Giter Club home page Giter Club logo

aes-rsa-java's Issues

几个问题

看了下这个方案的 Java 代码，有几个问题：
1.
https://github.com/wustrive2008/aes-rsa-java/blob/master/src/main/java/com/wustrive/aesrsa/util/RandomUtil.java

这个竟然用的是java.util.Random。
java.util.Random 不是密码学安全的！

"AES/ECB/PKCS5Padding";

AES绝对不要使用 ECB 模式！

https://zh.wikipedia.org/wiki/%E5%9D%97%E5%AF%86%E7%A0%81%E7%9A%84%E5%B7%A5%E4%BD%9C%E6%A8%A1%E5%BC%8F

HMAC 用 javax.crypto.Mac 就行了

http://stackoverflow.com/questions/3208160/how-to-generate-an-hmac-in-java-equivalent-to-a-python-example

不需要自己实现。
楼主的实现冗余代码太多。

建议废掉 HMAC-MD5 和 HMAC-SHA1,这俩已经不安全了。
1.
https://github.com/wustrive2008/aes-rsa-java/blob/master/src/main/java/com/wustrive/aesrsa/util/EncryptionUtil.java

这个提取一个 byte to hex 的公共函数出来就行了。

可以省掉复制粘贴。

byte to hex 也不需要写这么长。几行搞定：

http://stackoverflow.com/questions/15429257/how-to-convert-byte-array-to-hexstring-in-java

RSA 1024已经不安全了，起码要2048！

https://github.com/wustrive2008/aes-rsa-java/blob/master/src/main/java/com/wustrive/aesrsa/util/RSA.java

"SHA1WithRSA" 已经被废弃，建议更新成 SHA256WithRSA

建议楼主好好看看Facebook的这个项目：

https://github.com/facebook/conceal

客户端解密过程的疑问

String aeskey = RSA.decrypt(Req.encryptkey, serverPrivateKey);
解密服务器的响应时为什么不用客户端的私钥clientPrivateKey，这时客户端相对服务器端是接收方，不是应该用接收方的私钥解密吗？

Insecure Hash Functions

Hi there, we found that the following places using insecure hash functions:

/home/xwt/IdeaProjects/aes-rsa-java/src/main/java/com/wustrive/aesrsa/util/Digest.java:19: error: [algorithm.not.allowed] Algorithm: MD5 is not allowed by the current rules
			MessageDigest md = MessageDigest.getInstance("MD5");
			                                             ^
/home/xwt/IdeaProjects/aes-rsa-java/src/main/java/com/wustrive/aesrsa/util/Digest.java:33: error: [algorithm.not.allowed] Algorithm: MD5 is not allowed by the current rules
			MessageDigest md = MessageDigest.getInstance("MD5");
			                                             ^
/home/xwt/IdeaProjects/aes-rsa-java/src/main/java/com/wustrive/aesrsa/util/Digest.java:66: error: [algorithm.not.allowed] Algorithm: MD5 is not allowed by the current rules
			md = MessageDigest.getInstance("MD5");
			                               ^
/home/xwt/IdeaProjects/aes-rsa-java/src/main/java/com/wustrive/aesrsa/util/Digest.java:102: error: [algorithm.not.allowed] Algorithm: SHA is not allowed by the current rules
			md = MessageDigest.getInstance("SHA");
			                               ^
/home/xwt/IdeaProjects/aes-rsa-java/src/main/java/com/wustrive/aesrsa/util/Digest.java:132: error: [algorithm.not.allowed] Algorithm: SHA is not allowed by the current rules
			md = MessageDigest.getInstance("SHA");
			                               ^
/home/xwt/IdeaProjects/aes-rsa-java/src/main/java/com/wustrive/aesrsa/util/Digest.java:162: error: [algorithm.not.allowed] Algorithm: SHA1 is not allowed by the current rules
			MessageDigest md = MessageDigest.getInstance("SHA1");
			                                             ^
/home/xwt/IdeaProjects/aes-rsa-java/src/main/java/com/wustrive/aesrsa/util/EncryptionUtil.java:23: error: [algorithm.not.allowed] Algorithm: MD5 is not allowed by the current rules
            MessageDigest md = MessageDigest.getInstance("MD5");
                                                         ^
/home/xwt/IdeaProjects/aes-rsa-java/src/main/java/com/wustrive/aesrsa/util/EncryptionUtil.java:57: error: [algorithm.not.allowed] Algorithm: SHA-1 is not allowed by the current rules
            MessageDigest md = MessageDigest.getInstance("SHA-1");
                                                         ^

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.