Merging other languages
This commit is contained in:
James Miranda
247
en/09.6.md
247
en/09.6.md
@@ -1,122 +1,125 @@
|
||||
# 9.6 加密和解密数据
|
||||
前面小节介绍了如何存储密码，但是有的时候，我们想把一些敏感数据加密后存储起来，在将来的某个时候，随需将它们解密出来，此时我们应该在选用对称加密算法来满足我们的需求。
|
||||
|
||||
## base64加解密
|
||||
如果Web应用足够简单，数据的安全性没有那么严格的要求，那么可以采用一种比较简单的加解密方法是`base64`，这种方式实现起来比较简单，Go语言的`base64`包已经很好的支持了这个，请看下面的例子：
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
func base64Encode(src []byte) []byte {
|
||||
return []byte(base64.StdEncoding.EncodeToString(src))
|
||||
}
|
||||
|
||||
func base64Decode(src []byte) ([]byte, error) {
|
||||
return base64.StdEncoding.DecodeString(string(src))
|
||||
}
|
||||
|
||||
func main() {
|
||||
// encode
|
||||
hello := "你好，世界！ hello world"
|
||||
debyte := base64Encode([]byte(hello))
|
||||
fmt.Println(debyte)
|
||||
// decode
|
||||
enbyte, err := base64Decode(debyte)
|
||||
if err != nil {
|
||||
fmt.Println(err.Error())
|
||||
}
|
||||
|
||||
if hello != string(enbyte) {
|
||||
fmt.Println("hello is not equal to enbyte")
|
||||
}
|
||||
|
||||
fmt.Println(string(enbyte))
|
||||
}
|
||||
|
||||
|
||||
## 高级加解密
|
||||
|
||||
Go语言的`crypto`里面支持对称加密的高级加解密包有：
|
||||
|
||||
- `crypto/aes`包：AES(Advanced Encryption Standard)，又称Rijndael加密法，是美国联邦政府采用的一种区块加密标准。
|
||||
- `crypto/des`包：DES(Data Encryption Standard)，是一种对称加密标准，是目前使用最广泛的密钥系统，特别是在保护金融数据的安全中。曾是美国联邦政府的加密标准，但现已被AES所替代。
|
||||
|
||||
因为这两种算法使用方法类似，所以在此，我们仅用aes包为例来讲解它们的使用，请看下面的例子
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"fmt"
|
||||
"os"
|
||||
)
|
||||
|
||||
var commonIV = []byte{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f}
|
||||
|
||||
func main() {
|
||||
//需要去加密的字符串
|
||||
plaintext := []byte("My name is Astaxie")
|
||||
//如果传入加密串的话，plaint就是传入的字符串
|
||||
if len(os.Args) > 1 {
|
||||
plaintext = []byte(os.Args[1])
|
||||
}
|
||||
|
||||
//aes的加密字符串
|
||||
key_text := "astaxie12798akljzmknm.ahkjkljl;k"
|
||||
if len(os.Args) > 2 {
|
||||
key_text = os.Args[2]
|
||||
}
|
||||
|
||||
fmt.Println(len(key_text))
|
||||
|
||||
// 创建加密算法aes
|
||||
c, err := aes.NewCipher([]byte(key_text))
|
||||
if err != nil {
|
||||
fmt.Printf("Error: NewCipher(%d bytes) = %s", len(key_text), err)
|
||||
os.Exit(-1)
|
||||
}
|
||||
|
||||
//加密字符串
|
||||
cfb := cipher.NewCFBEncrypter(c, commonIV)
|
||||
ciphertext := make([]byte, len(plaintext))
|
||||
cfb.XORKeyStream(ciphertext, plaintext)
|
||||
fmt.Printf("%s=>%x\n", plaintext, ciphertext)
|
||||
|
||||
// 解密字符串
|
||||
cfbdec := cipher.NewCFBDecrypter(c, commonIV)
|
||||
plaintextCopy := make([]byte, len(plaintext))
|
||||
cfbdec.XORKeyStream(plaintextCopy, ciphertext)
|
||||
fmt.Printf("%x=>%s\n", ciphertext, plaintextCopy)
|
||||
}
|
||||
|
||||
|
||||
上面通过调用函数`aes.NewCipher`(参数key必须是16、24或者32位的[]byte，分别对应AES-128, AES-192或AES-256算法),返回了一个`cipher.Block`接口，这个接口实现了三个功能：
|
||||
|
||||
type Block interface {
|
||||
// BlockSize returns the cipher's block size.
|
||||
BlockSize() int
|
||||
|
||||
// Encrypt encrypts the first block in src into dst.
|
||||
// Dst and src may point at the same memory.
|
||||
Encrypt(dst, src []byte)
|
||||
|
||||
// Decrypt decrypts the first block in src into dst.
|
||||
// Dst and src may point at the same memory.
|
||||
Decrypt(dst, src []byte)
|
||||
}
|
||||
|
||||
这三个函数实现了加解密操作，详细的操作请看上面的例子。
|
||||
|
||||
## 总结
|
||||
这小节介绍了几种加解密的算法，在开发Web应用的时候可以根据需求采用不同的方式进行加解密，一般的应用可以采用base64算法，更加高级的话可以采用aes或者des算法。
|
||||
|
||||
|
||||
## links
|
||||
* [目录](<preface.md>)
|
||||
* 上一节: [存储密码](<09.5.md>)
|
||||
* 下一节: [小结](<09.7.md>)
|
||||
# 9.6 Encrypting and decrypting data
|
||||
|
||||
The previous section describes how to securely store passwords, but sometimes it might be neccessary to modify some sensitive encrypted data that has already been stored into our database. When data decryption is required, we should use a symmetric encryption algorithm instead of the one-way hashing techniques we've previously covered.
|
||||
|
||||
## Base64 Encryption and decryption
|
||||
|
||||
If the web application is relatively simple, and the data security requirements are not so stringent, then you can use a relatively simple method of encryption and decryption using `base64`. This approach is relatively straightforward to implement, and Go's `base64` package has good support for this. Consider the following example:
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
func base64Encode(src []byte) []byte {
|
||||
return []byte(base64.StdEncoding.EncodeToString(src))
|
||||
}
|
||||
|
||||
func base64Decode(src []byte) ([]byte, error) {
|
||||
return base64.StdEncoding.DecodeString(string(src))
|
||||
}
|
||||
|
||||
func main() {
|
||||
// encode
|
||||
hello := "你好，世界！ hello world"
|
||||
debyte := base64Encode([]byte(hello))
|
||||
fmt.Println(debyte)
|
||||
// decode
|
||||
enbyte, err := base64Decode(debyte)
|
||||
if err != nil {
|
||||
fmt.Println(err.Error())
|
||||
}
|
||||
|
||||
if hello != string(enbyte) {
|
||||
fmt.Println("hello is not equal to enbyte")
|
||||
}
|
||||
|
||||
fmt.Println(string(enbyte))
|
||||
}
|
||||
|
||||
|
||||
## Advanced encryption and decryption
|
||||
|
||||
The Go language supports symmetric encryption algorithms in its `crypto` package. Two advanced encryption modules are:
|
||||
|
||||
- `crypto/aes` package: AES (Advanced Encryption Standard), also known as Rijndael encryption method, is used by the U.S. federal government as a block encryption standard.
|
||||
- `crypto/des` package: DES (Data Encryption Standard), is a symmetric encryption standard . It's currently the most widely used key system, especially in protecting the security of financial data. It used to be the United States federal government's encryption standard, but has now been replaced by AES.
|
||||
|
||||
Because using these two encryption algorithms is quite similar, we'll just use the `aes` package in the following example to demonstrate how you'd typically use these packages:
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"fmt"
|
||||
"os"
|
||||
)
|
||||
|
||||
var commonIV = []byte{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f}
|
||||
|
||||
func main() {
|
||||
// Need to encrypt a string
|
||||
plaintext := []byte("My name is Astaxie")
|
||||
// If there is an incoming string of words to be encrypted, set plaintext to that incoming string
|
||||
if len(os.Args) > 1 {
|
||||
plaintext = []byte(os.Args[1])
|
||||
}
|
||||
|
||||
// aes encryption string
|
||||
key_text := "astaxie12798akljzmknm.ahkjkljl;k"
|
||||
if len(os.Args) > 2 {
|
||||
key_text = os.Args[2]
|
||||
}
|
||||
|
||||
fmt.Println(len(key_text))
|
||||
|
||||
// Create the aes encryption algorithm
|
||||
c, err := aes.NewCipher([]byte(key_text))
|
||||
if err != nil {
|
||||
fmt.Printf("Error: NewCipher(%d bytes) = %s", len(key_text), err)
|
||||
os.Exit(-1)
|
||||
}
|
||||
|
||||
// Encrypted string
|
||||
cfb := cipher.NewCFBEncrypter(c, commonIV)
|
||||
ciphertext := make([]byte, len(plaintext))
|
||||
cfb.XORKeyStream(ciphertext, plaintext)
|
||||
fmt.Printf("%s=>%x\n", plaintext, ciphertext)
|
||||
|
||||
// Decrypt strings
|
||||
cfbdec := cipher.NewCFBDecrypter(c, commonIV)
|
||||
plaintextCopy := make([]byte, len(plaintext))
|
||||
cfbdec.XORKeyStream(plaintextCopy, ciphertext)
|
||||
fmt.Printf("%x=>%s\n", ciphertext, plaintextCopy)
|
||||
}
|
||||
|
||||
Calling the above function `aes.NewCipher` (whose []byte key parameter must be 16, 24 or 32, corresponding to the AES-128, AES-192 or AES-256 algorithms, respectively), returns a `cipher.Block` Interface that implements three functions:
|
||||
|
||||
type Block interface {
|
||||
// BlockSize returns the cipher's block size.
|
||||
BlockSize() int
|
||||
|
||||
// Encrypt encrypts the first block in src into dst.
|
||||
// Dst and src may point at the same memory.
|
||||
Encrypt(dst, src []byte)
|
||||
|
||||
// Decrypt decrypts the first block in src into dst.
|
||||
// Dst and src may point at the same memory.
|
||||
Decrypt(dst, src []byte)
|
||||
}
|
||||
|
||||
These three functions implement encryption and decryption operations; see the Go documentation for a more detailed explanation.
|
||||
|
||||
## Summary
|
||||
|
||||
This section describes several encryption algorithms which can be used in different ways according to your web application's encryption and decryption needs. For the most basic applications, base64 encoding may suffice. For applications with more stringent security requirements, it's recommended to use the more advanced AES or DES algorithm .
|
||||
|
||||
|
||||
## Links
|
||||
|
||||
- [Directory](<preface.md>)
|
||||
- Previous: [store passwords](<09.5.md>)
|
||||
- Next: [Summary](<09.7.md>)
|
||||
|
||||
Reference in New Issue
Block a user