.Net RijndaelManaged找不到Javascript

Question

我在我的C# WCF中使用了以下加密/解密：

    public static string EncryptString(string InputText, string Password)
    {
        RijndaelManaged RijndaelCipher = new RijndaelManaged();
        RijndaelCipher.Padding = PaddingMode.ISO10126;
        if (string.IsNullOrEmpty(Password) == true)
        {
            Password = "Test";
        }
        byte[] PlainText = System.Text.Encoding.Unicode.GetBytes(InputText);
        byte[] Salt = Encoding.ASCII.GetBytes(Password.Length.ToString());

        //This class uses an extension of the PBKDF1 algorithm defined in the PKCS#5 v2.0 
        //standard to derive bytes suitable for use as key material from a password. 
        //The standard is documented in IETF RRC 2898.

        PasswordDeriveBytes SecretKey = new PasswordDeriveBytes(Password, Salt);
        //Creates a symmetric encryptor object. 
        ICryptoTransform Encryptor = RijndaelCipher.CreateEncryptor(SecretKey.GetBytes(32), SecretKey.GetBytes(16));
        MemoryStream memoryStream = new MemoryStream();
        //Defines a stream that links data streams to cryptographic transformations
        CryptoStream cryptoStream = new CryptoStream(memoryStream, Encryptor, CryptoStreamMode.Write);
        cryptoStream.Write(PlainText, 0, PlainText.Length);
        //Writes the final state and clears the buffer
        cryptoStream.FlushFinalBlock();
        byte[] CipherBytes = memoryStream.ToArray();
        memoryStream.Close();
        memoryStream = null;
        cryptoStream.Close();
        cryptoStream = null;
        PlainText = null;
        Salt = null;
        try
        {
            GC.Collect();
        }
        catch { }
        return Convert.ToBase64String(CipherBytes);

    }


    public static string DecryptString(string InputText, string Password)
    {

        RijndaelManaged RijndaelCipher = new RijndaelManaged();
        RijndaelCipher.Padding = PaddingMode.ISO10126;
        if (string.IsNullOrEmpty(Password) == true)
        {
            Password = "Test";
        }
        byte[] EncryptedData = Convert.FromBase64String(InputText);
        byte[] Salt = Encoding.ASCII.GetBytes(Password.Length.ToString());
        //Making of the key for decryption
        PasswordDeriveBytes SecretKey = new PasswordDeriveBytes(Password, Salt);
        //Creates a symmetric Rijndael decryptor object.
        ICryptoTransform Decryptor = RijndaelCipher.CreateDecryptor(SecretKey.GetBytes(32), SecretKey.GetBytes(16));
        MemoryStream memoryStream = new MemoryStream(EncryptedData);
        //Defines the cryptographics stream for decryption.THe stream contains decrpted data
        CryptoStream cryptoStream = new CryptoStream(memoryStream, Decryptor, CryptoStreamMode.Read);
        byte[] PlainText = new byte[EncryptedData.Length];
        int DecryptedCount = cryptoStream.Read(PlainText, 0, PlainText.Length);
        memoryStream.Close();
        memoryStream = null;
        cryptoStream.Close();
        cryptoStream = null;
        Salt = null;
        try
        {
            GC.Collect();
        }
        catch { }
        //Converting to string
        return Encoding.Unicode.GetString(PlainText, 0, DecryptedCount);
    }

现在，我正在尝试使用Java脚本来适应，想要加密我的网络中的数据，并能够解密我的WCF中的数据，我尝试使用this script，但不工作，我在哪里可以找到JS和.Net样本？

得到以下错误：{“要解密的数据长度无效。”}

谢谢。

Answer 1

好的，如果我没理解错的话，你想在浏览器中用javascript加密用户名/密码，以便安全地将数据传输到WCF服务。为此，您在两端都使用了AES (对称)加密。

如果这是正确的，那么您真的应该使用SSL。为什么？因为SSL做到了这一点，但效果要好得多。简而言之，SSL将在对RSA密钥的公钥进行身份验证后协商AES密钥。因此，您可以从客户端javascript获得额外的好处，因为它肯定是在与正确的服务器对话。

我认为自滚AES方法的错误之处在于，至少你必须将你的密钥(没有公钥认证步骤)暴露给客户端javascript。这意味着您立即破坏了安全性，因为拥有该密钥的任何人现在都可以向服务器发送数据。

如果我误解了，那么也许有一个合适的时机来做这件事，然而，目前我看不到一个。

希望这能有所帮助。