加密 .NET 二进制序列化流

Question

我正在研究 C# 中的加密，但遇到了问题。我有一些Rijndael encryption code and it's working perfectly with strings. But now I'm studying serialization and the BinaryWriter writes the data of classes without any protection. I'm using this code to test；有没有办法 "encrypt the class" 或类似的东西？

为了澄清问题，这是我的代码：

FileStream file = new FileStream(Environment.CurrentDirectory + @"\class.dat", FileMode.Create);
using (BinaryWriter sw = new BinaryWriter(file))
{
    byte[] byt = ConverteObjectEmByte(myVarClass);
    sw.Write(byt);
}

我是这样读的：

MyClass newMyVarClass;
FileStream file = new FileStream(Environment.CurrentDirectory + @"\class.dat", FileMode.Open);
using (BinaryReader sr = new BinaryReader(file))
{
    // 218 is the size of the byte array that I've tested (byt)
    myNewVarClass = (MyClass)ConverteByteEmObject(sr.ReadBytes(218));
}

谢谢！

Answer 1

与其将转换为 byte[] 作为传递到不同流对象时的中间步骤，不如将多个流链接在一起，将一个流的输出传递到另一个流的输入。

这种方法在这里很有意义，因为您正在链接在一起

二进制序列化 => 加密 => 写入文件.

考虑到这一点，您可以将 ConvertObjectEmByte 更改为：

public static void WriteObjectToStream(Stream outputStream, Object obj)
{
    if (object.ReferenceEquals(null, obj))
    {
        return;
    }

    BinaryFormatter bf = new BinaryFormatter();
    bf.Serialize(outputStream, obj);
}

同样，ConvertByteEmObject可以变成：

public static object ReadObjectFromStream(Stream inputStream)
{
    BinaryFormatter binForm = new BinaryFormatter();
    object obj = binForm.Deserialize(inputStream);
    return obj;
}

要添加 encryption/decryption，我们可以编写创建 CryptoStream 对象的函数，我们可以将这些对象与这些二进制序列化函数链接起来。我下面的示例函数看起来与您链接到的文章中的 Encrypt/Decrypt 函数有点不同，因为 IV (Initialization Vector) is now generated randomly and written to the stream (and read from the stream on the other end). It's important that the IV is unique for each chunk of data you encrypt for security, and you should also use a random number generator intended for cryptographic purposes like RNGCryptoServiceProvider，而不是像 Random 这样的伪随机数生成器.

public static CryptoStream CreateEncryptionStream(byte[] key, Stream outputStream)
{
    byte[] iv = new byte[ivSize];

    using (var rng = new RNGCryptoServiceProvider())
    {
        // Using a cryptographic random number generator
        rng.GetNonZeroBytes(iv);
    }

    // Write IV to the start of the stream
    outputStream.Write(iv, 0, iv.Length);

    Rijndael rijndael = new RijndaelManaged();
    rijndael.KeySize = keySize;

    CryptoStream encryptor = new CryptoStream(
        outputStream,
        rijndael.CreateEncryptor(key, iv),
        CryptoStreamMode.Write);
    return encryptor;
}

public static CryptoStream CreateDecryptionStream(byte[] key, Stream inputStream)
{
    byte[] iv = new byte[ivSize];

    if (inputStream.Read(iv, 0, iv.Length) != iv.Length)
    {
        throw new ApplicationException("Failed to read IV from stream.");
    }

    Rijndael rijndael = new RijndaelManaged();
    rijndael.KeySize = keySize;

    CryptoStream decryptor = new CryptoStream(
        inputStream,
        rijndael.CreateDecryptor(key, iv),
        CryptoStreamMode.Read);
    return decryptor;
}

最后，我们可以把它粘在一起了：

byte[] key = Convert.FromBase64String(cryptoKey);

using (FileStream file = new FileStream(Environment.CurrentDirectory + @"\class.dat", FileMode.Create))
using (CryptoStream cryptoStream = CreateEncryptionStream(key, file))
{
    WriteObjectToStream(cryptoStream, myVarClass);
}

MyClass newMyVarClass;
using (FileStream file = new FileStream(Environment.CurrentDirectory + @"\class.dat", FileMode.Open))
using (CryptoStream cryptoStream = CreateDecryptionStream(key, file))
{
    newMyVarClass = (MyClass)ReadObjectFromStream(cryptoStream);
}

注意，我们将file流对象传递给CreateEncryptionStream（和CreateDecryptionStream），然后将cryptoStream对象传递给WriteObjectToStream（和ReadObjectfromStream)。您还会注意到流在 using 块内的范围内，因此当我们完成它们时它们会自动清理。

完整的测试程序如下：

using System;
using System.IO;
using System.Runtime.Serialization.Formatters.Binary;
using System.Security.Cryptography;

namespace CryptoStreams
{
    class Program
    {
        [Serializable]
        public class MyClass
        {
            public string TestValue
            {
                get;
                set;
            }

            public int SomeInt
            {
                get;
                set;
            }
        }

        public static void WriteObjectToStream(Stream outputStream, Object obj)
        {
            if (object.ReferenceEquals(null, obj))
            {
                return;
            }

            BinaryFormatter bf = new BinaryFormatter();
            bf.Serialize(outputStream, obj);
        }

        public static object ReadObjectFromStream(Stream inputStream)
        {
            BinaryFormatter binForm = new BinaryFormatter();
            object obj = binForm.Deserialize(inputStream);
            return obj;
        }

        private const string cryptoKey =
            "Q3JpcHRvZ3JhZmlhcyBjb20gUmluamRhZWwgLyBBRVM=";
        private const int keySize = 256;
        private const int ivSize = 16; // block size is 128-bit

        public static CryptoStream CreateEncryptionStream(byte[] key, Stream outputStream)
        {
            byte[] iv = new byte[ivSize];

            using (var rng = new RNGCryptoServiceProvider())
            {
                // Using a cryptographic random number generator
                rng.GetNonZeroBytes(iv);
            }

            // Write IV to the start of the stream
            outputStream.Write(iv, 0, iv.Length);

            Rijndael rijndael = new RijndaelManaged();
            rijndael.KeySize = keySize;

            CryptoStream encryptor = new CryptoStream(
                outputStream,
                rijndael.CreateEncryptor(key, iv),
                CryptoStreamMode.Write);
            return encryptor;
        }

        public static CryptoStream CreateDecryptionStream(byte[] key, Stream inputStream)
        {
            byte[] iv = new byte[ivSize];

            if (inputStream.Read(iv, 0, iv.Length) != iv.Length)
            {
                throw new ApplicationException("Failed to read IV from stream.");
            }

            Rijndael rijndael = new RijndaelManaged();
            rijndael.KeySize = keySize;

            CryptoStream decryptor = new CryptoStream(
                inputStream,
                rijndael.CreateDecryptor(key, iv),
                CryptoStreamMode.Read);
            return decryptor;
        }

        static void Main(string[] args)
        {
            MyClass myVarClass = new MyClass
            {
                SomeInt = 1234,
                TestValue = "Hello"
            };

            byte[] key = Convert.FromBase64String(cryptoKey);

            using (FileStream file = new FileStream(Environment.CurrentDirectory + @"\class.dat", FileMode.Create))
            {
                using (CryptoStream cryptoStream = CreateEncryptionStream(key, file))
                {
                    WriteObjectToStream(cryptoStream, myVarClass);
                }
            }

            MyClass newMyVarClass;
            using (FileStream file = new FileStream(Environment.CurrentDirectory + @"\class.dat", FileMode.Open))
            using (CryptoStream cryptoStream = CreateDecryptionStream(key, file))
            {
                newMyVarClass = (MyClass)ReadObjectFromStream(cryptoStream);
            }

            Console.WriteLine("newMyVarClass.SomeInt: {0}; newMyVarClass.TestValue: {1}",
                newMyVarClass.SomeInt,
                newMyVarClass.TestValue);
        }
    }
}

Answer 2

我不确定是 .Net 库发生了变化还是只是代码有误。我不能直接运行 softwareiness 写的代码。此后，我根据答案更改了代码，以便可以正确使用。这是一个例子。

public class CryptoSerialization
{
    public static void WriteObjectToStream(Stream outputStream, object obj)
    {
        if (obj is null) throw new ArgumentNullException("obj can't be null");
        BinaryFormatter bf = new BinaryFormatter();
        bf.Serialize(outputStream, obj);
    }

    public static object ReadObjectFromStream(Stream inputStream)
    {
        BinaryFormatter bf = new BinaryFormatter();
        return bf.Deserialize(inputStream);
    }

    public static CryptoStream CreateEncryptionStream(Stream outputStream, byte[] Key, byte[] IV)
    {
        Rijndael rijndael = new RijndaelManaged();

        return new CryptoStream(outputStream, rijndael.CreateEncryptor(Key, IV), CryptoStreamMode.Write);
    }

    public static CryptoStream CreateDecryptionStream(Stream inputStream, byte[] Key, byte[] IV)
    {
        Rijndael rijndael = new RijndaelManaged();

        return new CryptoStream(inputStream, rijndael.CreateDecryptor(Key, IV), CryptoStreamMode.Read);
    }

    public static void EncryptObjectToFile(object obj, string path, byte[] Key, byte[] IV)
    {
        using FileStream file = new FileStream(path, FileMode.Create);
        using (CryptoStream cryptoStream = CreateEncryptionStream(file, Key, IV))
        {
            WriteObjectToStream(cryptoStream, obj);
        }
    }

    public static object DecryptObjectFromFile(string path, byte[] Key, byte[] IV)
    {
        using FileStream file = new FileStream(path, FileMode.Open);
        using (CryptoStream cryptoStream = CreateDecryptionStream(file, Key, IV))
        {
            return ReadObjectFromStream(cryptoStream);
        }
    }
}

[Serializable]
public class Student
{
    public string Name;
    public int Age;
}

static async Task Main(string[] args)
{
    // the original string "[This is an example key string!]";
    // I don't know if the length of the string has to be 32, but when I tried 64, it went wrong.
    string cryptoKey = "W1RoaXMgaXMgYW4gZXhhbXBsZSBrZXkgc3RyaW5nIV0=";
    byte[] Key = Convert.FromBase64String(cryptoKey);
    byte[] IV = new byte[16];
    using (RNGCryptoServiceProvider rngcsp = new RNGCryptoServiceProvider())
    {
        rngcsp.GetBytes(IV);
    }
    //same as
    //Rijndael rijndael = new RijndaelManaged();
    //rijndael.GenerateIV();
    //byte[] iv = rijndael.IV;
    List<Student> students = new List<Student>() { new Student { Name = "John", Age = 10 }, new Student { Name = "Marry", Age = 15 } };
    CryptoSerialization.EncryptObjectToFile(students, Environment.CurrentDirectory + @"\testCrypto.dat", Key, IV);

    List<Student> newStudents = (List<Student>)CryptoSerialization.DecryptObjectFromFile(Environment.CurrentDirectory + @"\testCrypto.dat", Key, IV);

    newStudents.ForEach((stu) =>
    {
        Console.WriteLine(stu.Name + ", " + stu.Age);
    });
    Console.ReadKey();
}

加密 .NET 二进制序列化流

Encrypt .NET binary serialization stream

c#

encryption