在node.js中重写Java AES 256 GCM加密(PBKDF2WithHmacSHA1)

Question

我有以下java代码用于加密纯文本：

private static final String SECRET_KEY = "SecKeyTest";
private static final String SALT = "thisIsSalt";



public String encrypt(String strToEncrypt) {
    try {
        byte[] iv = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
        IvParameterSpec ivspec = new IvParameterSpec(iv);

        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
        KeySpec spec = new PBEKeySpec(SECRET_KEY.toCharArray(), SALT.getBytes(), 65536, 256);
        SecretKey tmp = factory.generateSecret(spec);
        SecretKeySpec secretKey = new SecretKeySpec(tmp.getEncoded(), "AES");
        
        GCMParameterSpec gcmParameterSpec = new GCMParameterSpec(128 , iv);

        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, gcmParameterSpec);
        return Base64.getEncoder().encodeToString(cipher.doFinal(strToEncrypt.getBytes(StandardCharsets.UTF_8)));
    } catch (Exception e) {
        System.out.println("Error while encrypting: " + e.toString());
    }
    return null;
}

const salt = "thisIsSalt";
const digest = 'sha256';
const aesSecretKey = "SecKeyTest";

module.exports = {

    encrypt: function (plainText){

        const key = crypto.pbkdf2Sync(aesSecretKey, salt, 65536, 32, digest); //key len 32bytes i.e 256bits
        const iv = Buffer.from([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ]);

        // AES 256 GCM Mode
        var cipher = crypto.createCipheriv('aes-256-gcm', key, iv);

        // encrypt the given text
        var encrypted = Buffer.concat([cipher.update(plainText, 'utf8'), cipher.final()]);

        // extract the auth tag
        var tag = cipher.getAuthTag();

        // generate output
        return Buffer.concat([Buffer.from(salt), iv, tag, encrypted]).toString('base64');
        
    }


};

Answer 1

Java代码隐式地将密文和标记按此顺序连接在一起。因此，要在NodeJS代码中得到相同的结果，需要进行以下更改：

return Buffer.concat([encrypted, tag]).toString('base64');

但是，salt和IV不应该是静态的，而应该为每次密钥派生和加密随机生成。由于salt和IV是解密所需的，并且两者都不是秘密的，所以它们与密文和标签一起传递，通常也是级联的，例如：salt IV密文标签。