javascript - JS中RSA加解密成功，C#中解密失败

Question

为了安全起见，我通过 jsencrypt 加密了一些数据，例如浏览器中的用户名、密码和电子邮件，这是一个用于执行 OpenSSL RSA 加密、解密的 Javascript 库。然后我使用 C# 的 RSACryptoServiceProvider 解密密码数据。公钥、私钥由c#生成:

<RSAKeyValue><Modulus>wDIL9/5eXYZB1J6yOQSJTvczV6dv7/mF3X9p+86kWCArYQmNih/Y+ktOboAjo2UyC8np5Y81yF8G/qAdSrreIwdTtZyAFlgpij2Oovmqpg4/mzL7VS6Sj/4y34+GKRczTjDjxuqTmD4F/lLNhqAwPP2RBbDvCCfmNgnNlkVNOLM=</Modulus><Exponent>AQAB</Exponent><P>wzw0EayQYOMdp6x+OQYryHEmHEu5TY+ZUU6ECOc7zL8EITM9Wm8B7nBgnYZuciJ2Wo+/4+s7E42qEJgyGifznw==</P><Q>/AOmiZxyWeexlilyxxfBjKgr+4wPLSHzbG4vUeY2wngWLTvT/CydZ9vFSXW6jMRVO3Zx8pjyI1bd4uVxZNTCbQ==</Q><DP>IuJY82eADK/IFrOtggbmP9Rn2Np267Li1DJRST3342emF0COj+AR2kbeHIduqJobx6azxMe9MIs5femT2jSVRQ==</DP><DQ>88n8Qsbq//nYmzDBbcOXYqAU3CRjUf+z4cK9V/biJkHRAjUMHrhyFNRPB38x1Zbf9MPh+xLlujYAM8xNY4NGCQ==</DQ><InverseQ>SCvWAH0faRW6h8+ZAJ25kUXsgM0JYY3SoGr7RPkoqpfHyl/41wPth4vvJqLZLnOvX/ip8SEaAE3X9W2z52rIkA==</InverseQ><D>JNJx0JV/ZtOuERpGcv4XgHWD9KszmvpnV0Rt/bxdaDThmrnF0EzBuVJsOGd8bHWa3P9WPJDvcPAj2uy6L/MVU7MHetIEx1FDMPiFXjO9bjaqyx7T9MURuxnCij2flfj/rMEaMx+iRqG+zWP6vMGF3KBFzMjv5/p8o+nKb2znR+E=</D></RSAKeyValue>

在大多数情况下，此过程会成功。但大约百分之一的人，RSACryptoServiceProvider 将引发异常:

System.Security.Cryptography.CryptographicException: Bad Data。

该错误似乎是随机出现的。

下面是jscrypt可以加密解密，但c#解密失败的一些例子。每个数组的前两个元素是源数据和 jsencrypt 解密的数据。每个数组的最后一个元素是c#无法解密的加密数据。

[
  [
    "75190ba768c49c96adc7e6b048f1e856db8cf6444ce54249d3b2d24a0f480122",
    "75190ba768c49c96adc7e6b048f1e856db8cf6444ce54249d3b2d24a0f480122",
    "gOEY8LP5bYd5UTs+b5xl0MvCijsHJ+jD3hX2ewAibyhYzguB9RAn+pNHpyj0VbC2G9D62oeq2Hdu7YUlSEkEiskeqq9xBKc/xWo+21uc+ArRDdfMSDvHy6iT/KaIQY5LDAZBhv+EHGywkLOhoNSfGrHgyCMKodrIcjJKtv1TDw=="
  ],
  [
    "11b6a03043123d54b6da3f75b9e502ee5db177fbabfe168b19c46f3bebfbfd5c",
    "11b6a03043123d54b6da3f75b9e502ee5db177fbabfe168b19c46f3bebfbfd5c",
    "yX9VGY+4d4TCgE7T8hzyVZcddJPHZzsFsqEM4De1ghlC2wGIK/cKNucVzLgBeJ/VUkR0mhQbqVoWD8eLKfyXM2A1JONN5BgFFQsyOc2oCtZLzbDFk99JYM+7duoejRqM+oDFmKt4aujEYYo4Rcwch+0AfMi3gysHHfmuI/Ry4A=="
  ],
  [
    "12b5fe831e1d5718d06331d0eef2c5f3099f35cb6bcc8fdc5f9aa77df37a6419",
    "12b5fe831e1d5718d06331d0eef2c5f3099f35cb6bcc8fdc5f9aa77df37a6419",
    "IL9nOt4yq4vh2HsCACbCAyJwqMff8/t3AMRbGIYGMjP2SOtZFDeQleOsCYiLtk94lrGLpH2/Ic7KlvgkgtK0u+elbTfkiiSU6pBPiIJE424iNW6sYzCYN/i+gPHnKje9NcDt6BVaWrouDCDbDTtKZsh042iDWSsCRRD0qijdsA=="
  ],
  [
    "918aaf6fcc2fe520f26225335bb1212ac8a6ddf03d01d00c92d189ed2e0ad728",
    "918aaf6fcc2fe520f26225335bb1212ac8a6ddf03d01d00c92d189ed2e0ad728",
    "gA2Bwk7oOw8EvPcbPAF96zxbhK7knhFgEQLgbPU/as1CKfIQz4okci4FKzNx3XrkDNJ0zTcV6T8M2VHo6uCVD160y5BLfragMw5+SVMCRN+3A8Zl01TjYglFF5eChdtY9XDQ9VjSgcqKiHQT2q0lzx9M4Z71ZTtAY03MLAmnxA=="
  ],
  [
    "c72c74a99fd1b207e6532cca34a14a647325bfcfbf47a731378928a526072809",
    "c72c74a99fd1b207e6532cca34a14a647325bfcfbf47a731378928a526072809",
    "SfOl2od01PtPhPdB1ZegkG/ALcDSTyGxcgZMChrCc7HOpYN4o7rD8QeiV2kpi1UUU+F7e+p8V4EAxKdnQbiUXtnboeYY7S+up63AXhYWKDOCNIJLiLv55WQOrgj7OddW4eN6XMFe9OoAcjYLFV+ySgnEDinBoRs+FylAKqJdOQ=="
  ],
  [
    "77b8033daa528892c1282acd2492dbdb363365305c2cd428a29427620474f5a0",
    "77b8033daa528892c1282acd2492dbdb363365305c2cd428a29427620474f5a0",
    "sCloK1zYZlY4/cNEUF4kIBWavWarJk4pn3+302+zWXkaaKqVrWCtGvw9XWOSZ//XvkJHMcwuuNROs/6bUKGsgha+gKnzFSIt7yO+OaP5iBAJd7zCtYiRg5PGkzd9K6aC1MvEflIoi8J8qaziklXh2wKYnQBLumbdxe/xww7QMg=="
  ],
  [
    "d8d35d3eebe25de025844d249f2664d4de4df061d09520d3f04cccf556b766ec",
    "d8d35d3eebe25de025844d249f2664d4de4df061d09520d3f04cccf556b766ec",
    "vBHNc+3gazNDkHJfT76A99+kwy2w7/ZKTBzDN6dkYfdzR+IhRPR2IPI8vhOYW4tGlEdF+dGEFG2F6MJcAWNeVGMqWpD9g1aWqYa4cs1h3EExz9MuikpBkTJ3negm8UArJ4Dhrsa4V0m2cuvmFnBZ29w1Dfe3B9yyIJkxlIIqZQ=="
  ]
]

以下是解密数据的c#代码示例:

public byte[] Decrypt(byte[] bytes)
        {
            using (var rsa = new RSACryptoServiceProvider())
            {
                rsa.ImportParameters(PrivateParameters);
                return rsa.Decrypt(bytes, RSAEncryptionPadding.Pkcs1);
            }
        }

以下是加密数据的js代码示例:

<input id="pubkey" type="hidden" value="@Model.pubkey" />
<input id="prikey" type="hidden" value="@Model.prikey" />
<script type="text/javascript" src="/scripts/crypto/crypto-js.min.js"></script>
<script type="text/javascript" src="/scripts/crypto/jsencrypt.min.js"></script>
<div id="vue-app">
    <div class="container-fluid">
        <div class="row">
            <div class="col-md-12" v-for="c in cipher">
                {{ c }}
            </div>
        </div>        
    </div>
</div>
<script>
    $(function(){
        var pubkey = $("#pubkey").val();
        var prikey = $("#prikey").val();
        window.encryptor = new JSEncrypt();
        encryptor.setPublicKey(pubkey);       
        window.decryptor = new JSEncrypt();
        decryptor.setPrivateKey(prikey);
        function task(){
            var src = CryptoJS.SHA256(Math.uuid()).toString();                
            var cipher = encryptor.encrypt(src);
            var plain = decryptor.decrypt(cipher)
            var args = { src: src, cipher: cipher, plain: plain  }
            $.post("/api/test/view/rsa", args, function(msg){
                if(msg.error){
                    app.cipher.push([args.cipher==msg.message,args]);
                }
                else{
                    console.log(args)
                }
            });
            setTimeout(task, 1);
        }
        task();
    });
</script>

Answer 1

您的 JavaScript 加密产生的结果不符合 RSAES-PKCS1-V1_5-ENCRYPT 规范。

您的模数是一个 1024 位数字(128 字节)。因此，所有加密消息的输出将为 128 字节。

https://www.rfc-editor.org/rfc/rfc3447#section-7.2.1 :

c. Convert the ciphertext representative c to a ciphertext C of length k octets (see Section 4.1):

C = I2OSP (c, k).

(“长度为 k”，而不是“长度达到 k”)。

您提供的第三个值均以 == 结尾，这意味着字节数 mod 3 为 1。但是 128 mod 3 为 2。因此这里的输出不是I2OSP(c, 128) 的合法输出。

您使用的 JavaScript 库省略了前导零。因此，要在 .NET 中解决此问题，您需要这样做

public byte[] Decrypt(byte[] bytes)
{
    using (var rsa = new RSACryptoServiceProvider())
    {
        rsa.ImportParameters(PrivateParameters);

        // Correct the error in the JS encryptor.
        if (bytes.Length < rsa.KeySize / 8)
        {
            byte[] tmp = new byte[rsa.KeySize / 8];
            Buffer.BlockCopy(bytes, 0, tmp, tmp.Length - bytes.Length, bytes.Length);
            bytes = tmp;
        }

        return rsa.Decrypt(bytes, RSAEncryptionPadding.Pkcs1);
    }
}

请注意，我没有说 + 1，因为考虑到 javascript 库的观察到的行为，如果加密生成的值应该以 00 00 开头它会离开他们两个。

向库所有者提交错误似乎很好:)。