为什么 RC4 无法处理大量加密数据？

Question

我有以下解密文件的代码。

package encryption;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.Security;

import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

public class Decrypter {

    private static final String PASSWORD = "t_9Y#i@eT[h3}-7!";
    private static final String KEY_ALGORITHM = "PBEWithMD5AndDES";
    private static final String CIPHER_ALGORITHM = "RC4"; //Using Salsa20 or HC256 solves the problem
    private static final String PROVIDER = "BC";

    public static void main(String[] args) throws Exception {
        Security.addProvider(new BouncyCastleProvider());

        File inputFile = new File(args[0]);
        File outputFile = new File(args[1]);

        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(KEY_ALGORITHM);
        SecretKey key = keyFactory.generateSecret(new PBEKeySpec(PASSWORD.toCharArray()));

        Cipher cipher = Cipher.getInstance(CIPHER_ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, key);

        InputStream inputStream = new FileInputStream(inputFile);
        OutputStream outputStream = new FileOutputStream(outputFile);

        CipherInputStream cipherInputStream = new CipherInputStream(inputStream, cipher);

        byte []byteBuffer = new byte[(int)inputFile.length()]; 
        cipherInputStream.read(byteBuffer);
        outputStream.write(byteBuffer); //Only 512bytes of decrypted data is written to file, the rest becomes null
        outputStream.close();
    }

}

我的问题是我做错了什么？为什么 RC4 不解密大小超过 512 字节的块。

Answer 1

InputStream.read 只返回一定数量的数据，你应该循环直到流为空。不过我建议你使用 commons-io 的 org.apache.commons.io.FileUtils.copyInputStreamToFile(InputStream, File) 来复制流而不是自己滚动......

Answer 2

RC4 是一种流密码，因此它可以解码任意数量的数据。您的问题是 InputStreams 没有被大量读取。通常，您循环读取调用，直到没有更多数据可供读取并使用小缓冲区。请参阅documentation of read()。

这可以实现为

while(true) {
    int numRead = cipherInputStream.read(byteBuffer);
    if(numRead == -1)
        break;
    outputStream.write(byteBuffer, 0, numRead);
}

Answer 3

@Michael Lowman 有正确的答案，但我想我会展示另一种方式来宣传 DataInputStream 类的功能。

您可以通过使用DataInputStream.readFully() 方法来实现read-it-all-in-one-go 行为，例如perl slurp。在您的示例中，您可以使用此方法读取字节，然后将它们写出并使用 CipherOutputStream 而不是 CipherInputStream 解密。

以以下片段为例：

    byte[] byteBuffer = new byte[(int) inputFile.length()];
    DataInputStream dis = new DataInputStream(inputStream);
    dis.readFully(byteBuffer);
    dis.close();
    CipherOutputStream cos = new CipherOutputStream(outputStream, cipher);
    cos.write(byteBuffer);
    cos.close();