Yongqiang Continues to Teach You Encryption and Decryption: Symmetry (2)

  aes, des, php, Symmetric encryption algorithm

Yongqiang was frightened! Because Yongqiang saw a WeChat group who pointed out that the article attached to the soy sauce in the public numberShocked! A man in beijing did such a thing with swoole!“The content is too low, this kind of low articles don’t take out to send.

But it left a huge psychological shadow on Yongqiang. He has not yet seen the vicious face of social networks.

Therefore, the article Yongqiang was supposed to send yesterday has been postponed to today, but Yongqiang is really afraid of being sprayed and scolded. Despite all my encouragement, he was still concerned. Although I have already told him directly that “nobody has seen your stuff at all”, he still dare not send it. Then I had to pose PS law and made a picture for him. He looked at the picture and received my 6.66 yuan WeChat red envelope. He decided to continue to summon up courage to send it.

It’s time to show my PS virtuosity!

图片描述

“We went through untold hardships, rolled over countless mistakes, launched many Long March series, and took the painstaking efforts of a generation of astronauts. We finally saw the dawn of communication between the earth and the moon. Then within five minutes, we were surprised to find that Lao Wang’s smartmesh technology had already been realized, and even the communication between the earth’s civilization and the shape civilization had given a perfect solution …”-Nicholas Zhao Yongqiang

As we all know, as a master of various technical performances, I have long disdained to brag by ppt. Generally speaking, I perform directly on the computer. Of course, the programs are written in advance, all of which are mock data. The scripts are automated. No matter who operates them, everything is smooth and perfect!

As a person who pursues perfection, I have to continue to blow the last conversation to the end, as if I have left behind two problems:

  • What do these suffixes mean, ecb, cfb, cbc, etc
  • What does the iv vector mean

Since DES and 3DES are not recommended methods, this time we will directly use AES encryption to perform the impersonation. For example, you can copy and paste the following code and run it:

<?php
$ava_methods = openssl_get_cipher_methods();
// 选用aes-128-ecb
$my_method   = 'aes-128-ecb';
if ( !in_array( $my_method, $ava_methods ) ) { 
  exit( '错误的加密方法'.PHP_EOL );
}
// 加密用的密码
$key  = "1234567812345678";
// 加密的内容
$data = "12345678abcdxxoo12345678abcdxxoo";
$enc_data = openssl_encrypt( $data, $my_method, $key, OPENSSL_RAW_DATA );
$hex = bin2hex( $enc_data );
echo $hex.' : '.strlen( $hex ).PHP_EOL;

The result of my operation here is:

c1391e34caf38f8c2a477cbda3772533c1391e34caf38f8c2a477cbda3772533d96aa42b59151a9e9b5925fc9d95adaf : 96

Analyze the above code: AES-128-ECB is the encryption method we chose this time. What does this 128 mean? 128 is the key length: 128bit;; If you pay attention, you will also notice that there are aes-192-ecb and aes-256-ecb, which actually means that the encryption key length is 192bit and 256bit, and then it is worth noting that:

$enc_data = openssl_encrypt( $data, $my_method, $key, OPENSSL_RAW_DATA );
The last parameter is OPENSSL_RAW_DATA. If this option is selected, the encrypted data will be strange binary data and cannot be viewed directly through text. Therefore, if you want to see it, you must first use the bin2hex function to process it.

Note: Ha, I chose this key 12345678123456778 for a special purpose. The length of this key is 16 bytes, that is, 128 bits, while the length of the key required in the aes encryption method we chose is 128 bits. Then we tried to increase the number of keys to 1234567812345678abc, and then the other codes were encrypted again without any changes. The results are as follows:

c1391e34caf38f8c2a477cbda3772533c1391e34caf38f8c2a477cbda3772533d96aa42b59151a9e9b5925fc9d95adaf : 96

In other words, the data encrypted with “12345678123456778” and “1234567812345678abc” are the same. It seems that if we choose 128bit key length, once the key length exceeds 128bit, the extra part will be directly ignored ~ ~ ~

Then we will try to shorten the key “12345678123456778” by one byte and change it to “123456781234567”. The code in other places will be run without any changes. The results are as follows:

c202e5b1dc36c3147e50d02df7ab700cc202e5b1dc36c3147e50d02df7ab700cda89b056d926d3fea2e59ffc552b1d98 : 96

Not this time, it’s different ~

Then, we will focus on plaintext and ciphertext:

明文:12345678abcdxxoo12345678abcdxxoo
密文:c1391e34caf38f8c2a477cbda3772533c1391e34caf38f8c2a477cbda3772533d96aa42b59151a9e9b5925fc9d95adaf

If you look closely, there is a place that is rather bad. We will divide the ciphertext every 32 characters. You can feel it:

c1391e34caf38f8c2a477cbda3772533
c1391e34caf38f8c2a477cbda3772533
d96aa42b59151a9e9b5925fc9d95adaf

The first two paragraphs are the same! ? ? ? A horizontal trough. . . . . .

图片描述

Look carefully at a handful of plaintext 12345678 ABCD XXOO 12345678 ABCD XXOO, analyze, lie trough! :

12345678abcdxxoo
12345678abcdxxoo

Does it mean that the ciphertext of the plaintext “12345678abcdxxoo” encrypted by the key “1234567812345678” is “c1391e34cf38f8c2a477cbda3772533”?

The time is ripe! It’s time to continue playing possum! Why is this result? Now we begin to say “what do these suffixes mean, ecb, cfb, cbc, etc.”

You have a thoughtful guess: “Is it true that when symmetric encryption is used, plaintext is divided into blocks first, and then the blocks are encrypted separately?” , I looked at you with relief and said: “well, yes, it must be, otherwise I can’t write down, I can’t make it up …”

  • DES and 3DES group plaintext into 64bit(8 (8 bytes) as a unit;
  • AES groups plaintext with 128 bits (16 bytes) as a unit;
  • Whether AES or DES, when the data length of the last packet does not meet the packet standard length, it will be filled with some filling method.
  • After AES encrypts a 16-byte packet, the packet size is still 16 bytes.

For example, this plaintext “12345678abcdxxoo 12345678abcdxxoo” has a total of 32 bytes. Theoretically, it will be divided into 16 bytes: “12345678 ABCD XXOO” is one group, and the remaining “12345678 ABCD XXOO” is another group. Let’s verify it with the program:

<?php
$ava_methods = openssl_get_cipher_methods();
$my_method   = 'aes-128-ecb';
if ( !in_array( $my_method, $ava_methods ) ) { 
  exit( '错误的加密方法'.PHP_EOL );
}
$key  = "123456781234567";
// 注意!这段明文长度刚好为32字节!
$data = "12345678abcdxxoo12345678abcdxxoo";
echo '明文长度:'.strlen( $data ).PHP_EOL;
$enc_data = openssl_encrypt( $data, $my_method, $key, OPENSSL_RAW_DATA );
echo '密文长度:'.strlen( $enc_data ).PHP_EOL;

Note that the plaintext length I choose is exactly 32 bytes. Save and run it. I don’t know what is the result there. Anyway, here’s what I have here:

图片描述

On my day, I felt beaten in the face, adding 16 bytes to Mao’s encryption?

We changed the plaintext from “12345678 ABCD XXOO12345678 ABCD XXOO” of 32 bytes to “12345678 ABCD XXOO 12345678 ABCD XXOOA” of 33 bytes. In this way, the plaintext will be divided into three 16-byte packets. Since the last packet has only one byte, the remaining 15 bytes will be filled:

图片描述

It seems to confirm our guess: when the last plaintext packet is smaller than the required packet size, no new packet will be generated; When the last plaintext packet is greater than or equal to the required packet standard size, a new packet will be generated.

What if I don’t want to fill it? Modify the OPENSSL_NO_PADDING option at the end of the encryption and decryption function. Feel it:

<?php
$ava_methods = openssl_get_cipher_methods();
// 选用aes-128-ecb
$my_method   = 'aes-128-ecb';
if ( !in_array( $my_method, $ava_methods ) ) {
  exit( '错误的加密方法'.PHP_EOL );
}
// 加密用的密码
$key  = "1234567812345678";
// 加密的内容
$data = "12345678abcdxxoo12345678abcdxxoo";
echo '明文:'.$data.',长度为'.strlen( $data ).PHP_EOL;
$enc_data = openssl_encrypt( $data, $my_method, $key, OPENSSL_NO_PADDING );
echo '密文:'.$enc_data.',长度为'.strlen( $enc_data ).PHP_EOL;
$hex = bin2hex( $enc_data );
echo "密文十六进制:".$hex.',长度为'.strlen( $hex ).PHP_EOL;
$dec_data = openssl_decrypt( $data, $my_method, $key, OPENSSL_NO_PADDING );
$dec_data = openssl_decrypt( $enc_data, 'aes-128-ecb', $key, OPENSSL_NO_PADDING );
echo "解密:".$dec_data.PHP_EOL;

The above code runs and the result is as follows:

图片描述

Sometimes when some students do cross-language encryption and decryption, they are basically stuck in padding. The specific performance is to let Java decrypt after PHP encryption, and then found that decryption failed; Or Java encryption PHP decryption results are hung up. This time first check PADDING here, basically is such a problem.

So having said so much, to sum up:

AES, DES and 3DES are called block ciphers. Block ciphers can only encrypt plaintext of a fixed length at a time, so if the plaintext is very long, it is necessary to encrypt each block plaintext in turn. The block length of AES is 128bit, while the block length of DES is 64bit;. If multiple packets need to be encrypted in turn and the added plaintext is divided into three plaintext packets, then the three plaintext packets need to be encrypted iteratively (roughly understood as encrypted in turn). However, there are many different iterative methods. The professional name for this different iterative method is “mode”. These modes include: ECB, CBC, OFB, CFB, CTR …

PS: The way of grouping plaintext is fixed, the only difference is that the grouping length is different. Mode refers to how the process of encrypting multiple plaintext from the first to the last in turn is executed in turn.

图片描述