序列化密码错误答案

【问题标题】：Serialization Cryptography Error序列化密码错误
【发布时间】：2013-07-09 10:40:21
【问题描述】：

在反序列化对象时，我在使用序列化加密时遇到问题。

这是错误：

反序列化失败。原因：解析完成前遇到流结束

这是我的代码：

Imports System.IO
Imports System.Security.Cryptography
Imports System.Runtime.Serialization
Imports System.Runtime.Serialization.Formatters.Binary
Imports System.Text

Module TestModEncryption

Public Sub SaveEncryptedObjectToFile(FileName As String, Item As Object)
    Dim fs As FileStream
    Dim encryptor As CryptoStream

    Dim formatter As New BinaryFormatter

    Dim password As String = "MyPassword"
    Dim salt As String = "InitialVector123"

    Dim AES As AesManaged = New AesManaged
    AES.Padding = PaddingMode.None
    AES.Mode = CipherMode.CBC

    Dim HashAlgorithm As String = "SHA1" 'Can be SHA1 or MD5
    Dim PasswordIterations As Integer = 2
    Dim InitialVector As String = "InitialVector123" 'This should be a string of 16 ASCII characters.
    Dim KeySize As Integer = 256 'Can be 128, 192, or 256.

    Dim InitialVectorBytes As Byte() = Encoding.ASCII.GetBytes(InitialVector)
    Dim SaltValueBytes As Byte() = Encoding.ASCII.GetBytes(salt)
    Dim DerivedPassword As New Rfc2898DeriveBytes(password, SaltValueBytes, PasswordIterations)
    Dim KeyBytes As Byte() = DerivedPassword.GetBytes(CInt(KeySize / 8))

    Dim encryptTransf As ICryptoTransform = AES.CreateEncryptor(KeyBytes, InitialVectorBytes)

    fs = New FileStream(FileName, FileMode.Create)
    encryptor = New CryptoStream(fs, encryptTransf, CryptoStreamMode.Write)

    Try
        formatter.Serialize(encryptor, Item)
    Catch e As SerializationException
        Console.WriteLine("Failed to serialize. Reason: " & e.Message)
        Throw
    Finally
        fs.Close()
    End Try
End Sub

Public Function OpenEncryptedObjectFromFile(FileName As String) As Object
    Dim fs As New FileStream(FileName, FileMode.Open)
    Dim decryptor As CryptoStream

    Dim ItemToReturn As New Object

    Dim password As String = "MyPassword"
    Dim salt As String = "InitialVector123"

    Dim AES As AesManaged = New AesManaged
    AES.Padding = PaddingMode.None
    AES.Mode = CipherMode.CBC

    Dim HashAlgorithm As String = "SHA1" 'Can be SHA1 or MD5
    Dim PasswordIterations As Integer = 2
    Dim InitialVector As String = "InitialVector123" 'This should be a string of 16 ASCII characters.
    Dim KeySize As Integer = 256 'Can be 128, 192, or 256.

    Dim InitialVectorBytes As Byte() = Encoding.ASCII.GetBytes(InitialVector)
    Dim SaltValueBytes As Byte() = Encoding.ASCII.GetBytes(salt)
    Dim DerivedPassword As New Rfc2898DeriveBytes(password, SaltValueBytes, PasswordIterations)
    Dim KeyBytes As Byte() = DerivedPassword.GetBytes(CInt(KeySize / 8))

    Dim decryptTrans As ICryptoTransform = AES.CreateDecryptor(KeyBytes, InitialVectorBytes)

    Try
        Dim formatter As New BinaryFormatter

        decryptor = New CryptoStream(fs, decryptTrans, CryptoStreamMode.Read)
        ItemToReturn = DirectCast(formatter.Deserialize(decryptor), Object)
        Return ItemToReturn
    Catch e As SerializationException
        MsgBox("Failed to deserialize. Reason: " & e.Message)
        Return Nothing
        'Throw
    Finally
        fs.Close()
    End Try
End Function

End Module

【问题讨论】：

This should be a string of 16 ASCII characters?不，它应该是一个不可预测且唯一的字节串，最好来自一个安全的随机数生成器，并且每次调用函数时它都应该不同。对 PBKDF2 使用两次迭代是完全错误的，事实上，在这种情况下使用 PBKDF2 完全是错误的。

标签： vb.net serialization visual-studio-2012 cryptography deserialization

【解决方案1】：

加密有点复杂。首先让加密工作，只是加密。从一段文字开始：“我像犰狳一样孤独地流浪。”使用您的代码加密和解密该文本，忘记序列化。当它正常工作时，并且只有在那时，使用您的工作加密代码来加密/解密序列化对象。

您是否在没有任何加密的情况下成功序列化/反序列化您的对象？

一目了然，您需要将填充设置为 PKCS#7（又名 PKCS#5）。您的PaddingMode.None 可能是导致问题的原因。如果没有填充，您的最终块可能无法正确处理。显然，您需要对加密和解密使用相同的填充。

【讨论】：