我正在加密登錄密碼firebase，它運行良好，但我在 google play 控制臺中收到一條警告，your app contains unsafe cryptographic encryption patterns我該如何擺脫它？我正在 android studio 上嘗試。public static class AESCrypt{ private static final String ALGORITHM = "AES"; private static final String KEY = "1Hbfh667adfDEJ78"; public static String encrypt(String value) throws Exception { Key key = generateKey(); Cipher cipher = Cipher.getInstance(AESCrypt.ALGORITHM); cipher.init(Cipher.ENCRYPT_MODE, key); byte [] encryptedByteValue = cipher.doFinal(value.getBytes("utf-8")); String encryptedValue64 = Base64.encodeToString(encryptedByteValue, Base64.DEFAULT); return encryptedValue64; } public static String decrypt(String value) throws Exception { Key key = generateKey(); Cipher cipher = Cipher.getInstance(AESCrypt.ALGORITHM); cipher.init(Cipher.DECRYPT_MODE, key); byte[] decryptedValue64 = Base64.decode(value, Base64.DEFAULT); byte [] decryptedByteValue = cipher.doFinal(decryptedValue64); String decryptedValue = new String(decryptedByteValue,"utf-8"); return decryptedValue; } private static Key generateKey() throws Exception { Key key = new SecretKeySpec(AESCrypt.KEY.getBytes(),AESCrypt.ALGORITHM); return key; }
1 回答
梵蒂岡之花
TA貢獻1900條經驗 獲得超5個贊
主要問題是您使用沒有完整性的密碼和硬編碼的加密密鑰。如果您使用Find Security Bugs分析源代碼，您會收到CIPHER_INTEGRITY和HARD_CODE_KEY警告：
The cipher does not provide data integrity [com.lloyds.keystorage.AESCrypt] At AESCrypt.java:[line 25] CIPHER_INTEGRITY
The cipher does not provide data integrity [com.lloyds.keystorage.AESCrypt] At AESCrypt.java:[line 15] CIPHER_INTEGRITY
Hard coded cryptographic key found [com.lloyds.keystorage.AESCrypt] At AESCrypt.java:[line 35] HARD_CODE_KEY
解決方案是使用包含基于哈希的消息身份驗證代碼 (HMAC) 的密碼來對數據進行簽名：
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
并將密鑰存儲在單獨的配置文件或密鑰庫中。
下面是完整重構后的整個類：
import android.util.Base64
import static java.nio.charset.StandardCharsets.UTF_8;
import java.security.Key;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
public class AESCrypt {
? private static final String TRANSFORMATION = "AES/GCM/NoPadding";
? public static String encrypt(String value) throws Exception {
? ? Key key = generateKey();
? ? Cipher cipher = Cipher.getInstance(TRANSFORMATION);
? ? cipher.init(Cipher.ENCRYPT_MODE, key);
? ? byte[] encryptedByteValue = cipher.doFinal(value.getBytes(UTF_8));
? ? return Base64.encodeToString(encryptedByteValue, Base64.DEFAULT);
? }
? public static String decrypt(String value) throws Exception {
? ? Key key = generateKey();
? ? Cipher cipher = Cipher.getInstance(TRANSFORMATION);
? ? cipher.init(Cipher.DECRYPT_MODE, key);
? ? byte[] decryptedValue64 = Base64.decode(value, Base64.DEFAULT);
? ? byte[] decryptedByteValue = cipher.doFinal(decryptedValue64);
? ? return new String(decryptedByteValue, UTF_8);
? }
? private static Key generateKey() {
? ? return new SecretKeySpec(Configuration.getKey().getBytes(UTF_8), TRANSFORMATION);
? }
}
添加回答
舉報
0/150
提交
取消