3f4718e2448b2fe324d9ccda2710

但是来自 Python 的那个是 522dc1f099566d07f47f37a32a84427d643a8cdcbfe5c0c97598a2bd2555d1aa8cb08e48590dbb3da7b08b1056828838c5f61e6393ba7a0abcc9f662[=135=][=]

Answer 1

您发布的C 代码不完整，并且缩进与实际结构不符。但是，如果我以对我来说显而易见的方式完成它，并提供你为 python 显示的输入，我会得到你想要的密文：

#include <stdio.h>
#include <openssl/evp.h>
#include <openssl/err.h>

void handleErrors (const char *lab){
  puts(lab); ERR_print_errors_fp(stdout); exit(1);
}
void hex2 (const char*in, unsigned char*out){
  int x; while(sscanf(in, "%02x",&x)>0){ *out++ = x; in+=2; }
}
void hout (const unsigned char *x, int len){
  while(len--) printf("%02x",*x++); putchar('\n');
}

int main(void) {
  unsigned char key[32], iv[12], aad[20], pt[60], ct[128], tag[16];
  int out_len = 0, out_len2 = 0;
  hex2("feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308",key);
  hex2("feedfacedeadbeeffeedfacedeadbeefabaddad2",aad);
  hex2("cafebabefacedbaddecaf888",iv);
  hex2("d9313225f88416e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39",pt);
  const EVP_CIPHER *cipher = EVP_aes_256_gcm();
  EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
  if(1 != EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, 1))
    handleErrors("init1");
  if(!EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, 1))
    handleErrors("init2");
  if(1 != EVP_CipherUpdate(ctx, NULL, &out_len, aad, sizeof aad))
    handleErrors("updaad");
  if(1 != EVP_CipherUpdate(ctx, ct, &out_len, pt, sizeof pt))
    handleErrors("upddat");
  if(1 != EVP_CipherFinal(ctx, ct+out_len, &out_len2))
    handleErrors("final");
  if(1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, sizeof tag, tag))
    handleErrors("gettag");

  printf ("%d+%d=", out_len, out_len2);
  hout(ct, out_len+out_len2);
  printf ("tag=");
  hout(tag, sizeof tag);
  return 0;
}

60+0=522dc1f099566d07f47f37a32a84427d643a8cdcbfe5c0c97598a2bd2555d1aa8cb08e48590dbb3da7b08b1056828838c5f61e6393ba7a0abcc9f662
tag=175227bf3ebf9eb1bfb85b5e89126c10

为什么 OpenSSL EVP C 库和 Python 之间生成的密文存在差异？

Why is there a difference in generated cipher text between OpenSSL EVP C libraries and Python?

c

openssl

aes

aes-gcm

evp-cipher