1
SBOX = [...]  # AES S-Box 查找表
2
RCON = [0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36]
3
def key_expansion(key_words):
4
    W = list(key_words)  # W[0..3] = 原始密钥
5
    for i in range(4, 44):
6
        temp = W[i - 1]
7
        if i % 4 == 0:
8
            temp = sub_word(rot_word(temp)) ^ (RCON[i // 4 - 1] << 24)
9
        W.append(W[i - 4] ^ temp)
10
    return W  # 每 4 个字组成一个轮密钥
11
def rot_word(word):
12
    """循环左移一字节：[a,b,c,d] → [b,c,d,a]"""
13
    return ((word << 8) | (word >> 24)) & 0xFFFFFFFF

1
// AES-NI 加密一轮的伪代码（实际是单条指令）
2
// 一条 aesenc 指令完成 4 个操作的组合
3
__m128i aesenc(__m128i state, __m128i round_key) {
4
    // 硬件内部完成：
5
    // 1. SubBytes（S-Box 查表，硬件实现）
6
    // 2. ShiftRows（字节重排，硬件连线）
7
    // 3. MixColumns（GF(2^8) 矩阵乘，硬件实现）
8
    // 4. AddRoundKey（XOR，一条指令）
9
    return result;
10
}

1
// AES-GCM 加密（推荐）
2
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
3
keyGen.init(256);
4
SecretKey key = keyGen.generateKey();
5
// 加密
6
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
7
GCMParameterSpec spec = new GCMParameterSpec(128, iv);  // 128-bit tag
8
cipher.init(Cipher.ENCRYPT_MODE, key, spec);
9
byte[] ciphertext = cipher.doFinal(plaintext);
10
// 解密
11
cipher.init(Cipher.DECRYPT_MODE, key, spec);
12
byte[] decrypted = cipher.doFinal(ciphertext);

1
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
2
def ecb_encrypt_image(key, image_data):
3
description: "    """ECB 模式加密图像——轮廓仍然可见！"""
4
    cipher = Cipher(algorithms.AES(key), modes.ECB())
5
    encryptor = cipher.encryptor()
6
    return encryptor.update(image_data) + encryptor.finalize()
7
def cbc_encrypt_image(key, iv, image_data):
8
description: "    """CBC 模式加密图像——轮廓完全消失"""
9
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
10
    encryptor = cipher.encryptor()
11
    return encryptor.update(image_data) + encryptor.finalize()

1
def quarter_round(a, b, c, d):
2
    """ChaCha20 四分之一轮操作"""
3
    a = (a + b) & 0xFFFFFFFF; d ^= a; d = rotl32(d, 16)
4
    c = (c + d) & 0xFFFFFFFF; b ^= c; b = rotl32(b, 12)
5
    a = (a + b) & 0xFFFFFFFF; d ^= a; d = rotl32(d, 8)
6
    c = (c + d) & 0xFFFFFFFF; b ^= c; b = rotl32(b, 7)
7
    return a, b, c, d
8
def rotl32(v, n):
9
    """32 位循环左移"""
10
    return ((v << n) | (v >> (32 - n))) & 0xFFFFFFFF

1
┌──────────┬──────────┬──────────┬──────────┐
2
│ constant │ constant │ constant │ constant │
3
│ constant │ constant │ constant │ constant │
4
│   key    │   key    │   key    │   key    │
5
│   key    │   key    │   key    │   key    │
6
│ counter  │  nonce   │  nonce   │  nonce   │
7
└──────────┴──────────┴──────────┴──────────┘

1
// Java: ChaCha20-Poly1305 (JDK 11+)
2
KeyGenerator keyGen = KeyGenerator.getInstance("ChaCha20-Poly1305");
3
keyGen.init(256);
4
SecretKey key = keyGen.generateKey();
5
// 加密
6
Cipher cipher = Cipher.getInstance("ChaCha20-Poly1305/None/NoPadding");
7
cipher.init(Cipher.ENCRYPT_MODE, key);
8
byte[] ciphertext = cipher.doFinal(plaintext);
9
// 解密
10
cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(cipher.getIV()));
11
byte[] decrypted = cipher.doFinal(ciphertext);

1
from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305
2
import os
3
key = ChaCha20Poly1305.generate_key()
4
chacha = ChaCha20Poly1305(key)
5
nonce = os.urandom(12)
6
ciphertext = chacha.encrypt(nonce, b"Hello, World!", None)
7
plaintext = chacha.decrypt(nonce, ciphertext, None)

1
// Go: ChaCha20-Poly1305
2
package main
3
import (
4
    "crypto/cipher"
5
    "golang.org/x/crypto/chacha20poly1305"
6
)
7
func encrypt(key, nonce, plaintext, aad []byte) []byte {
8
    aead, _ := chacha20poly1305.New(key)
9
    return aead.Seal(nil, nonce, plaintext, aad)
10
}
11
func decrypt(key, nonce, ciphertext, aad []byte) ([]byte, error) {
12
    aead, _ := chacha20poly1305.New(key)
13
    return aead.Open(nil, nonce, ciphertext, aad)
14
}

1
def padding_oracle_attack(ciphertext_block, prev_block, oracle):
2
    """
3
    利用 Padding Oracle 逐字节恢复明文
4
    oracle: 函数，返回 True 表示填充有效，False 表示填充无效
5
    """
6
    intermediate = bytearray(16)  # D(C[i]) 的值
7
    for byte_pos in range(15, -1, -1):  # 从最后一个字节开始
8
        padding_value = 16 - byte_pos  # 目标填充值
9
        crafted = bytearray(16)
10
        for k in range(byte_pos + 1, 16):
11
            crafted[k] = intermediate[k] ^ padding_value
12
        for guess in range(256):
13
            crafted[byte_pos] = guess
14
            if oracle(bytes(crafted), ciphertext_block):
15
                intermediate[byte_pos] = guess ^ padding_value
16
                break
17
    plaintext = bytes(a ^ b for a, b in zip(intermediate, prev_block))
18
    return plaintext

1
from flask import Flask, jsonify
2
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
3
app = Flask(__name__)
4
@app.route("/decrypt", methods=["POST"])
5
def decrypt_data():
6
    try:
7
        plaintext = aesgcm.decrypt(nonce, ciphertext, aad)
8
        return jsonify({"status": "ok", "data": plaintext.decode()})
9
    except Exception:
10
        return jsonify({"status": "error", "message": "Decryption failed"}), 400
11
import hmac
12
def constant_time_compare(a: bytes, b: bytes) -> bool:
13
    """常数时间比较，防止时序攻击"""
14
    return hmac.compare_digest(a, b)

1
// Go: 安全的密钥生成
2
package main
3
import (
4
    "crypto/aes"
5
    "crypto/rand"
6
    "io"
7
)
8
func generateKey() ([]byte, error) {
9
    key := make([]byte, aes.KeySize)  // 32 bytes for AES-256
10
    if _, err := io.ReadFull(rand.Reader, key); err != nil {
11
        return nil, err
12
    }
13
    return key, nil
14
}

1
class KeyManager:
2
    def __init__(self):
3
        self.keys = {}        # version -> key
4
        self.current_version = None
5
    def rotate_key(self, new_key: bytes):
6
        """轮换密钥：新密钥成为当前版本"""
7
        version = len(self.keys) + 1
8
        self.keys[version] = new_key
9
        self.current_version = version
10
        return version
11
    def encrypt(self, plaintext: bytes) -> tuple:
12
        """用当前密钥加密，密文包含版本号"""
13
        nonce = os.urandom(12)
14
        ciphertext = AESGCM(self.keys[self.current_version]).encrypt(
15
            nonce, plaintext, None
16
        )
17
        return (self.current_version, nonce, ciphertext)
18
    def decrypt(self, version: int, nonce: bytes, ciphertext: bytes) -> bytes:
19
        """用对应版本的密钥解密"""
20
        return AESGCM(self.keys[version]).decrypt(nonce, ciphertext, None)

1
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
2
from cryptography.hazmat.primitives.kms import KMSClient  # 伪代码
3
import os
4
def envelope_encrypt(plaintext: bytes, master_key_id: str) -> dict:
5
    """信封加密"""
6
    dek = AESGCM.generate_key(bit_length=256)
7
    nonce = os.urandom(12)
8
    aesgcm = AESGCM(dek)
9
    ciphertext = aesgcm.encrypt(nonce, plaintext, None)
10
    encrypted_dek = kms_encrypt(master_key_id, dek)
11
    return {
12
        "encrypted_dek": encrypted_dek,
13
        "nonce": nonce,
14
        "ciphertext": ciphertext
15
    }

1
// Go: 流式 AES-GCM 加密大文件
2
package main
3
import (
4
    "crypto/aes"
5
    "crypto/cipher"
6
    "crypto/rand"
7
    "io"
8
)
9
func encryptStream(key []byte, src io.Reader, dst io.Writer) error {
10
    block, _ := aes.NewCipher(key)
11
    nonce := make([]byte, 12)
12
    rand.Read(nonce)
13
    dst.Write(nonce)  // nonce 明文传输
14
    gcm, _ := cipher.NewGCM(block)
15
    // 注意：标准库的 GCM 不直接支持流式
16
    // 生产环境应使用 cipher.StreamWriter 或专用库
17
    // 这里展示分块读取的思路
18
    buf := make([]byte, 4096)
19
    for {
20
        n, err := src.Read(buf)
21
        if n > 0 {
22
            ciphertext := gcm.Seal(nil, nonce, buf[:n], nil)
23
            dst.Write(ciphertext)
24
        }
25
        if err == io.EOF {
26
            break
27
        }
28
        if err != nil {
29
            return err
30
        }
31
    }
32
    return nil
33
}

1
import os
2
import time
3
from cryptography.hazmat.primitives.ciphers.aead import AESGCM, ChaCha20Poly1305
4
def benchmark(aead_cls, key_size, data_size=10 * 1024 * 1024, iterations=10):
5
    """基准测试：加密 10MB 数据的吞吐量"""
6
    key = aead_cls.generate_key(bit_length=key_size) if key_size else aead_cls.generate_key()
7
    aead = aead_cls(key)
8
    data = os.urandom(data_size)
9
    nonce = os.urandom(12)
10
    start = time.perf_counter()
11
    for _ in range(iterations):
12
        ciphertext = aead.encrypt(nonce, data, None)
13
    elapsed = time.perf_counter() - start
14
    throughput = (data_size * iterations) / elapsed / 1e9  # GB/s
15
    return throughput
16
aes_throughput = benchmark(AESGCM, 256)
17
chacha_throughput = benchmark(ChaCha20Poly1305, None)
18
print(f"AES-256-GCM:          {aes_throughput:.2f} GB/s")
19
print(f"ChaCha20-Poly1305:    {chacha_throughput:.2f} GB/s")

1
def caesar_encrypt(text, shift):
2
    result = []
3
    for ch in text:
4
        if ch.isalpha():
5
            base = ord('A') if ch.isupper() else ord('a')
6
            result.append(chr((ord(ch) - base + shift) % 26 + base))
7
        else:
8
            result.append(ch)
9
    return ''.join(result)
10

11
def caesar_decrypt(text, shift):
12
    return caesar_encrypt(text, -shift)
13

14
plaintext = 'ATTACK AT DAWN'
15
shift = 3
16
ciphertext = caesar_encrypt(plaintext, shift)
17
decrypted = caesar_decrypt(ciphertext, shift)
18

19
print(f'明文:   {plaintext}')
20
print(f'密钥:   偏移 {shift}')
21
print(f'加密后: {ciphertext}')
22
print(f'解密后: {decrypted}')
23
print()
24

25
# 暴力破解
26
print('--- 暴力破解（尝试所有 26 种偏移）---')
27
for s in range(26):
28
    guess = caesar_encrypt(ciphertext, -s)
29
    marker = ' <-- 正确' if s == shift else ''
30
    print(f'  偏移 {s:2d}: {guess}{marker}')

1
$ python3 caesar.py
2
明文:   ATTACK AT DAWN
3
密钥:   偏移 3
4
加密后: DWWDFN DW GDZQ
5
解密后: ATTACK AT DAWN
6

7
--- 暴力破解（尝试所有 26 种偏移）---
8
  偏移  0: DWWDFN DW GDZQ
9
  偏移  1: CVVCEM CV FCYP
10
  偏移  2: BUUBDL BU EBXO
11
  偏移  3: ATTACK AT DAWN <-- 正确
12
  偏移  4: ZSSZBJ ZS CZVM
13
  偏移  5: YRRYAI YR BYUL
14
  偏移  6: XQQXZH XQ AXTK
15
  偏移  7: WPPWYG WP ZWSJ
16
  偏移  8: VOOVXF VO YVRI
17
  偏移  9: UNNUWE UN XUQH
18
  偏移 10: TMMTVD TM WTPG
19
  偏移 11: SLLSUC SL VSOF
20
  偏移 12: RKKRTB RK URNE
21
  偏移 13: QJJQSA QJ TQMD
22
  偏移 14: PIIPRZ PI SPLC
23
  偏移 15: OHHOQY OH ROKB
24
  偏移 16: NGGNPX NG QNJA
25
  偏移 17: MFFMOW MF PMIZ
26
  偏移 18: LEELNV LE OLHY
27
  偏移 19: KDDKMU KD NKGX
28
  偏移 20: JCCJLT JC MJFW
29
  偏移 21: IBBIKS IB LIEV
30
  偏移 22: HAAHJR HA KHDU
31
  偏移 23: GZZGIQ GZ JGCT
32
  偏移 24: FYYFHP FY IFBS
33
  偏移 25: EXXEGO EX HEAR

1
import os
2

3
def xor_stream_cipher(data, key):
4
    """XOR 流密码：将数据与密钥逐字节异或"""
5
    key_stream = (key * ((len(data) // len(key)) + 1))[:len(data)]
6
    return bytes(a ^ b for a, b in zip(data, key_stream))
7

8
plaintext = b'Hello, Symmetric Encryption!'
9
key = os.urandom(8)  # 8 字节随机密钥
10

11
ciphertext = xor_stream_cipher(plaintext, key)
12
decrypted = xor_stream_cipher(ciphertext, key)
13

14
print(f'明文:   {plaintext.decode()}')
15
print(f'密钥:   {key.hex()}')
16
print(f'加密后: {ciphertext.hex()}')
17
print(f'解密后: {decrypted.decode()}')
18
print()
19

20
# XOR 的数学本质
21
print('--- XOR 的数学本质 ---')
22
a = plaintext[0]
23
k = key[0]
24
enc = a ^ k
25
dec = enc ^ k
26
print(f'  明文字节 a = 0x{a:02x} ({chr(a)})')
27
print(f'  密钥字节 k = 0x{k:02x}')
28
print(f'  加密 a⊕k   = 0x{enc:02x}')
29
print(f'  解密 (a⊕k)⊕k = 0x{dec:02x} ({chr(dec)})')
30
print(f'  验证: a⊕k⊕k = a  ')
31
print()
32

33
# 密钥重用的灾难
34
print('--- 密钥重用：两段明文 XOR 可消除密钥 ---')
35
msg1 = b'Secret Attack Plan'
36
msg2 = b'Defend at Dawn!!'
37
key2 = os.urandom(18)
38
c1 = xor_stream_cipher(msg1, key2)
39
c2 = xor_stream_cipher(msg2, key2)
40
xor_of_ciphertexts = bytes(a ^ b for a, b in zip(c1, c2))
41
xor_of_plaintexts = bytes(a ^ b for a, b in zip(msg1, msg2))
42
print(f'  C1 ⊕ C2 = {xor_of_ciphertexts.hex()}')
43
print(f'  P1 ⊕ P2 = {xor_of_plaintexts.hex()}')
44
print(f'  两者相等: {xor_of_ciphertexts == xor_of_plaintexts}')
45
print(f'  攻击者只需知道 P1，即可恢复 P2！')

1
$ python3 xor_stream.py
2
明文:   Hello, Symmetric Encryption!
3
密钥:   43e3b4972b3ba29a
4
加密后: 0b86d8fb441782c93a8ed9f25f49cbf963a6daf45942d2ee2a8cdab6
5
解密后: Hello, Symmetric Encryption!
6

7
--- XOR 的数学本质 ---
8
  明文字节 a = 0x48 (H)
9
  密钥字节 k = 0x43
10
  加密 a⊕k   = 0x0b
11
  解密 (a⊕k)⊕k = 0x48 (H)
12
  验证: a⊕k⊕k = a
13

14
--- 密钥重用：两段明文 XOR 可消除密钥 ---
15
  C1 ⊕ C2 = 170005170b100020005425021c4e714d
16
  P1 ⊕ P2 = 170005170b100020005425021c4e714d
17
  两者相等: True
18
  攻击者只需知道 P1，即可恢复 P2！

1
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
2
from cryptography.hazmat.primitives import padding
3
from cryptography.hazmat.backends import default_backend
4
import os
5

6
def aes_cbc_encrypt(plaintext, key, iv):
7
    # PKCS7 填充
8
    padder = padding.PKCS7(128).padder()
9
    padded = padder.update(plaintext) + padder.finalize()
10
    # 加密
11
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
12
    encryptor = cipher.encryptor()
13
    ciphertext = encryptor.update(padded) + encryptor.finalize()
14
    return ciphertext
15

16
def aes_cbc_decrypt(ciphertext, key, iv):
17
    # 解密
18
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
19
    decryptor = cipher.decryptor()
20
    padded = decryptor.update(ciphertext) + decryptor.finalize()
21
    # 去除 PKCS7 填充
22
    unpadder = padding.PKCS7(128).unpadder()
23
    plaintext = unpadder.update(padded) + unpadder.finalize()
24
    return plaintext
25

26
key = os.urandom(32)  # AES-256
27
iv = os.urandom(16)   # 128-bit IV
28
plaintext = b'AES-CBC mode requires padding!'
29

30
ciphertext = aes_cbc_encrypt(plaintext, key, iv)
31
decrypted = aes_cbc_decrypt(ciphertext, key, iv)
32

33
print(f'明文:   {plaintext.decode()}')
34
print(f'密钥:   {key.hex()[:32]}... ({len(key)*8} bit)')
35
print(f'IV:     {iv.hex()}')
36
print(f'加密后: {ciphertext.hex()}')
37
print(f'解密后: {decrypted.decode()}')
38
print()
39

40
# 展示填充过程
41
print('--- PKCS7 填充过程 ---')
42
padder = padding.PKCS7(128).padder()
43
padded = padder.update(plaintext) + padder.finalize()
44
print(f'  原始长度: {len(plaintext)} 字节')
45
print(f'  填充后长度: {len(padded)} 字节')
46
print(f'  填充字节数: {len(padded) - len(plaintext)}')
47
print(f'  填充内容: {padded[len(plaintext):].hex()} (每字节值为 0x{padded[-1]:02x} = {padded[-1]})')
48
print()
49

50
# 填充不正确时解密失败
51
print('--- 填充被篡改时解密失败 ---')
52
tampered = bytearray(ciphertext)
53
tampered[-1] ^= 0x01  # 篡改最后一个字节
54
try:
55
    aes_cbc_decrypt(bytes(tampered), key, iv)
56
    print('  解密成功（不应该发生）')
57
except Exception as e:
58
    print(f'  解密失败: {type(e).__name__}: {e}')

1
$ python3 aes_cbc.py
2
明文:   AES-CBC mode requires padding!
3
密钥:   3187021b59be2bfe23bdcdfd6f6f200d... (256 bit)
4
IV:     a0247230e7dab7e13caf27a8485d2de0
5
加密后: 572c8eec0294f4a5a5470dbbaf129ebd6625e0a58624c8501e45abb985e7577d
6
解密后: AES-CBC mode requires padding!
7

8
--- PKCS7 填充过程 ---
9
  原始长度: 30 字节
10
  填充后长度: 32 字节
11
  填充字节数: 2
12
  填充内容: 0202 (每字节值为 0x02 = 2)
13

14
--- 填充被篡改时解密失败 ---
15
  解密失败: ValueError: Invalid padding bytes.

1
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
2
import os
3

4
key = AESGCM.generate_key(bit_length=256)
5
aesgcm = AESGCM(key)
6
nonce = os.urandom(12)  # 96-bit nonce
7
plaintext = b'AES-GCM: Authenticated Encryption with Associated Data'
8
aad = b'header: {"alg":"dir","enc":"A256GCM"}'
9

10
# 加密
11
ciphertext = aesgcm.encrypt(nonce, plaintext, aad)
12
# ciphertext 包含密文 + 16 字节认证标签
13

14
# 解密
15
decrypted = aesgcm.decrypt(nonce, ciphertext, aad)
16

17
print(f'明文:   {plaintext.decode()}')
18
print(f'密钥:   {key.hex()[:32]}... ({len(key)*8} bit)')
19
print(f'Nonce:  {nonce.hex()} ({len(nonce)*8} bit)')
20
print(f'AAD:    {aad.decode()}')
21
print(f'加密后: {ciphertext.hex()}')
22
print(f'密文长度: {len(ciphertext)} 字节 (明文 {len(plaintext)} + 16 字节 tag)')
23
print(f'解密后: {decrypted.decode()}')
24
print()
25

26
# 认证标签验证
27
print('--- 认证标签验证 ---')
28
print(f'  密文被篡改时解密会失败:')
29
tampered = bytearray(ciphertext)
30
tampered[0] ^= 0x01
31
try:
32
    aesgcm.decrypt(nonce, bytes(tampered), aad)
33
    print('  解密成功（不应该发生）')
34
except Exception as e:
35
    print(f'  解密失败: {type(e).__name__}')
36

37
print()
38
print(f'  AAD 被篡改时解密也会失败:')
39
tampered_aad = b'header: {"alg":"RSA","enc":"A256GCM"}'
40
try:
41
    aesgcm.decrypt(nonce, ciphertext, tampered_aad)
42
    print('  解密成功（不应该发生）')
43
except Exception as e:
44
    print(f'  解密失败: {type(e).__name__}')

1
$ python3 aes_gcm.py
2
明文:   AES-GCM: Authenticated Encryption with Associated Data
3
密钥:   d9622f288e156538ad6bcbfbcc3e29f4... (256 bit)
4
Nonce:  095d41c7debd2b0aa5df2e83 (96 bit)
5
AAD:    header: {"alg":"dir","enc":"A256GCM"}
6
加密后: a8cedd6df4a7368c1339948b945f5380938024f445b5fc41f47130a7b07d5ebce7610ce73d6fad452532813fe49333240eb1003e762a60606ef155a0a93504cd430e871b55d4
7
密文长度: 70 字节 (明文 54 + 16 字节 tag)
8
解密后: AES-GCM: Authenticated Encryption with Associated Data
9

10
--- 认证标签验证 ---
11
  密文被篡改时解密会失败:
12
  解密失败: InvalidTag
13

14
  AAD 被篡改时解密也会失败:
15
  解密失败: InvalidTag

1
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
2
import os
3

4
key = AESGCM.generate_key(bit_length=256)
5
aesgcm = AESGCM(key)
6
nonce = os.urandom(12)  # 同一个 nonce 被重用！
7

8
msg1 = b'The secret attack is at dawn'
9
msg2 = b'Defend the northern gate!'
10

11
c1 = aesgcm.encrypt(nonce, msg1, None)
12
c2 = aesgcm.encrypt(nonce, msg2, None)
13

14
# 提取密文部分（去掉最后 16 字节的 tag）
15
c1_ct = c1[:-16]
16
c2_ct = c2[:-16]
17

18
# XOR 两个密文
19
xor_ct = bytes(a ^ b for a, b in zip(c1_ct, c2_ct))
20
# XOR 两个明文
21
xor_pt = bytes(a ^ b for a, b in zip(msg1, msg2))
22

23
print(f'消息 1: {msg1.decode()}')
24
print(f'消息 2: {msg2.decode()}')
25
print(f'Nonce:  {nonce.hex()} (同一个 nonce！)')
26
print()
27
print(f'C1 ⊕ C2 = {xor_ct.hex()}')
28
print(f'P1 ⊕ P2 = {xor_pt.hex()}')
29
print(f'两者相等: {xor_ct == xor_pt}')
30
print()
31

32
# 如果攻击者知道 P1，可以恢复 P2
33
print('--- 攻击者已知 P1，恢复 P2 ---')
34
recovered_p2 = bytes(a ^ b ^ c for a, b, c in zip(c1_ct, c2_ct, msg1))
35
# 截断到 msg2 的实际长度
36
recovered_p2 = recovered_p2[:len(msg2)]
37
print(f'  恢复的 P2: {recovered_p2.decode()}')
38
print(f'  原始的 P2: {msg2.decode()}')
39
print(f'  恢复成功: {recovered_p2 == msg2}')
40
print()
41

42
# nonce 重用还允许伪造认证标签
43
print('--- nonce 重用还破坏认证安全性 ---')
44
print(f'  相同 nonce 产生的 GHASH 子密钥 H 相同')
45
print(f'  攻击者可以构造有效的伪造密文，绕过认证检查')
46
print(f'  这就是为什么 nonce 绝对不能重用！')

1
$ python3 nonce_reuse.py
2
消息 1: The secret attack is at dawn
3
消息 2: Defend the northern gate!
4
Nonce:  000e7741b5c97263f9af27e0 (同一个 nonce！)
5

6
C1 ⊕ C2 = 100d03451d0143060d11000f1b06150b0e5207534700004545
7
P1 ⊕ P2 = 100d03451d0143060d11000f1b06150b0e5207534700004545
8
两者相等: True
9

10
--- 攻击者已知 P1，恢复 P2 ---
11
  恢复的 P2: Defend the northern gate!
12
  原始的 P2: Defend the northern gate!
13
  恢复成功: True
14

15
--- nonce 重用还破坏认证安全性 ---
16
  相同 nonce 产生的 GHASH 子密钥 H 相同
17
  攻击者可以构造有效的伪造密文，绕过认证检查
18
  这就是为什么 nonce 绝对不能重用！