如何从 AES 加密字符串中添加/删除 PKCS7 填充?

str_repeat produces a string consisting of a repetition of the same string, here a repetition of the character given by $pad, $pad times, i.e. a string of length $pad, filled with $pad. $str .= ... appends this padding string to the original data.

     return mcrypt_encrypt(MCRYPT_DES, $key, $str, MCRYPT_MODE_ECB);

这是加密本身.使用 MCRYPT_RIJNDAEL_128 而不是 MCRYPT_DES.

Here is the encryption itself. Use MCRYPT_RIJNDAEL_128 instead of MCRYPT_DES.

 }

现在另一个方向:

 function decrypt($str, $key)
 {   
     $str = mcrypt_decrypt(MCRYPT_DES, $key, $str, MCRYPT_MODE_ECB);

解密.(你当然会改变算法，如上所述).$str 现在是解密后的字符串，包括填充.

The decryption. (You would of course change the algorithm, as above). $str is now the decrypted string, including the padding.

     $block = mcrypt_get_block_size('des', 'ecb');

这又是块大小.(见上文.)

This is again the block size. (See above.)

     $pad = ord($str[($len = strlen($str)) - 1]);

这看起来有点奇怪.最好分多个步骤编写:

This looks a bit strange. Better write it in multiple steps:

    $len = strlen($str);
    $pad = ord($str[$len-1]);

$len 现在是填充字符串的长度，$str[$len - 1] 是这个字符串的最后一个字符.ord 将其转换为数字.因此，$pad 是我们之前用作填充填充值的数字，这就是填充长度.

$len is now the length of the padded string, and $str[$len - 1] is the last character of this string. ord converts this to a number. Thus $pad is the number which we previously used as the fill value for the padding, and this is the padding length.

     return substr($str, 0, strlen($str) - $pad);

所以现在我们从字符串中截取最后一个 $pad 字节.(代替 strlen($str) 我们也可以在这里写 $len: substr($str, 0, $len - $pad).).

So now we cut off the last $pad bytes from the string. (Instead of strlen($str) we could also write $len here: substr($str, 0, $len - $pad).).

 }

?>

注意，除了使用 substr($str, $len - $pad)，还可以写成 substr($str, -$pad)，作为PHP 中的 substr 函数对负操作数/参数进行了特殊处理，从字符串的末尾开始计数.(我不知道这比先获取长度然后手动计算索引效率更高还是更低.)

Note that instead of using substr($str, $len - $pad), one can also write substr($str, -$pad), as the substr function in PHP has a special-handling for negative operands/arguments, to count from the end of the string. (I don't know if this is more or less efficient than getting the length first and and calculating the index manually.)

如前所述并在 rossum 的评论中指出，而不是像这里所做的那样简单地去除填充，您应该检查它是否正确 - 即查看 substr($str, $len - $pad)，并检查其所有字节是否都是 chr($pad).这是对损坏的轻微检查(尽管如果您使用链接模式而不是 ECB，这种检查会更有效，并且不能替代真正的 MAC).

As said before and noted in the comment by rossum, instead of simply stripping off the padding like done here, you should check that it is correct - i.e. look at substr($str, $len - $pad), and check that all its bytes are chr($pad). This serves as a slight check against corruption (although this check is more effective if you use a chaining mode instead of ECB, and is not a replacement for a real MAC).

(而且，告诉您的客户他们应该考虑更改为比 ECB 更安全的模式.)

(And still, tell your client they should think about changing to a more secure mode than ECB.)

这篇关于如何从 AES 加密字符串中添加/删除 PKCS7 填充?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持跟版网！