1
# 对比 RSA 和 AES 的加密速度
2
# AES-256-GCM 加密 1MB 数据
3
openssl speed -evp aes-256-gcm -bytes 1048576
4
# → ~3.5 GB/s
5

6
# RSA-2048 签名速度
7
openssl speed rsa2048
8
# → ~1000 signs/s (每秒约 1000 次签名)
9

10
# 性能差距：AES 比 RSA 快约 3500 倍
11
# 这就是为什么 TLS 用 RSA/ECDH 交换密钥，用 AES 加密数据

1
第一步：选择两个大素数 p, q
2
  p = 61, q = 53（教学用小素数，实际使用 1024 位素数）
3

4
第二步：计算模数 n
5
  n = p × q = 61 × 53 = 3233
6

7
第三步：计算欧拉函数 φ(n)
8
  φ(n) = (p-1)(q-1) = 60 × 52 = 3120
9

10
第四步：选择公钥指数 e
11
  e = 17，满足 gcd(e, φ(n)) = 1
12
  通常选择 65537（0x10001）
13

14
第五步：计算私钥指数 d
15
  d = e⁻¹ mod φ(n) = 17⁻¹ mod 3120 = 2753
16
  验证：e × d mod φ(n) = 17 × 2753 mod 3120 = 1
17

18
公钥 = (n=3233, e=17)
19
私钥 = (n=3233, d=2753)

1
加密：c = m^e mod n = 65^17 mod 3233 = 2790
2
解密：m = c^d mod n = 2790^2753 mod 3233 = 65
3

4
签名：s = m^d mod n
5
验证：m' = s^e mod n → m' == m

1
# Python: RSA 完整操作——密钥生成、加密、签名
2
from cryptography.hazmat.primitives.asymmetric import rsa, padding
3
from cryptography.hazmat.primitives import hashes, serialization
4

5
# 1. 生成 RSA 密钥对（推荐 3072 位）
6
private_key = rsa.generate_private_key(public_exponent=65537, key_size=3072)
7
public_key = private_key.public_key()
8

9
# 2. 加密（OAEP 填充）
10
message = b"Hello, RSA!"
11
ciphertext = public_key.encrypt(
12
    message,
13
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
14
                 algorithm=hashes.SHA256(), label=None)
15
)
16

17
# 3. 解密
18
plaintext = private_key.decrypt(
19
    ciphertext,
20
    padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA256()),
21
                 algorithm=hashes.SHA256(), label=None)
22
)
23
assert plaintext == message
24

25
# 4. 签名（PSS 填充）
26
signature = private_key.sign(
27
    message,
28
    padding.PSS(mgf=padding.MGF1(hashes.SHA256()),
29
                salt_length=padding.PSS.MAX_LENGTH),
30
    hashes.SHA256()
31
)
32

33
# 5. 验证签名
34
public_key.verify(
35
    signature, message,
36
    padding.PSS(mgf=padding.MGF1(hashes.SHA256()),
37
                salt_length=padding.PSS.MAX_LENGTH),
38
    hashes.SHA256()
39
)

1
达到 128 位安全：RSA 需要 3072 位，ECC 只需 256 位（12:1）
2
达到 256 位安全：RSA 需要 15360 位，ECC 只需 521 位（29:1）

1
标量乘法示例（倍加法）：
2
计算 13 × P：13 = 1101（二进制）
3
  P → 2P → 4P → 8P（逐次倍加）
4
  13P = 8P + 4P + P（按二进制位累加）
5
  只需 log₂(13) ≈ 4 次运算，而非 13 次

1
# Python: ECDH 密钥交换（Curve25519）
2
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
3
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
4
from cryptography.hazmat.primitives import hashes
5

6
alice_private = X25519PrivateKey.generate()
7
bob_private = X25519PrivateKey.generate()
8

9
# 交换公钥，计算共享密钥
10
alice_shared = alice_private.exchange(bob_private.public_key())
11
bob_shared = bob_private.exchange(alice_private.public_key())
12
assert alice_shared == bob_shared
13

14
# 从共享密钥派生对称密钥（不要直接使用原始共享密钥！）
15
derived_key = HKDF(
16
    algorithm=hashes.SHA256(), length=32,
17
    salt=None, info=b"handshake data",
18
).derive(alice_shared)

1
1. h = Hash(message)
2
2. 生成随机数 k（关键！k 泄露 = 私钥泄露）
3
3. (x₁, y₁) = k × G
4
4. r = x₁ mod n
5
5. s = k⁻¹ × (h + r × d) mod n（d 为私钥）
6
6. 签名 = (r, s)

1
1. h = Hash(message)
2
2. w = s⁻¹ mod n
3
3. (x₁, y₁) = (h × w) × G + (r × w) × Q（Q 为公钥）
4
4. r ≡ x₁ mod n → 签名有效

1
# Python: ECDSA 签名与验证
2
from cryptography.hazmat.primitives.asymmetric import ec
3
from cryptography.hazmat.primitives import hashes
4

5
message = b"Important document"
6
private_key = ec.generate_private_key(ec.SECP256R1())
7
signature = private_key.sign(message, ec.ECDSA(hashes.SHA256()))
8

9
public_key = private_key.public_key()
10
public_key.verify(signature, message, ec.ECDSA(hashes.SHA256()))

1
# Python: Ed25519 签名（推荐用于新系统）
2
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
3

4
private_key = Ed25519PrivateKey.generate()
5
signature = private_key.sign(b"Important document")
6
private_key.public_key().verify(signature, b"Important document")

1
# 生成 Ed25519 SSH 密钥（推荐）
2
ssh-keygen -t ed25519 -C "your@email.com"
3
# 生成 RSA SSH 密钥（兼容旧系统）
4
ssh-keygen -t rsa -b 4096 -C "your@email.com"

1
# 配置 Git 使用 SSH 签名
2
git config --global gpg.format ssh
3
git config --global user.signingkey ~/.ssh/id_ed25519.pub
4
git config --global commit.gpgsign true
5

6
# 签名提交与标签
7
git commit -S -m "Signed commit"
8
git tag -s v1.0.0 -m "Signed release"
9

10
# 验证签名
11
git verify-commit HEAD
12
git verify-tag v1.0.0

1
# Python: 使用 Ed25519 对软件包签名
2
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
3

4
signing_key = Ed25519PrivateKey.generate()
5
verify_key = signing_key.public_key()
6

7
with open("release-v1.0.tar.gz", "rb") as f:
8
    package_data = f.read()
9
signature = signing_key.sign(package_data)
10

11
# 用户验证
12
try:
13
    verify_key.verify(signature, package_data)
14
    print("签名验证通过，未被篡改")
15
except Exception:
16
    print("签名验证失败，文件可能被篡改！")

1
# 生成 ECC 密钥（P-256 曲线，即 prime256v1）
2
openssl ecparam -name prime256v1 -genkey -noout -out ecc_private.pem

1
# 从私钥导出公钥
2
openssl ec -in ecc_private.pem -pubout -out ecc_public.pem

1
read EC key
2
writing EC key

1
# 查看 ECC 私钥详情
2
openssl ec -in ecc_private.pem -text -noout

1
Private-Key: (256 bit)
2
priv:
3
    b5:2a:6f:b0:ce:7d:67:a9:16:85:20:00:c8:6f:8a:
4
    44:c6:0c:74:4c:06:e9:c4:a3:94:28:b4:6e:c7:ec:
5
    4d:54
6
pub:
7
    04:ec:2f:8b:ff:66:2c:c6:9c:a6:b2:f0:f8:79:2d:
8
    5a:51:7a:13:d1:70:3d:4d:f4:b8:49:41:4a:a3:78:
9
    c3:2b:98:7a:80:3d:dd:a2:49:37:d1:49:c6:03:ad:
10
    66:d5:f3:45:ee:4f:fe:d8:f9:de:49:31:92:31:55:
11
    c5:5c:9c:34:57
12
ASN1 OID: prime256v1
13
NIST CURVE: P-256

1
# 查看 ECC 公钥
2
cat ecc_public.pem

1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7C+L/2YsxpymsvD4eS1aUXoT0XA9
3
TfS4SUFKo3jDK5h6gD3dokk30UnGA61m1fNF7k/+2PneSTGSMVXFXJw0Vw==
4
-----END PUBLIC KEY-----

1
echo "RSA 私钥: $(wc -c < rsa_private.pem) bytes"
2
echo "RSA 公钥: $(wc -c < rsa_public.pem) bytes"
3
echo "ECC 私钥: $(wc -c < ecc_private.pem) bytes"
4
echo "ECC 公钥: $(wc -c < ecc_public.pem) bytes"

1
RSA 私钥: 1704 bytes
2
RSA 公钥: 451 bytes
3
ECC 私钥: 227 bytes
4
ECC 公钥: 178 bytes

1
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
2
from cryptography.hazmat.primitives import serialization
3

4
# Alice 生成密钥对
5
alice_private = X25519PrivateKey.generate()
6
alice_public = alice_private.public_key()
7

8
# Bob 生成密钥对
9
bob_private = X25519PrivateKey.generate()
10
bob_public = bob_private.public_key()
11

12
# 序列化公钥用于传输
13
alice_pub_bytes = alice_public.public_bytes(
14
    encoding=serialization.Encoding.Raw,
15
    format=serialization.PublicFormat.Raw
16
)
17
bob_pub_bytes = bob_public.public_bytes(
18
    encoding=serialization.Encoding.Raw,
19
    format=serialization.PublicFormat.Raw
20
)
21

22
print(f"Alice 公钥 (hex): {alice_pub_bytes.hex()}")
23
print(f"Bob   公钥 (hex): {bob_pub_bytes.hex()}")
24
print(f"公钥长度: {len(alice_pub_bytes)} bytes")
25
print()
26

27
# ECDH 密钥交换
28
alice_shared = alice_private.exchange(bob_public)
29
bob_shared = bob_private.exchange(alice_public)
30

31
print(f"Alice 计算的共享密钥 (hex): {alice_shared.hex()}")
32
print(f"Bob   计算的共享密钥 (hex): {bob_shared.hex()}")
33
print(f"共享密钥长度: {len(alice_shared)} bytes")
34
print(f"双方共享密钥一致: {alice_shared == bob_shared}")

1
Alice 公钥 (hex): b6f855339e6ecd37f1d5d1062610e98c35ce49054fa97a9f7a31c543453d6417
2
Bob   公钥 (hex): dbc96c20304a67eab400103fe2a282ef7b428f79f61bfaf40750684a60ab192b
3
公钥长度: 32 bytes
4

5
Alice 计算的共享密钥 (hex): f097fc615fb6d46459fe9d670e9187cf24f345e2418a7c0e15c4286f67ff6525
6
Bob   计算的共享密钥 (hex): f097fc615fb6d46459fe9d670e9187cf24f345e2418a7c0e15c4286f67ff6525
7
共享密钥长度: 32 bytes
8
双方共享密钥一致: True

1
import os
2
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
3
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
4
from cryptography.hazmat.primitives import hashes, serialization
5
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
6

7
# ============================================================
8
# 第一阶段：ECDH 密钥交换（协商对称密钥）
9
# ============================================================
10
print("=" * 60)
11
print("第一阶段：ECDH 密钥交换")
12
print("=" * 60)
13

14
# Alice 生成临时密钥对
15
alice_private = X25519PrivateKey.generate()
16
alice_public = alice_private.public_key()
17

18
# Bob 生成临时密钥对
19
bob_private = X25519PrivateKey.generate()
20
bob_public = bob_private.public_key()
21

22
alice_pub_bytes = alice_public.public_bytes(
23
    encoding=serialization.Encoding.Raw,
24
    format=serialization.PublicFormat.Raw
25
)
26
bob_pub_bytes = bob_public.public_bytes(
27
    encoding=serialization.Encoding.Raw,
28
    format=serialization.PublicFormat.Raw
29
)
30

31
print(f"Alice 公钥: {alice_pub_bytes.hex()}")
32
print(f"Bob   公钥: {bob_pub_bytes.hex()}")
33
print()
34

35
# 双方交换公钥，计算共享密钥
36
alice_raw_shared = alice_private.exchange(bob_public)
37
bob_raw_shared = bob_private.exchange(alice_public)
38
assert alice_raw_shared == bob_raw_shared
39
print(f"原始共享密钥: {alice_raw_shared.hex()}")
40
print()
41

42
# 使用 HKDF 从共享密钥派生 AES-256 密钥
43
# 注意：永远不要直接使用原始共享密钥！
44
hkdf = HKDF(
45
    algorithm=hashes.SHA256(),
46
    length=32,  # AES-256 需要 32 字节密钥
47
    salt=None,
48
    info=b"hybrid-encryption-demo",
49
)
50
aes_key = hkdf.derive(alice_raw_shared)
51
print(f"HKDF 派生的 AES-256 密钥: {aes_key.hex()}")
52
print()
53

54
# ============================================================
55
# 第二阶段：AES-GCM 加密数据
56
# ============================================================
57
print("=" * 60)
58
print("第二阶段：AES-GCM 对称加密")
59
print("=" * 60)
60

61
plaintext = b"Hello, hybrid encryption! This message is protected by ECDH + AES-256-GCM."
62
print(f"明文: {plaintext.decode()}")
63
print(f"明文长度: {len(plaintext)} bytes")
64
print()
65

66
# Alice 使用派生密钥加密
67
aesgcm = AESGCM(aes_key)
68
nonce = os.urandom(12)  # AES-GCM 推荐 12 字节 nonce
69
ciphertext = aesgcm.encrypt(nonce, plaintext, None)
70

71
print(f"Nonce (hex):       {nonce.hex()}")
72
print(f"密文+Tag (hex):    {ciphertext.hex()}")
73
print(f"密文+Tag 长度:     {len(ciphertext)} bytes")
74
print(f"  其中密文:        {len(plaintext)} bytes")
75
print(f"  其中认证标签:    16 bytes (AES-GCM 固定)")
76
print()
77

78
# Bob 使用相同的派生密钥解密
79
aesgcm_bob = AESGCM(aes_key)
80
decrypted = aesgcm_bob.decrypt(nonce, ciphertext, None)
81

82
print(f"Bob 解密结果: {decrypted.decode()}")
83
print(f"解密成功: {decrypted == plaintext}")
84
print()
85

86
# ============================================================
87
# 篡改检测演示
88
# ============================================================
89
print("=" * 60)
90
print("篡改检测：AES-GCM 认证标签验证")
91
print("=" * 60)
92

93
# 模拟密文被篡改
94
tampered = bytearray(ciphertext)
95
tampered[0] ^= 0xFF  # 翻转第一个字节
96
try:
97
    aesgcm_bob.decrypt(nonce, bytes(tampered), None)
98
    print("错误：篡改密文未被检测到！")
99
except Exception as e:
100
    print(f"检测到篡改！解密失败: {type(e).__name__}")
101
    print("AES-GCM 的认证标签成功阻止了篡改攻击。")

1
============================================================
2
第一阶段：ECDH 密钥交换
3
============================================================
4
Alice 公钥: 18709306e16fb52c2656efa7d929d41163127ace3ddcf7a1dda5f2d1d9a68377
5
Bob   公钥: a723dd1fb47cf2a0e78718dbbd88142d5d6d1d6684f3508f02cf599f47faa303
6

7
原始共享密钥: 605b03e077ae960c3dbf2f52088fe1b49ac73788f1b9828ccb1dfdc5b5b65c25
8

9
HKDF 派生的 AES-256 密钥: e5cf9be844f2ff60984982a23ba813e36ae8b3666282fb693890d1523c48df3f
10

11
============================================================
12
第二阶段：AES-GCM 对称加密
13
============================================================
14
明文: Hello, hybrid encryption! This message is protected by ECDH + AES-256-GCM.
15
明文长度: 74 bytes
16

17
Nonce (hex):       8b2b4f2b99fa528a93391090
18
密文+Tag (hex):    04928f5a9a432585063cacab6034b8712ed231c04a734026102d1630290094c150bddba7eaa879c4d9c3ff1d9e465c481b563328c9b398f319a3bd0bbe13758cc33046879eecabfffa0a2fae41f9e612a3d76fec856d8c6ecd36
19
密文+Tag 长度:     90 bytes
20
  其中密文:        74 bytes
21
  其中认证标签:    16 bytes (AES-GCM 固定)
22

23
Bob 解密结果: Hello, hybrid encryption! This message is protected by ECDH + AES-256-GCM.
24
解密成功: True
25

26
============================================================
27
篡改检测：AES-GCM 认证标签验证
28
============================================================
29
检测到篡改！解密失败: InvalidTag
30
AES-GCM 的认证标签成功阻止了篡改攻击。