C++ OpenSSL AES CBC解密乱码问题解析与EVP API最佳实践

// C++ 加密代码片段
unsigned char iv[AES_BLOCK_SIZE];
if (RAND_bytes(iv, AES_BLOCK_SIZE) != 1) { /* error handling */ }

// ... 填充数据 ...

unsigned char ciphertext[paddedLen];
AES_cbc_encrypt(paddedData, ciphertext, paddedLen, &aesKey, iv, AES_ENCRYPT); // 问题所在：iv在此处被修改

std::string output(reinterpret_cast<char *>(iv), AES_BLOCK_SIZE); // 此时的iv已非原始IV
output.append(reinterpret_cast<char *>(ciphertext), paddedLen);

#include <openssl/evp.h>
#include <openssl/rand.h>
#include <openssl/err.h>
#include <string>
#include <vector>
#include <iostream>
#include <iomanip> // For std::hex, std::setw

// 辅助函数：将二进制数据转换为十六进制字符串
std::string binToHex(const std::vector<unsigned char>& input) {
    std::ostringstream hexStream;
    hexStream << std::hex << std::setfill('0');
    for (unsigned char c : input) {
        hexStream << std::setw(2) << static_cast<int>(c);
    }
    return hexStream.str();
}

std::string encrypt_with_evp(const std::string& plaintext, const std::string& key_str) {
    EVP_CIPHER_CTX* ctx = NULL;
    int len;
    int ciphertext_len;

    // 密钥和IV
    const unsigned char* key = reinterpret_cast<const unsigned char*>(key_str.c_str());
    unsigned char iv[EVP_MAX_IV_LENGTH]; // EVP_MAX_IV_LENGTH 足够大，通常为16字节

    // 生成随机IV
    if (RAND_bytes(iv, AES_BLOCK_SIZE) != 1) {
        std::cerr << "Error generating IV" << std::endl;
        return "";
    }

    // 创建和初始化上下文
    if (!(ctx = EVP_CIPHER_CTX_new())) {
        ERR_print_errors_fp(stderr);
        return "";
    }

    // 初始化加密操作，使用AES-128-CBC
    // EVP_EncryptInit_ex会自动处理IV，不会原地修改传入的iv参数
    if (1 != EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv)) {
        ERR_print_errors_fp(stderr);
        EVP_CIPHER_CTX_free(ctx);
        return "";
    }

    // 设置填充模式 (EVP默认使用PKCS#7，这里显式设置以防万一)
    // if (1 != EVP_CIPHER_CTX_set_padding(ctx, EVP_PADDING_PKCS7)) {
    //     ERR_print_errors_fp(stderr);
    //     EVP_CIPHER_CTX_free(ctx);
    //     return "";
    // }

    // 预估密文大小，并分配内存
    // 明文长度 + 块大小 - 1 (最多一个块的填充)
    std::vector<unsigned char> ciphertext_buffer(plaintext.length() + AES_BLOCK_SIZE);

    // 加密明文
    if (1 != EVP_EncryptUpdate(ctx, ciphertext_buffer.data(), &len,
                               reinterpret_cast<const unsigned char*>(plaintext.c_str()), plaintext.length())) {
        ERR_print_errors_fp(stderr);
        EVP_CIPHER_CTX_free(ctx);
        return "";
    }
    ciphertext_len = len;

    // 完成加密，处理最后一个块和填充
    if (1 != EVP_EncryptFinal_ex(ctx, ciphertext_buffer.data() + ciphertext_len, &len)) {
        ERR_print_errors_fp(stderr);
        EVP_CIPHER_CTX_free(ctx);
        return "";
    }
    ciphertext_len += len;

    // 释放上下文
    EVP_CIPHER_CTX_free(ctx);

    // 将原始IV和密文拼接，并转换为十六进制字符串
    std::vector<unsigned char> result_bytes;
    result_bytes.insert(result_bytes.end(), iv, iv + AES_BLOCK_SIZE); // 拼接原始IV
    result_bytes.insert(result_bytes.end(), ciphertext_buffer.begin(), ciphertext_buffer.begin() + ciphertext_len);

    return binToHex(result_bytes);
}

// 示例用法
int main() {
    std::string key = "t*H3_B3$t/k$%evr"; // 16字节密钥
    std::string data = "{\"pass\":\"azertyu\",\"opt\":\"test\"}";

    std::string encrypted_hex = encrypt_with_evp(data, key);
    if (!encrypted_hex.empty()) {
        std::cout << "Encrypted (Hex): " << encrypted_hex << std::endl;
    }
    return 0;
}

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import binascii

def decrypt(ciphertext_hex):
    key = b"t*H3_B3$t/k$%evr"
    data = binascii.unhexlify(ciphertext_hex)
    iv = data[:AES.block_size] # 提取IV
    data = data[AES.block_size:] # 剩余为密文
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypted = unpad(cipher.decrypt(data), AES.block_size)
    print(decrypted)
    return decrypted.decode("utf-8")