scala C# 和 PHP、ColdFusion、Ruby、Python 之间的兼容加密
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/102496/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Compatible encryption between C# and PHP, ColdFusion, Ruby, Python
提问by Paul Shannon
We're developing a service that will accept a POSTrequest. Some of the POSTdata will need to be encrypted before the POSTas it will be stored in hidden fields on a form.
我们正在开发一项接受POST请求的服务。某些POST数据需要在加密之前进行加密，POST因为它们将存储在表单的隐藏字段中。
The application is written in C#, but we want third party clients to be able to easily integrate with it. We find that most clients use PHP, Classic ASP or VB.Net.
该应用程序是用 C# 编写的，但我们希望第三方客户端能够轻松地与其集成。我们发现大多数客户使用 PHP、Classic ASP 或 VB.Net。
The third parties should only be doing the encryption. We'd do the decryption. There is no two-way communication.
第三方应该只进行加密。我们会进行解密。没有双向通信。
What are the most compatible combinations of encryption algorithm, padding mode and other options?
加密算法、填充模式和其他选项最兼容的组合是什么？
采纳答案by Ben Doom
Assuming that you have a safe way of sharing a key (whether RSA encryption of it, retrieval over an SSH or HTTPS link, or callling the other developer on a secured phone line), any of the major modern encryptions (like AES, as mentioned by @Ed Haber) would be suitable. I would second his suggestion of AES. There should be libraries for PHP, VB, Ruby, etc.
假设您有一种安全的方式来共享密钥（无论是 RSA 加密、通过 SSH 或 HTTPS 链接检索，还是在安全电话线上呼叫其他开发人员），任何主要的现代加密（如前面提到的 AES） @Ed Haber）将是合适的。我会支持他对 AES 的建议。应该有 PHP、VB、Ruby 等的库。
However, remember that with "no two-way communication" you will have to find an out-of-channel method for securely getting the symmetric key to the encrypting party.
但是，请记住，在“无双向通信”的情况下，您必须找到一种通道外方法来安全地将对称密钥发送给加密方。
回答by Chris Kite
If you mean that it should be impossible for third-parties to decrypt data, then you will want to use an asymmetric encryption algorithm such as RSA. This will the third-party to encrypt data with your public key, and then only you can decrypt the data with your private key, which you do not disclose. There should be implementations of RSA available for all the languages you mentioned.
如果您的意思是第三方无法解密数据，那么您将需要使用非对称加密算法，例如 RSA。这将让第三方使用您的公钥加密数据，然后只有您可以使用您不公开的私钥解密数据。应该有适用于您提到的所有语言的 RSA 实现。
If you don't care if the third-party can decrypt the data, then AES is the way to go. You will have one key which you share with the third-parties. This key is used both for encryption and decryption.
如果您不在乎第三方是否可以解密数据，那么 AES 就是您要走的路。您将拥有一个与第三方共享的密钥。此密钥用于加密和解密。
回答by tim.tadh
I would use AES for the bulk data encryption and RSA for encrypting the AES Key. If the data is small enough then just encrypt the whole thing with RSA.
我会使用 AES 进行批量数据加密，使用 RSA 来加密 AES 密钥。如果数据足够小，那么只需使用 RSA 加密整个内容即可。
I think this is a good solution. What I would do is have your application publish an API for getting a public RSA key. When I third party wants to send you something it gets the public key. It then generates a session key to do the actual encryption using a block cipher, (ie AES), and sends the key to you by encrypting with your public key. You decrypt the session key with your private key. The third party then encrypts the data it wants to send you with AES (using a padding scheme that you also publish) and sends it to you. You decrypt it using the session key.
我认为这是一个很好的解决方案。我要做的是让您的应用程序发布一个 API 来获取公共 RSA 密钥。当我第三方想要向您发送某些东西时，它会获取公钥。然后它会生成一个会话密钥来使用分组密码（即 AES）进行实际加密，并通过使用您的公钥加密将密钥发送给您。你用你的私钥解密会话密钥。然后，第三方使用 AES 加密要发送给您的数据（使用您也发布的填充方案）并将其发送给您。您可以使用会话密钥对其进行解密。
There are some problems with the method above. Since you are not sending any information (other than publishing your public key, you cannot control how the session key is generated. This means that third parties can use very insecure ways to of generating the session key and you will never know. A second problem is everyone who wants to send you data has to pad data for AES in the same way you do. So you will have to make sure every one co-ordinates. The second issue isn't to big, but the first could be a problem especially if you don't trust the third parties all that much to generate really good session keys from a good cryptographically secure random number generator
上述方法存在一些问题。由于您没有发送任何信息（除了发布您的公钥，您无法控制会话密钥的生成方式。这意味着第三方可以使用非常不安全的方式来生成会话密钥，而您永远不会知道。第二个问题是每个想要向您发送数据的人都必须以与您相同的方式为 AES 填充数据。因此，您必须确保每个人都有坐标。第二个问题不大，但第一个问题可能是个问题特别是如果您不太信任第三方会从一个好的加密安全随机数生成器生成非常好的会话密钥
回答by Ed Haber
I would use AES for the bulk data encryption and RSA for encrypting the AES Key. If the data is small enough then just encrypt the whole thing with RSA.
我会使用 AES 进行批量数据加密，使用 RSA 来加密 AES 密钥。如果数据足够小，那么只需使用 RSA 加密整个内容即可。
回答by Ian P
You could very easily implement your own XOR key-based bit encryption. With a little thought and ingenuity, you can come up with something that's more than suitable for you application.
您可以非常轻松地实现您自己的基于 XOR 密钥的位加密。稍加思考和独创性，您就可以想出一些更适合您的应用程序的东西。
Here's a PHP example:
这是一个 PHP 示例：
function XOREncryption($InputString, $KeyPhrase){
$KeyPhraseLength = strlen($KeyPhrase);
for ($i = 0; $i < strlen($InputString); $i++){
$rPos = $i % $KeyPhraseLength;
$r = ord($InputString[$i]) ^ ord($KeyPhrase[$rPos]);
$InputString[$i] = chr($r);
}
return $InputString;
}
回答by Peter Boughton
ColdFusion has the encrypt and decrypt functions capable of handling a range of algorithms and encodings, including the AES recommended above.
ColdFusion 具有加密和解密功能，能够处理一系列算法和编码，包括上面推荐的 AES。
Information at: http://www.cfquickdocs.com/cf8/?getDoc=encrypt#Encrypt
信息位于：http: //www.cfquickdocs.com/cf8/?getDoc=encrypt#Encrypt
Quick example code:
快速示例代码：
Key = generateSecretKey( 'AES' , 128 )
EncryptedText = encrypt( Text , Key , 'AES' , 'Hex' )
Text = decrypt( EncryptedText , Key, 'AES' , 'Hex' )
Similar functionality is available with this library for PHP:
http://www.chilkatsoft.com/p/php_aes.asp
这个PHP库提供了类似的功能：http:
//www.chilkatsoft.com/p/php_aes.asp
...and Java, Python, Ruby, and others...
http://www.example-code.com/java/crypt2_aes_matchPhp.asp
http://www.example-code.com/python/aes_stringEncryption.asp
...以及 Java、Python、Ruby 等...
http://www.example-code.com/java/crypt2_aes_matchPhp.asp
http://www.example-code.com/python/aes_stringEncryption.asp
回答by thenickdude
Why not have your server exposed over HTTPS? That way, any client which can handle HTTPS can consume the service securely.
为什么不让您的服务器通过 HTTPS 公开？这样，任何可以处理 HTTPS 的客户端都可以安全地使用该服务。
回答by thenickdude
Sounds like RSA is the algorithm for you.
听起来像 RSA 是适合您的算法。
