AES 搞砸了套接字上的序列化/反序列化。流标头无效。爪哇

Question

我正在做一个项目，我需要加密 java 对象并通过套接字发送它们。当对象没有加密时，序列化和反序列化工作得很好，但是当我加密它们时，我得到：

Error: invalid stream header: 5F15DD25
java.io.StreamCorruptedException: invalid stream header: 5F15DD25
    at java.io.ObjectInputStream.readStreamHeader(ObjectInputStream.java:802)
    at java.io.ObjectInputStream.<init>(ObjectInputStream.java:299)
    at Utils.deserializeEnv(Utils.java:236)
    at Utils.decryptEnv(Utils.java:221)
    at GroupThread.run(GroupThread.java:59)
Exception in thread "Thread-2" java.lang.NullPointerException
    at GroupThread.run(GroupThread.java:63)

在我的反序列化方法中的 ObjectInputStream。我将下面的行加粗。

我的插座是这样的：

ObjectOutputStream output = new ObjectOutputStream(socket.getOutputStream());
ObjectInputStream input = new ObjectInputStream(socket.getInputStream());

然后像这样序列化和反序列化对象：

static byte[] serializeEnv(Envelope message) {
    try {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(message);
        return baos.toByteArray();
    } catch (IOException e) {
        System.err.println("Error: " + e.getMessage());
        e.printStackTrace(System.err);
    }
    return null;
}

static Envelope deserializeEnv(byte[] bytes) {
    System.out.println("\nRECEVIVED LENGTH: " + bytes.length + ". SEND BYTES YO: " + bytes[0] + ", " + bytes[1] + ", " + bytes[2] + ", " + bytes[3] + ", " + bytes[4]);
    ObjectInputStream ois = null;
    try {

仅当字节被加密/解密时才会出现错误

           ois = new ObjectInputStream(new ByteArrayInputStream(bytes)); // Error
           Envelope message = (Envelope) ois.readObject();
           return message;
    } catch (IOException | ClassNotFoundException e) {
        System.err.println("Error: " + e.getMessage());
        e.printStackTrace(System.err);
    }
    return null;
}

这是我加密和解密的方法：

static byte[] encryptEnv(Envelope message, SecretKey secretKey) {
    try {
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding", "BC");
        cipher.init(Cipher.ENCRYPT_MODE, secretKey);
        byte[] serializedEnv = serializeEnv(message);
        return cipher.doFinal(serializedEnv);
    } catch (NoSuchAlgorithmException | NoSuchProviderException | NoSuchPaddingException | InvalidKeyException e) {
        System.err.println("Error: " + e.getMessage());
        e.printStackTrace(System.err);
    } catch (IllegalBlockSizeException | BadPaddingException e) {
        System.err.println("Error: " + e.getMessage());
        e.printStackTrace(System.err);
    }
    return null;
}

static Envelope decryptEnv(int length, byte[] bytes, SecretKey secretKey, IvParameterSpec ivSpec) {
    try {
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding", "BC");
        cipher.init(Cipher.DECRYPT_MODE, secretKey, ivSpec);
        byte[] decrypted = cipher.doFinal(bytes);
        return deserializeEnv(decrypted);
    } catch (NoSuchAlgorithmException | NoSuchProviderException | NoSuchPaddingException e) {
        System.err.println("Error: " + e.getMessage());
        e.printStackTrace(System.err);
    } catch (InvalidKeyException | InvalidAlgorithmParameterException | IllegalBlockSizeException | BadPaddingException e) {
        System.err.println("Error: " + e.getMessage());
        e.printStackTrace(System.err);
    }
    return null;
}

要通过套接字发送加密的字节数组，我只需将其添加到包装类 Envelope，然后发送：output.writeObject(myEnvelope) 并检索它myEnvelope = (Envelope) input.readObject()

任何人都可以看到加密是如何搞砸一切的吗？

Answer 1

anttix 是对的，我不知何故忘记在我的加密密码中包含初始化向量。叹息。

cipher.init(Cipher.ENCRYPT_MODE, secretKey); -->

cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivSpec);