几种常见加密算法初窥及如何选用加密算法

http://www.cnblogs.com/yangywyangyw/archive/2012/07/31/2620861.html

以前写文章总喜欢先废话一堆，这次就免了，直入主题。

加 密算法通常分为对称性加密算法和非对称性加密算法，对于对称性加密算法，信息接收双方都需事先知道密匙和加解密算法且其密匙是相同的，之后便是对数据进行 加解密了。非对称算法与之不同，发送双方A,B事先均生成一堆密匙，然后A将自己的公有密匙发送给B，B将自己的公有密匙发送给A，如果A要给B发送消 息，则先需要用B的公有密匙进行消息加密，然后发送给B端，此时B端再用自己的私有密匙进行消息解密，B向A发送消息时为同样的道理。

几种对称性加密算法：AES,DES,3DES

DES是一种分组数据加密技术（先将数据分成固定长度的小数据块，之后进行加密），速度较快，适用于大量数据加密，而3DES是一种基于DES的加密算法，使用3个不同密匙对同一个分组数据块进行3次加密，如此以使得密文强度更高。

相较于DES和3DES算法而言，AES算法有着更高的速度和资源使用效率，安全级别也较之更高了，被称为下一代加密标准。

几种非对称性加密算法：RSA,DSA,ECC

RSA和DSA的安全性及其它各方面性能都差不多，而ECC较之则有着很多的性能优越，包括处理速度，带宽要求，存储空间等等。

几种线性散列算法（签名算法）：MD5,SHA1,HMAC

这几种算法只生成一串不可逆的密文，经常用其效验数据传输过程中是否经过修改，因为相同的生成算法对于同一明文只会生成唯一的密文，若相同算法生成的密文不同，则证明传输数据进行过了修改。通常在数据传说过程前，使用MD5和SHA1算法均需要发送和接收数据双方在数据传送之前就知道密匙生成算法，而HMAC与之不同的是需要生成一个密匙，发送方用此密匙对数据进行摘要处理（生成密文），接收方再利用此密匙对接收到的数据进行摘要处理，再判断生成的密文是否相同。

对于各种加密算法的选用：

由于对称加密算法的密钥管理是一个复杂的过程，密钥的管理直接决定着他的安全性，因此当数据量很小时，我们可以考虑采用非对称加密算法。

在实际的操作过程中，我们通常采用的方式是：采用非对称加密算法管理对称算法的密钥，然后用对称加密算法加密数据，这样我们就集成了两类加密算法的优点，既实现了加密速度快的优点，又实现了安全方便管理密钥的优点。

如果在选定了加密算法后，那采用多少位的密钥呢？一般来说，密钥越长，运行的速度就越慢，应该根据的我们实际需要的安全级别来选择，一般来说，RSA建议采用1024位的数字，ECC建议采用160位，AES采用128为即可。

 

对于几种加密算法的内部实现原理，我不想研究的太透彻，这些问题就留给科学家们去研究吧。而对于其实现而言，网上有很多开源版本，比较经典的是PorlaSSL（官网：http://en.wikipedia.org/wiki/PolarSSL ）。其它语言如JAVA,OBJC也都有相应的类库可以使用。以下附上自己用OC封装的通用加密类：

 

CryptionUseSysLib.h          //     // CryptionUseSysLib.h     // encoding     //     // Created by weiy on 12-7-25.     // Copyright (c) 2012年 __MyCompanyName__. All rights reserved.     //          #import <Foundation/Foundation.h>     #import <CommonCrypto/CommonDigest.h>     #import <CommonCrypto/CommonCryptor.h>          @interface CryptionUseSysLib : NSObject{          }          + (NSData *) md5:(NSString *)str;               + (NSData *) doCipherUseAesMethod:(NSData *)sTextIn                                     key:(NSData *)sKey                                 context:(CCOperation)encryptOrDecrypt;          + (NSData *) doCipherUse3DesMethod:(NSData *)sTextIn                                     key:(NSData *)sKey                                 context:(CCOperation)encryptOrDecrypt;          + (NSData *) doCipherUseDesMethod:(NSData *)sTextIn                                     key:(NSData *)sKey                                 context:(CCOperation)encryptOrDecrypt;          + (NSData *) doCipherUseCastMethod:(NSData *)sTextIn                                   key:(NSData *)sKey                               context:(CCOperation)encryptOrDecrypt;          + (NSString *) encodeBase64WithString:(NSString *)strData;          + (NSString *) encodeBase64WithData:(NSData *)objData;          + (NSData *) decodeBase64WithString:(NSString *)strBase64;          @end 

 

CryptionUseSysLib.m     //     // CryptionUseSysLib.m     // encoding     //     // Created by weiy on 12-7-25.     // Copyright (c) 2012年 __MyCompanyName__. All rights reserved.     //          #import "CryptionUseSysLib.h"               static const char _base64EncodingTable[64] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";     static const short _base64DecodingTable[256] = {     -2, -2, -2, -2, -2, -2, -2, -2, -2, -1, -1, -2, -1, -1, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,     -1, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, 62, -2, -2, -2, 63,     52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -2, -2, -2, -2, -2, -2,     -2, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,     15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -2, -2, -2, -2, -2,     -2, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,     41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -2, -2, -2, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,     -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2     };          @implementation CryptionUseSysLib               + (NSString *) md5:(NSString *)str          {          const char *cStr = [str UTF8String];          unsigned char result[CC_MD5_DIGEST_LENGTH];          CC_MD5( cStr, strlen(cStr), result );          return [NSString                              stringWithFormat: @"%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X",                              result[0], result[1],                              result[2], result[3],                              result[4], result[5],                              result[6], result[7],                              result[8], result[9],                              result[10], result[11],                              result[12], result[13],                              result[14], result[15]                              ];          }          + (NSData *)doCipher:(NSData *)sTextIn                      key:(NSData *)sKey                Algorithm:(CCAlgorithm)algorithm                  context:(CCOperation)encryptOrDecrypt {            NSData * dTextIn;              dTextIn = [sTextIn mutableCopy];              NSMutableData * dKey = [sKey mutableCopy];       int moreSize = 0;              //make key to standard;       switch (algorithm) {         case kCCAlgorithmDES:           moreSize = kCCBlockSizeDES;           [dKey setLength:kCCKeySizeDES];           break;         case kCCAlgorithm3DES:           moreSize = kCCBlockSize3DES;           [dKey setLength:kCCKeySize3DES];           break;         case kCCAlgorithmAES128:           moreSize = kCCBlockSizeAES128;           [dKey setLength:kCCKeySizeAES128];           break;         case kCCAlgorithmCAST:           moreSize = kCCBlockSizeCAST;           [dKey setLength:kCCKeySizeMaxCAST];           break;         case kCCAlgorithmRC4:         case kCCAlgorithmRC2:           moreSize = kCCBlockSizeRC2;           [dKey setLength:kCCKeySizeMaxRC2];            break;         default:           return nil;           break;       }              uint8_t *bufferPtr1 = NULL;       size_t bufferPtrSize1 = 0;       size_t movedBytes1 = 0;     unsigned char iv[8];       memset(iv, 0, 8);              bufferPtrSize1 = [sTextIn length] + moreSize;            bufferPtr1 = malloc(bufferPtrSize1);       memset((void *)bufferPtr1, 0, bufferPtrSize1);              // cryption....       CCCryptorStatus ccStatus = CCCrypt(encryptOrDecrypt, // CCOperation op               algorithm, // CCAlgorithm alg               kCCOptionPKCS7Padding|kCCOptionECBMode, // CCOptions options               [dKey bytes], // const void *key               [dKey length], // size_t keyLength               iv, // const void *iv               [dTextIn bytes], // const void *dataIn               [dTextIn length], // size_t dataInLength               (void *)bufferPtr1, // void *dataOut               bufferPtrSize1, // size_t dataOutAvailable               &movedBytes1); // size_t *dataOutMoved              // output situation after crypt       switch (ccStatus) {         case kCCSuccess:           NSLog(@"SUCCESS");           break;         case kCCParamError:           NSLog(@"PARAM ERROR");           break;         case kCCBufferTooSmall:           NSLog(@"BUFFER TOO SMALL");           break;         case kCCMemoryFailure:           NSLog(@"MEMORY FAILURE");           break;         case kCCAlignmentError:           NSLog(@"ALIGNMENT ERROR");           break;         case kCCDecodeError:           NSLog(@"DECODE ERROR");           break;         case kCCUnimplemented:           NSLog(@"UNIMPLEMENTED");           break;         default:           break;       }              if (ccStatus == kCCSuccess){         NSData *result = [NSData dataWithBytes:bufferPtr1 length:movedBytes1];         free(bufferPtr1);         return result;       }       free(bufferPtr1);       return nil;     }          + (NSData*)doCipherUse3DesMethod:(NSData *)sTextIn                                    key:(NSData *)sKey                                context:(CCOperation)encryptOrDecrypt{       return [CryptionUseSysLib doCipher:sTextIn                         key:sKey                   Algorithm:kCCAlgorithm3DES context:encryptOrDecrypt];     }          + (NSData *) doCipherUseCastMethod:(NSData *)sTextIn                                   key:(NSData *)sKey                               context:(CCOperation)encryptOrDecrypt{              return [CryptionUseSysLib doCipher:sTextIn                                      key:sKey                                Algorithm:kCCAlgorithmCAST context:encryptOrDecrypt];          }          + (NSData*)doCipherUseDesMethod:(NSData *)sTextIn                                   key:(NSData *)sKey                               context:(CCOperation)encryptOrDecrypt{       return [CryptionUseSysLib doCipher:sTextIn                         key:sKey                   Algorithm:kCCAlgorithmDES                     context:encryptOrDecrypt];     }          + (NSData*)doCipherUseAesMethod:(NSData *)sTextIn                                   key:(NSData *)sKey                               context:(CCOperation)encryptOrDecrypt{       return [CryptionUseSysLib doCipher:sTextIn                         key:sKey                   Algorithm:kCCAlgorithmAES128                     context:encryptOrDecrypt];     }          + (NSString *)encodeBase64WithString:(NSString *)strData {     return [CryptionUseSysLib encodeBase64WithData:[strData dataUsingEncoding:NSUTF8StringEncoding]];     }          + (NSString *)encodeBase64WithData:(NSData *)objData {          const unsigned char * objRawData = [objData bytes];     char * objPointer;     char * strResult;          // Get the Raw Data length and ensure we actually have data     int intLength = [objData length];     if (intLength == 0) return nil;          // Setup the String-based Result placeholder and pointer within that placeholder     strResult = (char *)calloc(((intLength + 2) / 3) * 4, sizeof(char));     objPointer = strResult;          // Iterate through everything     while (intLength > 2) { // keep going until we have less than 24 bits     *objPointer++ = _base64EncodingTable[objRawData[0] >> 2];     *objPointer++ = _base64EncodingTable[((objRawData[0] & 0x03) << 4) + (objRawData[1] >> 4)];     *objPointer++ = _base64EncodingTable[((objRawData[1] & 0x0f) << 2) + (objRawData[2] >> 6)];     *objPointer++ = _base64EncodingTable[objRawData[2] & 0x3f];          // we just handled 3 octets (24 bits) of data     objRawData += 3;     intLength -= 3;     }          // now deal with the tail end of things     if (intLength != 0) {     *objPointer++ = _base64EncodingTable[objRawData[0] >> 2];     if (intLength > 1) {     *objPointer++ = _base64EncodingTable[((objRawData[0] & 0x03) << 4) + (objRawData[1] >> 4)];     *objPointer++ = _base64EncodingTable[(objRawData[1] & 0x0f) << 2];     *objPointer++ = '=';     } else {     *objPointer++ = _base64EncodingTable[(objRawData[0] & 0x03) << 4];     *objPointer++ = '=';     *objPointer++ = '=';     }     }          // Terminate the string-based result     *objPointer = '\0';          // Return the results as an NSString object     return [NSString stringWithCString:strResult encoding:NSASCIIStringEncoding];     }          + (NSData *)decodeBase64WithString:(NSString *)strBase64 {     const char * objPointer = [strBase64 cStringUsingEncoding:NSASCIIStringEncoding];     int intLength = strlen(objPointer);     int intCurrent;     int i = 0, j = 0, k;          unsigned char * objResult;     objResult = calloc(intLength, sizeof(char));          // Run through the whole string, converting as we go     while ( ((intCurrent = *objPointer++) != '\0') && (intLength-- > 0) ) {     if (intCurrent == '=') {     if (*objPointer != '=' && ((i % 4) == 1)) {// || (intLength > 0)) {     // the padding character is invalid at this point -- so this entire string is invalid     free(objResult);     return nil;     }     continue;     }          intCurrent = _base64DecodingTable[intCurrent];     if (intCurrent == -1) {     // we're at a whitespace -- simply skip over     continue;     } else if (intCurrent == -2) {     // we're at an invalid character     free(objResult);     return nil;     }          switch (i % 4) {     case 0:     objResult[j] = intCurrent << 2;     break;          case 1:     objResult[j++] |= intCurrent >> 4;     objResult[j] = (intCurrent & 0x0f) << 4;     break;          case 2:     objResult[j++] |= intCurrent >>2;     objResult[j] = (intCurrent & 0x03) << 6;     break;          case 3:     objResult[j++] |= intCurrent;     break;     }     i++;     }          // mop things up if we ended on a boundary     k = j;     if (intCurrent == '=') {     switch (i % 4) {     case 1:     // Invalid state     free(objResult);     return nil;          case 2:     k++;     // flow through     case 3:     objResult[k] = 0;     }     }          // Cleanup and setup the return NSData     NSData * objData = [[[NSData alloc] initWithBytes:objResult length:j] autorelease];     free(objResult);     return objData;     }          @end