加密。NET和Android中的解密抛出BadPaddingException:pad块已损坏

Question

我做了很多研究，但我找不到我的问题的答案。我在做AES加密（Rijndael块大小128位）。NET和解密在Android（AES）与相同的密码，盐

C#加密代码片段：

        byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector);
        byte[] saltValueBytes  = Encoding.ASCII.GetBytes(saltValue);

        byte[] plainTextBytes  = Encoding.UTF8.GetBytes(plainText);

        PasswordDeriveBytes password = new PasswordDeriveBytes(
                                                        passPhrase, 
                                                        saltValueBytes, 
                                                        hashAlgorithm, 
                                                        passwordIterations);

        byte[] keyBytes = password.GetBytes(keySize / 8);

        RijndaelManaged symmetricKey = new RijndaelManaged();

        symmetricKey.Padding = PaddingMode.PKCS7;

        symmetricKey.BlockSize = 128;  

        symmetricKey.Mode = CipherMode.CBC;        

        ICryptoTransform encryptor = symmetricKey.CreateEncryptor(
                                                            keyBytes, 
                                                            initVectorBytes);

        MemoryStream memoryStream = new MemoryStream();        

        CryptoStream cryptoStream = new CryptoStream(memoryStream, 
                                                        encryptor,
                                                        CryptoStreamMode.Write);
        cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);

        cryptoStream.FlushFinalBlock();

        byte[] cipherTextBytes = memoryStream.ToArray();

        memoryStream.Close();
        cryptoStream.Close();

        string cipherText = Convert.ToBase64String(cipherTextBytes);

Android解密代码段：

    KeySpec keySpec = new PBEKeySpec(password.toCharArray(), salt.getBytes(), iterationCount); 

    SecretKey key = SecretKeyFactory.getInstance( 
            "PBEWithSHA1And128BitAES-CBC-BC").generateSecret(keySpec);

    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding", "BC");

    cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv.getBytes()));

    byte[] decrypted = cipher.doFinal(encrypted);

密码doFinal调用引发以下异常。

“05-02 18:17:38.239:W/System.err（25547）：javax.crypto.BadPaddingException:填充块损坏”

我确实在这两个文件中将填充设置为“PKCS7Padding”。NET和Android，加密块大小为128位。

然而，在Android加密

样本测试：

String PlainText            = "hello world";
String EncryptedDotNetblob  = "JyijoGEALMI25Zej7d+fMg==";
String EncryptedAndroidblob = "1HhuTQaLRJEK4zxI9FAO6A==";

正如你所看到的，上面的斑点也不同。

有人知道这里有什么问题吗？

Answer 1

下面是一个C#示例，您需要IterationCount

protected void Page_Load(object sender, EventArgs e)
{
    string value = "";
    string password = "";
    string salt = "";
    string iv = "";


    byte[] vectorBytes = Convert.FromBase64String(Server.UrlDecode(iv)); 
    byte[] cipherText = Convert.FromBase64String(Server.UrlDecode(value));

    Rfc2898DeriveBytes key1 = new Rfc2898DeriveBytes(password, StringToByteArray(salt)); //same as PBKDF2WithHmacSHA1
    key1.IterationCount = 32;
    byte[] keyBytes = key1.GetBytes(16);

    string Answer = DecryptDataAES(cipherText, keyBytes, vectorBytes); //vectorBytes is good

    //litAnswer.Text = Answer;
}

public static string DecryptDataAES(byte[] cipherText, byte[] key, byte[] iv)
{
    string plaintext = null;

    using (Rijndael rijndael = Rijndael.Create())
    {
        rijndael.Key = key;
        rijndael.IV = iv;
        rijndael.Padding = PaddingMode.None;

        ICryptoTransform decryptor = rijndael.CreateDecryptor(rijndael.Key, rijndael.IV);

        // Create the streams used for decryption. 
        using (MemoryStream msDecrypt = new MemoryStream(cipherText))
        {
            using (CryptoStream csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read))
            {
                using (StreamReader srDecrypt = new StreamReader(csDecrypt))
                {
                    plaintext = srDecrypt.ReadToEnd();
                }
            }
        }
    }
    return plaintext;
}

public static byte[] StringToByteArray(String hex)
{
    int NumberChars = hex.Length / 2;
    byte[] bytes = new byte[NumberChars];
    using (var sr = new StringReader(hex))
    {
        for (int i = 0; i < NumberChars; i++)
            bytes[i] =
              Convert.ToByte(new string(new char[2] { (char)sr.Read(), (char)sr.Read() }), 16);
    }
    return bytes;
}

Answer 2

您派生的键是不同的，这就是为什么会出现错误（将它们记录为十六进制字符串以进行检查）PasswordDeriveBytes使用经过修改的PBKDF1版本，另一方面，SecretKeyFactory。getInstance（“pbewithsha1和128bitaes CBC BC”）提供一个密钥工厂，该工厂根据PKCS#12的指定派生密钥。这些是不同的算法，产生不同的密钥。在中使用Rfc2898DeriveBytes。NET和SecretKeyFactory。getInstance（“PBKDF2WithHmacSHA1”）使用相同的参数获取相同的密钥。