iOS RSA+AES 加密、解密

作者: 梦回蓝桥 | 来源:发表于2018-02-26 17:32 被阅读76次

年前忙着赶项目，也没时间更新，现在告一段落，因为是贷款类项目，涉及到用户的银行卡，身份证等信息，不可避免的使用到了加密相关技术，这里就来聊聊RSA与AES加密吧

1. 有关对称加密与非对称加密的区别：

参考之前写的文章（1.3-1.4-1.5）

https://www.jianshu.com/p/4112bc3334af
RSA（非对称加密，公钥加密，私钥解密，涉及数字签名等，速度相对较慢）
AES（对称加密，公、私钥相同，速度相对较快，如DES、RC5、RC6）
安全的HTTPS（相对）就是同时使用了对称加密以及非对称加密.

2. RSA 加、解密

加密流程：

一种是根据服务端提供给你的.cer或.der证书(不管是.cer还是.der其实只是一个公钥的载体)进行加密，根据.p12文件进行解密;
另一种就是根据服务端直接提供给你的公、私钥(字符串)进行加、解密;
我们使用的是证书加、解密，所以只做此演示.
1. 服务端会给你生成一个cer或者der证书，直接拖进项目即可（选中copy选项）.
2. 根据证书路径生成公钥
3. 使用生成的公钥对文件（文件的生成：是字典->json字符串->UTF8）进行加密，将加密后生成的NSData转成base64码（字符串）传给服务端即可;

这里先来看看RSA加密相关类SXRSAEncryptor(直接拷贝可用)

其中 SXRSAEncryptor.h

#import <Foundation/Foundation.h>

@interface SXRSAEncryptor : NSObject

/**
 *  加密方法
 *
 *  @param str   需要加密的字符串
 *  @param path  '.der'格式的公钥文件路径
 */
+ (NSString *)encryptString:(NSString *)str publicKeyWithContentsOfFile:(NSString *)path;

/**
 *  解密方法
 *
 *  @param str       需要解密的字符串
 *  @param path      '.p12'格式的私钥文件路径
 *  @param password  私钥文件密码
 */
+ (NSString *)decryptString:(NSString *)str privateKeyWithContentsOfFile:(NSString *)path password:(NSString *)password;

/**
 *  加密方法
 *
 *  @param str    需要加密的字符串
 *  @param pubKey 公钥字符串
 */
+ (NSString *)encryptString:(NSString *)str publicKey:(NSString *)pubKey;

/**
 *  解密方法
 *
 *  @param str     需要解密的字符串
 *  @param privKey 私钥字符串
 */
+ (NSString *)decryptString:(NSString *)str privateKey:(NSString *)privKey;



@end

SXRSAEncryptor.m

#import "SXRSAEncryptor.h"
#import <Security/Security.h>
@implementation SXRSAEncryptor

static NSString *base64_encode_data(NSData *data){
data = [data base64EncodedDataWithOptions:0];
NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
return ret;
}

static NSData *base64_decode(NSString *str){
NSData *data = [[NSData alloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters];
return data;
}

#pragma mark - 使用'.der'公钥文件加密

//加密
+ (NSString *)encryptString:(NSString *)str publicKeyWithContentsOfFile:(NSString *)path{
if (!str || !path)  return nil;
return [self encryptString:str publicKeyRef:[self getPublicKeyRefWithContentsOfFile:path]];
}

//获取公钥
+ (SecKeyRef)getPublicKeyRefWithContentsOfFile:(NSString *)filePath{
NSData *certData = [NSData dataWithContentsOfFile:filePath];
if (!certData) {
    return nil;
}
SecCertificateRef cert = SecCertificateCreateWithData(NULL, (CFDataRef)certData);
SecKeyRef key = NULL;
SecTrustRef trust = NULL;
SecPolicyRef policy = NULL;
if (cert != NULL) {
    policy = SecPolicyCreateBasicX509();
    if (policy) {
        if (SecTrustCreateWithCertificates((CFTypeRef)cert, policy, &trust) == noErr) {
            SecTrustResultType result;
            if (SecTrustEvaluate(trust, &result) == noErr) {
                key = SecTrustCopyPublicKey(trust);
            }
        }
    }
}
if (policy) CFRelease(policy);
if (trust) CFRelease(trust);
if (cert) CFRelease(cert);
return key;
}

+ (NSString *)encryptString:(NSString *)str publicKeyRef:(SecKeyRef)publicKeyRef{
if(![str dataUsingEncoding:NSUTF8StringEncoding]){
    return nil;
}
if(!publicKeyRef){
    return nil;
}
NSData *data = [self encryptData:[str dataUsingEncoding:NSUTF8StringEncoding] withKeyRef:publicKeyRef];
NSString *ret = base64_encode_data(data);
return ret;
}

#pragma mark - 使用'.12'私钥文件解密

//解密
+ (NSString *)decryptString:(NSString *)str privateKeyWithContentsOfFile:(NSString *)path password:(NSString *)password{
if (!str || !path) return nil;
if (!password) password = @"";
return [self decryptString:str privateKeyRef:[self getPrivateKeyRefWithContentsOfFile:path password:password]];
}

//获取私钥
+ (SecKeyRef)getPrivateKeyRefWithContentsOfFile:(NSString *)filePath password:(NSString*)password{

NSData *p12Data = [NSData dataWithContentsOfFile:filePath];
if (!p12Data) {
    return nil;
}
SecKeyRef privateKeyRef = NULL;
NSMutableDictionary * options = [[NSMutableDictionary alloc] init];
[options setObject: password forKey:(__bridge id)kSecImportExportPassphrase];
CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
OSStatus securityError = SecPKCS12Import((__bridge CFDataRef) p12Data, (__bridge CFDictionaryRef)options, &items);
if (securityError == noErr && CFArrayGetCount(items) > 0) {
    CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items, 0);
    SecIdentityRef identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
    securityError = SecIdentityCopyPrivateKey(identityApp, &privateKeyRef);
    if (securityError != noErr) {
        privateKeyRef = NULL;
    }
}
CFRelease(items);

return privateKeyRef;
}

+ (NSString *)decryptString:(NSString *)str privateKeyRef:(SecKeyRef)privKeyRef{
NSData *data = [[NSData alloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters];
if (!privKeyRef) {
    return nil;
}
data = [self decryptData:data withKeyRef:privKeyRef];
NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
return ret;
}

#pragma mark - 使用公钥字符串加密

/* START: Encryption with RSA public key */

//使用公钥字符串加密
+ (NSString *)encryptString:(NSString *)str publicKey:(NSString *)pubKey{
NSData *data = [self encryptData:[str dataUsingEncoding:NSUTF8StringEncoding] publicKey:pubKey];
NSString *ret = base64_encode_data(data);
return ret;
}

+ (NSData *)encryptData:(NSData *)data publicKey:(NSString *)pubKey{
if(!data || !pubKey){
    return nil;
}
SecKeyRef keyRef = [self addPublicKey:pubKey];
if(!keyRef){
    return nil;
}
return [self encryptData:data withKeyRef:keyRef];
}

+ (SecKeyRef)addPublicKey:(NSString *)key{
NSRange spos = [key rangeOfString:@"-----BEGIN PUBLIC KEY-----"];
NSRange epos = [key rangeOfString:@"-----END PUBLIC KEY-----"];
if(spos.location != NSNotFound && epos.location != NSNotFound){
    NSUInteger s = spos.location + spos.length;
    NSUInteger e = epos.location;
    NSRange range = NSMakeRange(s, e-s);
    key = [key substringWithRange:range];
}
key = [key stringByReplacingOccurrencesOfString:@"\r" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@"\n" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@"\t" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@" "  withString:@""];

// This will be base64 encoded, decode it.
NSData *data = base64_decode(key);
data = [self stripPublicKeyHeader:data];
if(!data){
    return nil;
}

//a tag to read/write keychain storage
NSString *tag = @"RSAUtil_PubKey";
NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];

// Delete any old lingering key with the same tag
NSMutableDictionary *publicKey = [[NSMutableDictionary alloc] init];
[publicKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
[publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
[publicKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
SecItemDelete((__bridge CFDictionaryRef)publicKey);

// Add persistent version of the key to system keychain
[publicKey setObject:data forKey:(__bridge id)kSecValueData];
[publicKey setObject:(__bridge id) kSecAttrKeyClassPublic forKey:(__bridge id)
 kSecAttrKeyClass];
[publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)
 kSecReturnPersistentRef];

CFTypeRef persistKey = nil;
OSStatus status = SecItemAdd((__bridge CFDictionaryRef)publicKey, &persistKey);
if (persistKey != nil){
    CFRelease(persistKey);
}
if ((status != noErr) && (status != errSecDuplicateItem)) {
    return nil;
}

[publicKey removeObjectForKey:(__bridge id)kSecValueData];
[publicKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
[publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
[publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];

// Now fetch the SecKeyRef version of the key
SecKeyRef keyRef = nil;
status = SecItemCopyMatching((__bridge CFDictionaryRef)publicKey, (CFTypeRef *)&keyRef);
if(status != noErr){
    return nil;
}
return keyRef;
}

+ (NSData *)stripPublicKeyHeader:(NSData *)d_key{
// Skip ASN.1 public key header
if (d_key == nil) return(nil);

unsigned long len = [d_key length];
if (!len) return(nil);

unsigned char *c_key = (unsigned char *)[d_key bytes];
unsigned int  idx     = 0;

if (c_key[idx++] != 0x30) return(nil);

if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
else idx++;

// PKCS #1 rsaEncryption szOID_RSA_RSA
static unsigned char seqiod[] =
{ 0x30,   0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
    0x01, 0x05, 0x00 };
if (memcmp(&c_key[idx], seqiod, 15)) return(nil);

idx += 15;

if (c_key[idx++] != 0x03) return(nil);

if (c_key[idx] > 0x80) idx += c_key[idx] - 0x80 + 1;
else idx++;

if (c_key[idx++] != '\0') return(nil);

// Now make a new NSData from this buffer
return ([NSData dataWithBytes:&c_key[idx] length:len - idx]);
}

+ (NSData *)encryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef{
const uint8_t *srcbuf = (const uint8_t *)[data bytes];
size_t srclen = (size_t)data.length;

size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
void *outbuf = malloc(block_size);
size_t src_block_size = block_size - 11;

NSMutableData *ret = [[NSMutableData alloc] init];
for(int idx=0; idx<srclen; idx+=src_block_size){
    //NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
    size_t data_len = srclen - idx;
    if(data_len > src_block_size){
        data_len = src_block_size;
    }
    
    size_t outlen = block_size;
    OSStatus status = noErr;
    status = SecKeyEncrypt(keyRef,
                           kSecPaddingPKCS1,
                           srcbuf + idx,
                           data_len,
                           outbuf,
                           &outlen
                           );
    if (status != 0) {
        NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
        ret = nil;
        break;
    }else{
        [ret appendBytes:outbuf length:outlen];
    }
  }

  free(outbuf);
  CFRelease(keyRef);
  return ret;
  }

 /* END: Encryption with RSA public key */

#pragma mark - 使用私钥字符串解密

/* START: Decryption with RSA private key */

//使用私钥字符串解密
+ (NSString *)decryptString:(NSString *)str privateKey:(NSString *)privKey{
if (!str) return nil;
NSData *data = [[NSData alloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters];
data = [self decryptData:data privateKey:privKey];
NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
return ret;
}

+ (NSData *)decryptData:(NSData *)data privateKey:(NSString *)privKey{
if(!data || !privKey){
    return nil;
}
SecKeyRef keyRef = [self addPrivateKey:privKey];
if(!keyRef){
    return nil;
}
return [self decryptData:data withKeyRef:keyRef];
}

+ (SecKeyRef)addPrivateKey:(NSString *)key{
NSRange spos = [key rangeOfString:@"-----BEGIN RSA PRIVATE KEY-----"];
NSRange epos = [key rangeOfString:@"-----END RSA PRIVATE KEY-----"];
if(spos.location != NSNotFound && epos.location != NSNotFound){
    NSUInteger s = spos.location + spos.length;
    NSUInteger e = epos.location;
    NSRange range = NSMakeRange(s, e-s);
    key = [key substringWithRange:range];
}
key = [key stringByReplacingOccurrencesOfString:@"\r" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@"\n" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@"\t" withString:@""];
key = [key stringByReplacingOccurrencesOfString:@" "  withString:@""];

// This will be base64 encoded, decode it.
NSData *data = base64_decode(key);
data = [self stripPrivateKeyHeader:data];
if(!data){
    return nil;
}

//a tag to read/write keychain storage
NSString *tag = @"RSAUtil_PrivKey";
NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];

// Delete any old lingering key with the same tag
NSMutableDictionary *privateKey = [[NSMutableDictionary alloc] init];
[privateKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
[privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
[privateKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
SecItemDelete((__bridge CFDictionaryRef)privateKey);

// Add persistent version of the key to system keychain
[privateKey setObject:data forKey:(__bridge id)kSecValueData];
[privateKey setObject:(__bridge id) kSecAttrKeyClassPrivate forKey:(__bridge id)
 kSecAttrKeyClass];
[privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)
 kSecReturnPersistentRef];

CFTypeRef persistKey = nil;
OSStatus status = SecItemAdd((__bridge CFDictionaryRef)privateKey, &persistKey);
if (persistKey != nil){
    CFRelease(persistKey);
}
if ((status != noErr) && (status != errSecDuplicateItem)) {
    return nil;
}

[privateKey removeObjectForKey:(__bridge id)kSecValueData];
[privateKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
[privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
[privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];

// Now fetch the SecKeyRef version of the key
SecKeyRef keyRef = nil;
status = SecItemCopyMatching((__bridge CFDictionaryRef)privateKey, (CFTypeRef *)&keyRef);
if(status != noErr){
    return nil;
}
return keyRef;
}

+ (NSData *)stripPrivateKeyHeader:(NSData *)d_key{
// Skip ASN.1 private key header
if (d_key == nil) return(nil);

unsigned long len = [d_key length];
if (!len) return(nil);

unsigned char *c_key = (unsigned char *)[d_key bytes];
unsigned int  idx     = 22; //magic byte at offset 22

if (0x04 != c_key[idx++]) return nil;

//calculate length of the key
unsigned int c_len = c_key[idx++];
int det = c_len & 0x80;
if (!det) {
    c_len = c_len & 0x7f;
} else {
    int byteCount = c_len & 0x7f;
    if (byteCount + idx > len) {
        //rsa length field longer than buffer
        return nil;
    }
    unsigned int accum = 0;
    unsigned char *ptr = &c_key[idx];
    idx += byteCount;
    while (byteCount) {
        accum = (accum << 8) + *ptr;
        ptr++;
        byteCount--;
    }
    c_len = accum;
}

// Now make a new NSData from this buffer
return [d_key subdataWithRange:NSMakeRange(idx, c_len)];
 }

+ (NSData *)decryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef{
const uint8_t *srcbuf = (const uint8_t *)[data bytes];
size_t srclen = (size_t)data.length;

size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
UInt8 *outbuf = malloc(block_size);
size_t src_block_size = block_size;

NSMutableData *ret = [[NSMutableData alloc] init];
for(int idx=0; idx<srclen; idx+=src_block_size){
    //NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
    size_t data_len = srclen - idx;
    if(data_len > src_block_size){
        data_len = src_block_size;
    }
    
    size_t outlen = block_size;
    OSStatus status = noErr;
    status = SecKeyDecrypt(keyRef,
                           kSecPaddingNone,
                           srcbuf + idx,
                           data_len,
                           outbuf,
                           &outlen
                           );
    if (status != 0) {
        NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
        ret = nil;
        break;
    }else{
        //the actual decrypted data is in the middle, locate it!
        int idxFirstZero = -1;
        int idxNextZero = (int)outlen;
        for ( int i = 0; i < outlen; i++ ) {
            if ( outbuf[i] == 0 ) {
                if ( idxFirstZero < 0 ) {
                    idxFirstZero = i;
                } else {
                    idxNextZero = i;
                    break;
                }
            }
        }
        
        [ret appendBytes:&outbuf[idxFirstZero+1] length:idxNextZero-idxFirstZero-1];
    }
}

free(outbuf);
CFRelease(keyRef);
return ret;
}

@end

从上面的.h和.m文件可以看到，这里提供了上述两种加解密的方法，请根据实际需求选择.

3. AES 加、解密

同样的这里先来看看AES加密相关类SXAESEncryptor(直接拷贝可用)
SXAESEncryptor.h

#import <Foundation/Foundation.h>

@interface SXAESEncryptor : NSObject

// 普通AES加、解密
+(NSData *)AES256ParmEncryptWithKey:(NSString *)key Encrypttext:(NSData *)text;   //加密
+(NSData *)AES256ParmDecryptWithKey:(NSString *)key Decrypttext:(NSData *)text;   //解密
+(NSString *) aes256_encrypt:(NSString *)key Encrypttext:(NSString *)text;
+(NSString *) aes256_decrypt:(NSString *)key Decrypttext:(NSString *)text;

// 追加base64方式加密
+ (NSString *)encryptAES:(NSString *)content key:(NSString *)key;

// 追加base64方式解密
+ (NSDictionary *)decryptAES:(NSString *)content key:(NSString *)key;

@end

SXAESEncryptor.m

#import "SXAESEncryptor.h"
#import <CommonCrypto/CommonCryptor.h>
@implementation SXAESEncryptor

/** 初始向量*/
NSString *const kInitVector = @"16-Bytes--String";
/** 密钥长度：AES-128*/
size_t const kKeySize = kCCKeySizeAES256;

************************* 普通AES 256 位加密，如果是 128、192 直接修改 kKeySize即可 ********************

+(NSData *)AES256ParmEncryptWithKey:(NSString *)key Encrypttext:(NSData *)text  //加密
{
char keyPtr[kKeySize +1];
bzero(keyPtr, sizeof(keyPtr));
[key getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];
NSUInteger dataLength = [text length];
size_t bufferSize = dataLength + kCCBlockSizeAES128;
void *buffer = malloc(bufferSize);
size_t numBytesEncrypted = 0;
CCCryptorStatus cryptStatus = CCCrypt(kCCEncrypt, kCCAlgorithmAES128,
                                      kCCOptionPKCS7Padding | kCCOptionECBMode,
                                      keyPtr, kCCBlockSizeAES128,
                                      NULL,
                                      [text bytes], dataLength,
                                      buffer, bufferSize,
                                      &numBytesEncrypted);
if (cryptStatus == kCCSuccess) {
    // 对加密后的数据进行 base64 编码
    //        return [[NSData dataWithBytesNoCopy:buffer length:numBytesEncrypted] base64EncodedStringWithOptions:NSDataBase64EncodingEndLineWithLineFeed];
    return [NSData dataWithBytesNoCopy:buffer length:numBytesEncrypted];
}
free(buffer);
return nil;
}

+ (NSData *)AES256ParmDecryptWithKey:(NSString *)key Decrypttext:(NSData *)text  //解密
{
char keyPtr[kKeySize +1];
bzero(keyPtr, sizeof(keyPtr));
[key getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];
NSUInteger dataLength = [text length];
size_t bufferSize = dataLength + kCCBlockSizeAES128;
void *buffer = malloc(bufferSize);
size_t numBytesDecrypted = 0;
CCCryptorStatus cryptStatus = CCCrypt(kCCDecrypt, kCCAlgorithmAES128,
                                      kCCOptionPKCS7Padding | kCCOptionECBMode,
                                      keyPtr, kCCBlockSizeAES128,
                                      NULL,
                                      [text bytes], dataLength,
                                      buffer, bufferSize,
                                      &numBytesDecrypted);
if (cryptStatus == kCCSuccess) {
    return [NSData dataWithBytesNoCopy:buffer length:numBytesDecrypted];
}
free(buffer);
return nil;
}

+(NSString *) aes256_encrypt:(NSString *)key Encrypttext:(NSString *)text
{
const char *cstr = [text cStringUsingEncoding:NSUTF8StringEncoding];
NSData *data = [NSData dataWithBytes:cstr length:text.length];
//对数据进行加密
NSData *result = [SXAESEncryptor AES256ParmEncryptWithKey:key Encrypttext:data];

//转换为2进制字符串
if (result && result.length > 0) {
    
    Byte *datas = (Byte*)[result bytes];
    NSMutableString *output = [NSMutableString stringWithCapacity:result.length * 2];
    for(int i = 0; i < result.length; i++){
        [output appendFormat:@"%02x", datas[i]];
    }
    return output;
}
return nil;
}

+(NSString *) aes256_decrypt:(NSString *)key Decrypttext:(NSString *)text
{
//转换为2进制Data
NSMutableData *data = [NSMutableData dataWithCapacity:text.length / 2];
unsigned char whole_byte;
char byte_chars[3] = {'\0','\0','\0'};
int i;
for (i=0; i < [text length] / 2; i++) {
    byte_chars[0] = [text characterAtIndex:i*2];
    byte_chars[1] = [text characterAtIndex:i*2+1];
    whole_byte = strtol(byte_chars, NULL, 16);
    [data appendBytes:&whole_byte length:1];
}

//对数据进行解密
NSData* result = [SXAESEncryptor  AES256ParmDecryptWithKey:key Decrypttext:data];
if (result && result.length > 0) {
    return [[NSString alloc] initWithData:result encoding:NSUTF8StringEncoding];
}
return nil;
}





************************** 追加base64加、解密 *********************

// 项目中使用基于base64加密方法
+ (NSString *)encryptAES:(NSString *)content key:(NSString *)key {

NSData *contentData = [content dataUsingEncoding:NSUTF8StringEncoding];
NSUInteger dataLength = contentData.length;

// 为结束符'\0' +1
char keyPtr[kKeySize + 1];
memset(keyPtr, 0, sizeof(keyPtr));
[key getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];

// 密文长度 <= 明文长度 + BlockSize
size_t encryptSize = dataLength + kCCBlockSizeAES128;
void *encryptedBytes = malloc(encryptSize);
size_t actualOutSize = 0;

//    NSData *initVector = [kInitVector dataUsingEncoding:NSUTF8StringEncoding];

CCCryptorStatus cryptStatus = CCCrypt(kCCEncrypt,
                                      kCCAlgorithmAES,
                                      kCCOptionPKCS7Padding | kCCOptionECBMode,  // 系统默认使用 CBC，然后指明使用 PKCS7Padding
                                      keyPtr,
                                      kKeySize,
                                      NULL,
                                      contentData.bytes,
                                      dataLength,
                                      encryptedBytes,
                                      encryptSize,
                                      &actualOutSize);

if (cryptStatus == kCCSuccess) {
    // 对加密后的数据进行 base64 编码
    return [[NSData dataWithBytesNoCopy:encryptedBytes length:actualOutSize] base64EncodedStringWithOptions:NSDataBase64EncodingEndLineWithLineFeed];
}
free(encryptedBytes);
return nil;
}


// 项目中使用基于base64解密方法
+ (NSDictionary *)decryptAES:(NSString *)content key:(NSString *)key {
// 把 base64 String 转换成 Data
NSData *contentData = [[NSData alloc] initWithBase64EncodedString:content options:NSDataBase64DecodingIgnoreUnknownCharacters];
NSUInteger dataLength = contentData.length;

char keyPtr[kKeySize + 1];
memset(keyPtr, 0, sizeof(keyPtr));
[key getCString:keyPtr maxLength:sizeof(keyPtr) encoding:NSUTF8StringEncoding];

size_t decryptSize = dataLength + kCCBlockSizeAES128;
void *decryptedBytes = malloc(decryptSize);
size_t actualOutSize = 0;

// 这里不使用初始向量
// NSData *initVector = [kInitVector dataUsingEncoding:NSUTF8StringEncoding];
CCCryptorStatus cryptStatus = CCCrypt(kCCDecrypt,
                                      kCCAlgorithmAES,
                                      kCCOptionPKCS7Padding,
                                      keyPtr,
                                      kKeySize,
                                      NULL,
                                      contentData.bytes,
                                      dataLength,
                                      decryptedBytes,
                                      decryptSize,
                                      &actualOutSize);

if (cryptStatus == kCCSuccess) {
    NSString *content = [[NSString alloc] initWithData:[NSData dataWithBytesNoCopy:decryptedBytes length:actualOutSize] encoding:NSUTF8StringEncoding];
    return [self dictionaryWithJsonString:content];
}
free(decryptedBytes);
return nil;
}

// NSDictionary 转换为 NSString
+ (NSString *)convertToJsonData:(NSDictionary *)dictionary {
NSError *error;
NSData *jsonData = [NSJSONSerialization dataWithJSONObject:dictionary options:NSJSONWritingPrettyPrinted error:&error];
NSString *jsonString;
if (!jsonData) {
    NSLog(@"%@",error);
}else{
    jsonString = [[NSString alloc]initWithData:jsonData encoding:NSUTF8StringEncoding];
}
NSMutableString *mutStr = [NSMutableString stringWithString:jsonString];
NSRange range = {0,jsonString.length};
//去掉字符串中的空格
[mutStr replaceOccurrencesOfString:@" " withString:@"" options:NSLiteralSearch range:range];
NSRange range2 = {0,mutStr.length};
//去掉字符串中的换行符
[mutStr replaceOccurrencesOfString:@"\n" withString:@"" options:NSLiteralSearch range:range2];
return mutStr;
}

// NSString 转换为 NSDictionary
+ (NSDictionary *)dictionaryWithJsonString:(NSString *)content {
if (content == nil) {
    return nil;
}

NSData *jsonData = [content dataUsingEncoding:NSUTF8StringEncoding];
NSError *err;
NSDictionary *dic = [NSJSONSerialization JSONObjectWithData:jsonData
                                                    options:NSJSONReadingMutableContainers
                                                      error:&err];
if(err)
{
    NSLog(@"json解析失败：%@",err);
    return nil;
}
return dic;
}

@end

关于AES有几个需要注意的点，首先你要搞清楚你们使用的是128、192、还是256位加密算法，其次跟服务端商量好是普通AES加密还是追加base64的加密方式.

4. 项目中实际使用

我们项目中的逻辑是随机生成一个16位字符串radomString，对这个radomString进行RSA加密生成参数encryptKey.
然后用这个radomString作为 AES加密的key（如果只是单纯的AES,此key要与服务端商量好，定义一个死值）对要传给服务端的参数(需将dic转json)进行AES加密生成字符串encryData.
最后将encryptKey和encryData传给服务端。
服务端先使用RSA对encryptKey解密得到radomString，再使用radomString作为key进行AES对encryData解密得到我们最终传的明文文件.

NSDictionary *dic = [NSDictionary dictionaryWithObjectsAndKeys:self.checkModel.name,@"applicantName",self.repayDetailModel.applyMoney,@"applyMoney",self.checkModel.bankNum,@"bankCardId",self.checkModel.originBank,@"bankName",self.unitModel.production,@"bizType",self.unitModel.uintName,@"bizWorkfor",self.checkModel.mobile,@"callNumber",self.checkModel.certNo,@"cardId",self.contactModel.phone,@"linkman1Cell",self.contactModel.name,@"linkman1Name",self.contactModel.useTo,@"loanReason",self.unitModel.email,@"mail",self.unitModel.detailAddress,@"bizAddr",self.repayDetailModel.refundPeriods,@"refundPeriods",userModel.token,@"token",userModel.mobile,@"mobile",@"00101",@"productionCode",self.caseNumModel.requestId,@"requestId",self.unitModel.unitAddress,@"addresCode",self.checkModel.originBank,@"depositBank", nil];
    
// 字典转json
NSString *jsonString = [self convertToJsonData:dic];
// 随机16位字符串
NSString *radomString = [self getRandomString];
// RSA加密
NSString *encryptKey = [SXRSAEncryptor encryptString:radomString publicKeyWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"shuixiangjinrong" ofType:@"cer"]];
// AES加密
NSString *encryData = [SXAESEncryptor encryptAES:jsonString key:radomString];

SXEncryptorParam *param = [SXEncryptorParam encryptorParamWithData:encryData encryptKey:encryptKey serviceId:@"JUNCAI0029"];

[SXComplentTool complentToolWithParam:param success:^(SXComplentResult *result) {
    if ([result.code isEqualToString:SXRequestSuccess]) {
       // 成功
} failure:^(NSError *error) {
       // 失败
}];


其中
// 返回16位大小写字母和数字
-(NSString *)getRandomString{
//定义一个包含数字，大小写字母的字符串
NSString * strAll = @"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
//定义一个结果
NSString * result = [[NSMutableString alloc]initWithCapacity:16];
for (int i = 0; i < 16; i++)
{
    //获取随机数
    NSInteger index = arc4random() % (strAll.length-1);
    char tempStr = [strAll characterAtIndex:index];
    result = (NSMutableString *)[result stringByAppendingString:[NSString stringWithFormat:@"%c",tempStr]];
}
return result;
}

#pragma mark - 字典转json
-(NSString *)convertToJsonData:(NSDictionary *)dict

{
    NSError *error;

    NSData *jsonData = [NSJSONSerialization dataWithJSONObject:dict options:NSJSONWritingPrettyPrinted error:&error];

    NSString *jsonString;

    if (!jsonData) {
        NSLog(@"%@",error);
    }else{
        jsonString = [[NSString alloc]initWithData:jsonData encoding:NSUTF8StringEncoding];
    }

    NSMutableString *mutStr = [NSMutableString stringWithString:jsonString];

    NSRange range = {0,jsonString.length};

    //去掉字符串中的空格

    [mutStr replaceOccurrencesOfString:@" " withString:@"" options:NSLiteralSearch range:range];

    NSRange range2 = {0,mutStr.length};

    //去掉字符串中的换行符
    [mutStr replaceOccurrencesOfString:@"\n" withString:@"" options:NSLiteralSearch range:range2];

    return mutStr;
}

iOS RSA+AES 加密、解密

1. 有关对称加密与非对称加密的区别：

参考之前写的文章（1.3-1.4-1.5）

2. RSA 加、解密

3. AES 加、解密

关于AES有几个需要注意的点，首先你要搞清楚你们使用的是128、192、还是256位加密算法，其次跟服务端商量好是普通AES加密还是追加base64的加密方式.

4. 项目中实际使用

相关文章

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读

iOS Development

iOS

程序员

aes rsa 加密和protobuf数据转换

iOS-网安学习

iOS开发

iOS RSA+AES 加密、解密

1. 有关对称加密与非对称加密的区别：

参考之前写的文章（1.3-1.4-1.5）

2. RSA 加、解密

3. AES 加、解密

关于AES有几个需要注意的点，首先你要搞清楚你们使用 的是128、192、还是256位加密算法，其次跟服务端商量好是普通AES加密还是追加base64的加密方式.

4. 项目中实际使用

相关文章

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读

iOS Development

iOS

程序员

aes rsa 加密和protobuf数据转换

iOS-网安学习

iOS开发

关于AES有几个需要注意的点，首先你要搞清楚你们使用的是128、192、还是256位加密算法，其次跟服务端商量好是普通AES加密还是追加base64的加密方式.