文件加密CryptEncrypt和导出密钥CryptExportKey学习笔记

野性酷女 2022-06-09 08:52 569阅读 0赞

刚刚接触C++，使用CryptEncrypt来对一个文件进行加密，代码都是MSDN上的，一开始使用起来比价困难，这里对代码解读和分享一下。

#include <tchar.h>
    #include <stdio.h>
    #include <windows.h>
    #include <wincrypt.h>
    #include <conio.h>
    
    #pragma comment (lib, "advapi32")
    
    #define KEYLENGTH 0x00800000 //产生密钥的长度，类型
    #define ENCRYPT_ALGORITHM CALG_RC4 //生成密钥所使用的算法
    #define ENCRYPT_BLOCK_SIZE 8 //每次加密数据块的最小单位长度
    
    bool MyEncryptFile(
        LPTSTR szSource,
        LPTSTR szDestination,
        LPTSTR szPassword,
        LPTSTR szexportkey);
    
    void MyHandleError(
        LPTSTR psz,
        int nErrorNumber);
    
    int main()
    {
    
        LPTSTR pszSource = (LPTSTR)L"D:\\testSecurity\\hello11.txt";//要加密的文件
        LPTSTR pszDestination = (LPTSTR)L"D:\\testSecurity\\hello22.txt";//加密后的文件
        LPTSTR pszexportkeyDestination = (LPTSTR)L"D:\\testSecurity\\exportkeyblob.txt";
        //LPTSTR pszPassword = (LPTSTR)"123456";//随便一串字符，用于加解密
        LPTSTR pszPassword = NULL;
        //---------------------------------------------------------------
        // Call EncryptFile to do the actual encryption.
        if (MyEncryptFile(pszSource, pszDestination, pszPassword, pszexportkeyDestination))
        {
            _tprintf(TEXT("Encryption of the file %s was successful. \n"), pszSource);
            _tprintf(TEXT("The encrypted data is in file %s.\n"), pszDestination);
        }
        else
        {
            MyHandleError(TEXT("Error encrypting file!\n"), GetLastError());
        }
        getchar();
        return 0;
    }
    
    bool MyEncryptFile(LPTSTR pszSourceFile, LPTSTR pszDestinationFile, LPTSTR pszPassword, LPTSTR pszexportkeyDestination)
    {
        bool fReturn = false;
        HANDLE hSourceFile = INVALID_HANDLE_VALUE;
        HANDLE hDestinationFile = INVALID_HANDLE_VALUE;
        HANDLE hexportkeyDestinationFile = INVALID_HANDLE_VALUE;
    
        HCRYPTPROV hCryptProv = NULL;
        HCRYPTKEY hKey = NULL;
        HCRYPTKEY hXchgKey = NULL;
        HCRYPTHASH hHash = NULL;
    
        PBYTE pbKeyBlob = NULL;
        DWORD dwKeyBlobLen;
    
        PBYTE pbBuffer = NULL;
        DWORD dwBlockLen;
        DWORD dwBufferLen;
        DWORD dwCount;
    
    
        hSourceFile = CreateFile(
            pszSourceFile,
            FILE_READ_DATA,
            FILE_SHARE_READ,
            NULL,
            OPEN_EXISTING,
            FILE_ATTRIBUTE_NORMAL,
            NULL);
        if (INVALID_HANDLE_VALUE != hSourceFile)
        {
            _tprintf(TEXT("The source plaintext file, %s, is open. \n"), pszSourceFile);
        }
        else
        {
            MyHandleError(TEXT("Error opening source plaintext file!\n"), GetLastError());
            goto Exit_MyEncryptFile;
        }
    
        // 创建目标文件 
        hDestinationFile = CreateFile(pszDestinationFile, FILE_WRITE_DATA, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
        if (INVALID_HANDLE_VALUE != hDestinationFile)
        {
            _tprintf(TEXT("The destination file, %s, is open. \n"), pszDestinationFile);
        }
        else
        {
            MyHandleError(TEXT("Error opening destination file!\n"), GetLastError());
            goto Exit_MyEncryptFile;
        }
        //获取容器handle
        if (!CryptAcquireContext(
            &hCryptProv, //返回的CSP句柄,秘钥容器
            NULL,   //密钥容器的名字
            MS_ENHANCED_PROV, //这个参数这里用的是缺省值，指得是缺省得CSP模块，你也可以传入一个LPCTSTR类型的字符串，指定CSP模块
            PROV_RSA_FULL, //这里为使用的加密策略
            0))
        {
            //
            if (GetLastError() == NTE_BAD_KEYSET)
            {
                if (!CryptAcquireContext(
                    &hCryptProv,
                    NULL,
                    MS_ENHANCED_PROV,
                    PROV_RSA_FULL,
                    CRYPT_NEWKEYSET)) // CRYPT_NEWKEYSET意味着当指定容器不存在的时候，去创建一个容器。
                {
                    MyHandleError(TEXT("Error during CryptAcquireContext!\n"), GetLastError());
                    goto Exit_MyEncryptFile;
                    //return FALSE;
                }
            }
            else
            {
                MyHandleError(TEXT("Error during CryptAcquireContext!\n"), GetLastError());
                goto Exit_MyEncryptFile;
                //return FALSE;
            }
        }
        _tprintf(TEXT("A cryptographic provider has been acquired. \n"));
    
        // 创建密钥
        if (pszPassword == NULL)
        {
            // 如果pszPassword为NULL，则生成一个随机的密钥，然后再把这个随机秘钥写到文件中
            // 创建一个随机秘钥 hKey
            if (CryptGenKey( //产生一个随机的交换密钥或者公/私钥对
                hCryptProv,
                ENCRYPT_ALGORITHM,  //表明产生私钥所使用的算法或者公钥生成的算法
                KEYLENGTH | CRYPT_EXPORTABLE, //表示密钥使用的长度，参数可以为0，采用默认的密钥长度
                &hKey))
            {
                _tprintf(TEXT("A session key has been created. \n"));
            }
            else
            {
                MyHandleError(TEXT("Error during CryptGenKey. \n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
    
            //-----------------------------------------------------------
            // Get the handle to the exchange public key. 
            //获取交换密钥句柄
            if (CryptGetUserKey(
                hCryptProv,
                AT_KEYEXCHANGE, //AT_KEYEXCHANGE（交换密钥） or AT_SIGNATURE（签名密钥）
                &hXchgKey)) //返回所获取密钥类型的句柄
            {
                _tprintf(TEXT("The user public key has been retrieved. \n"));
            }
            else
            {
                if (NTE_NO_KEY == GetLastError())
                {
                    //如果没有交换密钥，可以随机生成一个
                    if (!CryptGenKey(
                        hCryptProv,
                        AT_KEYEXCHANGE,
                        CRYPT_EXPORTABLE,
                        &hXchgKey))
                    {
                        MyHandleError(TEXT("Could not create a user public key.\n"), GetLastError());
                        goto Exit_MyEncryptFile;
                    }
                }
                else
                {
                    MyHandleError(TEXT("User public key is not available and may ")TEXT("not exist.\n"), GetLastError());
                    goto Exit_MyEncryptFile;
                }
            }
    
            //-----------------------------------------------------------
            // Determine size of the key BLOB, and allocate memory. 
            //这步导出密钥只是先获取导出key Blob的长度，并对其分配内存，
            if (CryptExportKey(
                hKey, //需要导出的密钥句柄
                hXchgKey, //将待导出密钥用交换密钥进行加密，假如是公开的BLOG当然就设置为0
                SIMPLEBLOB, // 指定导出的密钥BLOB类型,BLOB也就是一种存储结构。六个参数见MSDN
                0,
                NULL, //导出的数据指针，以后就可以将这个数据写如磁盘或者别的任务
                &dwKeyBlobLen)) //导出的数据长度
            {
                _tprintf(TEXT("The key BLOB is %d bytes long. \n"), dwKeyBlobLen);
            }
            else
            {
                MyHandleError(TEXT("Error computing BLOB length! \n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
            //未将要存储秘钥的keyBlob分配内存
            if (pbKeyBlob = (BYTE *)malloc(dwKeyBlobLen))
            {
                _tprintf(TEXT("Memory is allocated for the key BLOB. \n"));
            }
            else
            {
                MyHandleError(TEXT("Out of memory. \n"), E_OUTOFMEMORY);
                goto Exit_MyEncryptFile;
            }
    
            //-----------------------------------------------------------
            // Encrypt and export the session key into a simple key 
            // BLOB.
            //真正的用交换密钥将密钥加密后，存储到Blob
            if (CryptExportKey(
                hKey,
                hXchgKey,
                SIMPLEBLOB,
                0,
                pbKeyBlob,
                &dwKeyBlobLen))
            {
                _tprintf(TEXT("The key has been exported. \n"));
            }
            else
            {
                MyHandleError(TEXT("Error during CryptExportKey!\n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
    
            //-----------------------------------------------------------
            // Release the key exchange key handle. 
            //释放交换密钥
            if (hXchgKey)
            {
                if (!(CryptDestroyKey(hXchgKey)))
                {
                    MyHandleError(
                        TEXT("Error during CryptDestroyKey.\n"),
                        GetLastError());
                    goto Exit_MyEncryptFile;
                }
    
                hXchgKey = 0;
            }
            hexportkeyDestinationFile = CreateFile(pszexportkeyDestination, FILE_WRITE_DATA, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
            if (INVALID_HANDLE_VALUE != hexportkeyDestinationFile)
            {
                _tprintf(TEXT("The destination file, %s, is open. \n"), pszexportkeyDestination);
            }
            else
            {
                MyHandleError(TEXT("Error opening destination file!\n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
            //先将keyblob 长度保存到文件中，然后再将keyblob写入，以后想解密还是啥的可以直接导入该keyblob即可
            if (!WriteFile(
                hexportkeyDestinationFile,
                &dwKeyBlobLen,
                sizeof(DWORD),
                &dwCount,
                NULL))
            {
                MyHandleError(TEXT("Error writing header.\n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
            else
            {
                _tprintf(TEXT("A file header has been written. \n"));
            }
            //写入keyblob
            if (!WriteFile(
                hexportkeyDestinationFile,
                pbKeyBlob,
                dwKeyBlobLen,
                &dwCount,
                NULL))
            {
                MyHandleError(TEXT("Error writing header.\n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
            else
            {
                _tprintf(TEXT("The key BLOB has been written to the ")TEXT("file. \n"));
            }
            // Free memory.
            free(pbKeyBlob);
        }
        else
        {
            //-----------------------------------------------------------
            // The file will be encrypted with a session key derived 
            // from a password.
            // The session key will be recreated when the file is 
            // decrypted only if the password used to create the key is 
            // available. 
    
            //创建一个hash对象，将password hash以后再通过CryptDeriveKey得到密钥
            if (CryptCreateHash( //初始化一个HASH对象,产生一个空的HASH对象
                hCryptProv,
                CALG_MD5, //指定的hash算法
                0,
                0,
                &hHash))
            {
                _tprintf(TEXT("A hash object has been created. \n"));
            }
            else
            {
                MyHandleError(TEXT("Error during CryptCreateHash!\n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
    
            // Hash password后将hash信息保存在hHash中
            if (CryptHashData( //对数据使用HASH，保存在hHash中
                hHash,
                (BYTE *)pszPassword,
                lstrlen(pszPassword),
                0))
            {
                _tprintf(TEXT("The password has been added to the hash. \n"));
            }
            else
            {
                MyHandleError(TEXT("Error during CryptHashData. \n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
    
            //再使用已经对password的hash对象生成密钥
            if (CryptDeriveKey(  //从某一数据产生会话密钥。有点类似CryptGenKey，但是产生的会话密钥来自固定数据，而CryptGenKey是随机产生的。并且不能产生公 / 私钥对
                hCryptProv,
                ENCRYPT_ALGORITHM, //in,指定的算法，类似CryptGenKey
                hHash, //in,HASH对象的句柄
                KEYLENGTH, //in,指定产生密钥的类型
                &hKey)) //in,out产生的密钥句柄地址
            {
                _tprintf(TEXT("An encryption key is derived from the ")TEXT("password hash. \n"));
            }
            else
            {
                MyHandleError(TEXT("Error during CryptDeriveKey!\n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
        }
    
        //---------------------------------------------------------------
        // The session key is now ready. If it is not a key derived from 
        // a password, the session key encrypted with the private key 
        // has been written to the destination file.
    
        //---------------------------------------------------------------
        // Determine the number of bytes to encrypt at a time. 
        // This must be a multiple of ENCRYPT_BLOCK_SIZE.
        //每一次加密的字节长度，必须要是ENCRYPT_BLOCK_SIZE的整数倍
        dwBlockLen = 1000 - 1000 % ENCRYPT_BLOCK_SIZE;
    
        //---------------------------------------------------------------
        // Determine the block size. If a block cipher is used, 
        // it must have room for an extra block. 
        if (ENCRYPT_BLOCK_SIZE > 1)
        {
            dwBufferLen = dwBlockLen + ENCRYPT_BLOCK_SIZE;
        }
        else
        {
            dwBufferLen = dwBlockLen;
        }
    
        //---------------------------------------------------------------
        // Allocate memory. 
        if (pbBuffer = (BYTE *)malloc(dwBufferLen))
        {
            _tprintf(TEXT("Memory has been allocated for the buffer. \n"));
        }
        else
        {
            MyHandleError(TEXT("Out of memory. \n"), E_OUTOFMEMORY);
            goto Exit_MyEncryptFile;
        }
    
        //---------------------------------------------------------------
        // In a do loop, encrypt the source file, 
        // and write to the source file. 
        bool fEOF = FALSE;
        do
        {
            //-----------------------------------------------------------
            // Read up to dwBlockLen bytes from the source file. 
            //从要加密的文件每次读取dwBlockLen个字节进行加密
            if (!ReadFile(
                hSourceFile, //文件的句柄
                pbBuffer, //用于保存读入数据的一个缓冲区
                dwBlockLen, //要读入的字节数
                &dwCount, //指向实际读取字节数的指针
                NULL))
            {
                MyHandleError(TEXT("Error reading plaintext!\n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
    
            if (dwCount < dwBlockLen)
            {
                fEOF = TRUE;
            }
            // 加密数据 
            if (!CryptEncrypt(
                hKey,
                NULL,
                fEOF, //若只有一个分组的数据需要加密或者为最后一个分组，则Final为TRUE。
                0,
                pbBuffer,
                &dwCount,
                dwBufferLen))
            {
                MyHandleError(TEXT("Error during CryptEncrypt. \n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
            //将加密后的数据写入目标文件
            if (!WriteFile(
                hDestinationFile,
                pbBuffer,
                dwCount,
                &dwCount,
                NULL))
            {
                MyHandleError(TEXT("Error writing ciphertext.\n"), GetLastError());
                goto Exit_MyEncryptFile;
            }
        } while (!fEOF);
    
        fReturn = true;
    
    Exit_MyEncryptFile:
        //---------------------------------------------------------------
        // Close files.
        if (hSourceFile)
        {
            CloseHandle(hSourceFile);
        }
    
        if (hDestinationFile)
        {
            CloseHandle(hDestinationFile);
        }
    
        //---------------------------------------------------------------
        // Free memory. 
        if (pbBuffer)
        {
            free(pbBuffer);
        }
    
    
        //-----------------------------------------------------------
        // Release the hash object. 
        if (hHash)
        {
            if (!(CryptDestroyHash(hHash)))
            {
                MyHandleError(
                    TEXT("Error during CryptDestroyHash.\n"),
                    GetLastError());
            }
    
            hHash = NULL;
        }
    
        //---------------------------------------------------------------
        // Release the session key. 
        if (hKey)
        {
            if (!(CryptDestroyKey(hKey)))
            {
                MyHandleError(
                    TEXT("Error during CryptDestroyKey!\n"),
                    GetLastError());
            }
        }
    
        //---------------------------------------------------------------
        // Release the provider handle. 
        if (hCryptProv)
        {
            if (!(CryptReleaseContext(hCryptProv, 0)))
            {
                MyHandleError(
                    TEXT("Error during CryptReleaseContext!\n"),
                    GetLastError());
            }
        }
        return fReturn;
    } // End Encryptfile.
    
    
    //-------------------------------------------------------------------
    // This example uses the function MyHandleError, a simple error
    // handling function, to print an error message to the 
    // standard error (stderr) file and exit the program. 
    // For most applications, replace this function with one 
    // that does more extensive error reporting.
    
    void MyHandleError(LPTSTR psz, int nErrorNumber)
    {
        _ftprintf(stderr, TEXT("An error occurred in the program. \n"));
        _ftprintf(stderr, TEXT("%s\n"), psz);
        _ftprintf(stderr, TEXT("Error number %x.\n"), nErrorNumber);
    }

要加密的文件：  
![这里写图片描述][SouthEast]  
加密后文件：  
![这里写图片描述][SouthEast 1]  
导出的秘钥blob:  
![这里写图片描述][SouthEast 2]

[SouthEast]: /images/20220609/135273738a0645d0bbbb5d160b0177a9.png
[SouthEast 1]: /images/20220609/7b9072b5202c41edb6b7ef11a511f869.png
[SouthEast 2]: /images/20220609/73d6a074d1c14397a6ef840985bfb869.png