使用加密包解密数据时出现错误"ValueError: Encryption/decryption“。

Question

import base64
import os.path
from shutil import copyfile
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.asymmetric import padding, rsa
from cryptography.hazmat.backends.openssl.rsa import _RSAPublicKey, _RSAPrivateKey
from asym_crypto_yaml import (decrypt_value, encrypt_value, Encrypted,
load_private_key_from_file, load_public_key_from_file,
generate_new_private_key, generate_new_public_key,
load, dump, NUMBER_OF_BYTES_PER_ENCRYPTED_CHUNK, KEY_CHUNK_SIZE,
SUPPORTED_KEY_SIZES, generate_private_key_to_file, generate_private_key_to_file, generate_public_key_to_file,
encrypt_value_and_print ,add_secret_to_yaml_file, decrypt_yaml_file_and_write_encrypted_file_to_disk,
reencrypt_secrets_and_write_to_yaml_file)
from functools import reduce

def test_add_secret_to_yaml_file():
    private_key_output_filename = "/home/asy/private_key.private"
    public_key_output_filename = "/home/asy/public_key.public"
    private_key = generate_private_key_to_file(private_key_output_filename)
    public_key = generate_public_key_to_file(private_key_output_filename, public_key_output_filename)

    yaml_file_fixture = "/home/asy/saml.yml"
    yaml_file_to_append_to = "/home/asy/saml_du.yml"
    test_key_to_encrypt = ['FACEBOOK_APP_ID', 'FACEBOOK_APP_SECRET', 'AWS_S3_BUCKET', 'SECRET_TOKEN', 'TWITTER_CONSUMER_KEY', 'TWITTER_CONSUMER_SECRET',
    'TWITTER_OAUTH_TOKEN', 'TWITTER_OAUTH_TOKEN_SECRET', 'LINKEDIN_API_KEY', 'LINKEDIN_SECRET_KEY']
    print ("################################ENCRYPT YAML########################################")
    before_dict = None
    with open(yaml_file_to_append_to, "r") as f:
        before_dict = load(f)
    #  Encrypt data in yml file
    for test_key in test_key_to_encrypt:
        print ('Encrypted key is:', test_key)
        print ('Encrypted value is:', before_dict[test_key])
        add_secret_to_yaml_file(test_key, before_dict[test_key], public_key_output_filename, yaml_file_to_append_to)

    print ("################################DECRYPT YAML########################################")
    before_dict = None
    with open(yaml_file_to_append_to, "r") as f:
        before_dict = load(f)
    # Decrypt data from yml file (Using same function)
    for test_key_value in test_key_to_encrypt:
        print ('key is', before_dict[test_key_value])
        test_encrypted_key_value = decrypt_value(before_dict[test_key_value], private_key)
        print ("decrypt data", test_encrypted_key_value)
    # 

def decrypt_data():
    private_key_output_filename = "/home/asy/private_key.private"
    public_key_output_filename = "/home/asy/public_key.public"
    private_key = generate_private_key_to_file(private_key_output_filename)
    public_key = generate_public_key_to_file(private_key_output_filename, public_key_output_filename)

    yaml_file_to_append_to = "/home/asy/saml_du.yml"
    test_key_to_encrypt = ['FACEBOOK_APP_ID', 'FACEBOOK_APP_SECRET', 'AWS_S3_BUCKET', 'SECRET_TOKEN', 'TWITTER_CONSUMER_KEY', 'TWITTER_CONSUMER_SECRET',
    'TWITTER_OAUTH_TOKEN', 'TWITTER_OAUTH_TOKEN_SECRET', 'LINKEDIN_API_KEY', 'LINKEDIN_SECRET_KEY']
    print ("################################DECRYPT YAML########################################")
    before_dict = None
    with open(yaml_file_to_append_to, "r") as f:
        before_dict = load(f)

    for test_key_value in test_key_to_encrypt:
        print ('key is', test_key_value)
        print ('value is', before_dict[test_key_value])
        test_encrypted_key_value = decrypt_value(before_dict[test_key_value], private_key)
        print ("decrypt data", test_encrypted_key_value)

if __name__ == "__main__":
    test_add_secret_to_yaml_file()
    # decrypt_data()

示例yml文件：

SECRET_TOKEN:            "d4e5783de1c74c7a4e3a27578df6gdgf6g786g8df7g6g87d6fgb709"
FACEBOOK_APP_ID:         "35864341"
FACEBOOK_APP_SECRET:     "759a1e7sd7fvyfsd473"
TWITTER_CONSUMER_KEY:    "1UrRKJDF8SD7FSDF3S"
TWITTER_CONSUMER_SECRET: "5W7TE8KJJk787bnG0s"
TWITTER_OAUTH_TOKEN:     "716397744-3rHXFkFkjKjkjK78PQ5"
TWITTER_OAUTH_TOKEN_SECRET: "DuDJKFSD89SDFD"
LINKEDIN_API_KEY:        "2vjkJKjk4"
LINKEDIN_SECRET_KEY:     "5KLSJDFsE"
GMAIL_USERNAME:          "username@gmail.com"
GMAIL_PASSWORD:          "PASSWORD"
AWS_ACCESS_KEY_ID:       "ASDKLSDJFIA"
AWS_SECRET_ACCESS_KEY:   "7ASDFJksdfjskdlf87sdfKb"
AWS_S3_BUCKET:           "bucket"

development:
  MAILER_HOST: "localhost:3000"

test:
  MAILER_HOST: "localhost:3000"

production:
  MAILER_HOST: "domain.com"

我正在使用"asym_crypto_yaml“yaml包在.yml文件中写入加密值。我无法解密来自不同解密函数(decrypt_data())的值。上面的代码只有在我第一次执行代码时才会解密。但是从第二次开始它就给出了“加密/解密错误”。

我的目标是解密来自yml文件的数据。如果能帮上一点忙，我们会很感激。

Answer 1

由于decrypt_data()中用于解密的私钥不属于test_add_secret_to_yaml_file()中用于执行加密的公钥，因此会触发该错误。因此，使用此私钥解密失败。

这个问题可以通过在decrypt_data()中使用test_add_secret_to_yaml_file()生成的密钥对的私钥来解决。为此，在decrypt_data()中删除generate_private_key_to_file()和generate_public_key_to_file()调用(以生成和存储密钥对)。所需的私钥可以通过存储在test_add_secret_to_yaml_file()中的文件中的load_private_key_from_file()加载。

Answer 2

当您想要加密的数据对于您生成的密钥的大小来说太大时，hazmat类也会抛出此ValueError: Encryption/decryption failed.错误。

使用更大的密钥大小重试，如下所示。

private_key = rsa.generate_private_key(public_exponent=65537, key_size = 4096)

但请记住，这将增加生成密钥的时间，这是RSA加密算法的最大缺点之一。