PHP中AES-128解密成功取决于加密字符串的长度？？ （从 iOS xcode 发送）

Question

1. 我跟着 https://tharindufit.wordpress.com/2011/12/15/aes128-encryption-in-ios-and-decryption-in-php/ 开发了 Xcode 中的客户端加密和 PHP 中的服务器解密。

2. 我使用了密钥：0123456789abcdef，这是 AES128 所需的 16 字节长。

3. 但是如果应用的用户输入的密码要么太长要么太短，

服务器无法解密。

为什么会这样？？是什么导致这种情况发生？？如果加密字符串太长或太短，则解密失败。

我的确切代码如下。您可以复制并粘贴代码，它会工作。

Xcode 中的客户端：

#import "ViewController.h"
#import "NSString+AESCrypt.h"

static NSString *const KEY = @"0123456789abcdef";

@interface ViewController (){
    NSString *rawPassword;
    NSMutableData *receivedData;
}

@end

@implementation ViewController

- (void)viewDidLoad {
    [super viewDidLoad];
} 
- (IBAction)send:(UIButton *)sender {
    rawPassword = @"passwordHere";
    [self sendRequest];
}

- (void) sendRequest {
    NSString *rawUserid = @"useridHere";

    // Encrypt with key
    NSString *encoded_usr = [rawUserid AES128EncryptWithKey: KEY];
    NSString *encoded_pwd = [rawPassword AES128EncryptWithKey: KEY];

    NSString *parameter = [NSString stringWithFormat:
              @"userid=%@&password=%@",encoded_usr, encoded_pwd];

    NSLog(@"sending:%@", parameter);
    NSData *parameterData = [parameter dataUsingEncoding:NSUTF8StringEncoding];

    NSURL *url = [NSURL URLWithString: @"http://mywebsite.com/server.php"];
    NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:url];
    [request setHTTPBody:parameterData];

    [request setHTTPMethod:@"POST"];
    [request addValue: @"application/x-www-form-urlencoded; charset=utf-8"  forHTTPHeaderField:@"Content-Type"];
    NSURLConnection *connection = [[NSURLConnection alloc]initWithRequest:request delegate:self];


    if(connection){
        receivedData = [[NSMutableData alloc]init];
        NSLog(@"CONNECTING");
    } else {
        NSLog(@"NO CONNECTING");
    }
}

#pragma mark NSURLConnection delegates
-(void) connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)response
{
    [receivedData setLength:0];
}
-(void) connection:(NSURLConnection *)connection didReceiveData:(NSData *)data
{
    [receivedData appendData:data];
}
-(void) connection:(NSURLConnection *)connection didFailWithError:(NSError *)error
{
    NSLog(@"CONNECTION FAILED");
    return;
 }
-(void) connectionDidFinishLoading:(NSURLConnection *)connection
 {
    NSString* newStr = [[NSString alloc] initWithData:receivedData encoding:NSUTF8StringEncoding];
    NSLog(@"connectionDidFinishLoading:%@", newStr);
 }
 @end

服务器端 PHP：

<?php

$encoded_pwd = $_POST['password'];
$encoded_usr = $_POST['userid'];
$device      = $_POST['device'];

$decoded_pwd = decrypt_password( $encoded_pwd , "0123456789abcdef");
$decoded_usr = decrypt_password( $encoded_usr , "0123456789abcdef");

echo "decoded userid:".$decoded_usr."  decoded password:".$decoded_pwd;

function decrypt_password($pass,$key)
{
 $base64encoded_ciphertext = $pass;

 $res_non = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, base64_decode($base64encoded_ciphertext), MCRYPT_MODE_ECB);

 $decrypted = $res_non;
 $dec_s2 = strlen($decrypted);

 $padding = ord($decrypted[$dec_s2-1]);
 $decrypted = substr($decrypted, 0, -$padding);

 return  $decrypted;
}
?>

Answer 1

问题嵌入在您的问题中。密码不是密钥。 AES 的密钥需要是 16、24 或 32 字节（分别用于 AES-128、AES-192 和 AES-256）。此外，这些字节应该与随机字节没有区别。密码不是这种情况，因为密码由特定字符组成。

要将密码用作密钥，您需要运行基于密码的密钥派生函数或 PBKDF。众所周知的是 bcrypt 和 PBKDF2。

或者，您可以让用户输入 32 个十六进制字符并将其解码为 16 字节密钥。请注意，尽管大多数人无法记住 32 个十六进制数字。