如何在 python 中使用 RSA/ECB/PKCS1Padding 创建密钥？
我正在努力寻找在 ECB 模式下使用 RSA 和 python 中的 PKCS1 填充的任何方法。我研究过 pyCrypto，但他们在主分支中没有 PKCS1 填充（但在补丁中有）。尽管如此，我在M2Crypto包中发现了带有PKCS1的RSA，但我不确定是否可以选择ECB模式......
I am struggling to find any method of using RSA in ECB mode with PKCS1 padding in python. I've looked into pyCrypto, but they don't have PKCS1 padding in the master branch (but do in a patch). Nevertheless I found RSA with PKCS1 in the M2Crypto package, but I'm not sure if I can choose ECB mode...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
ECB 等链接模式对于 RSA 来说没有任何意义，除非你做错了。
ECB 用于分组密码：输入数据被分割成大小相等的块，并且每个块单独加密。这会带来一些弱点，因此分组密码最好避免 ECB 模式。
RSA 不是分组密码。特别是，RSA 必然会放大加密的消息：使用 1024 位 RSA 密钥（相当典型的大小），可以将消息加密至 117 字节，但结果是 128 字节的值。
人们可以想象接收一条更大的消息，将其分割成长度为 117 字节（或更少）的单独块，并对每个块单独进行 RSA 加密，但没有人这样做，主要是因为大小增加和 CPU 成本。而且，与分裂和重组相关的安全问题根本没有被研究过，因此结果很可能会很弱。通常，当加密库需要填充模式作为算法名称的一部分时，例如在“
RSA/ECB/PKCS1Padding”中，这仅仅是由于名称和链接的语法约束部分 (ECB) 实际上被忽略（例如，这就是 Java 所做的）。在实践中，当加密一些可能大于最大RSA输入大小的数据时，会使用混合加密：RSA加密的是随机对称密钥（例如一堆16个均匀随机字节），并且该密钥用于对称加密（例如使用 AES）实际数据。这更节省空间（因为对称加密不会扩大块）和 CPU 效率（对称加密比非对称加密快得多，特别是 RSA解密）。
Chaining mode such as ECB makes no sense for RSA, unless you are doing it wrong.
ECB is for block ciphers: the input data is split into equal-size blocks, and each block is encrypted separately. This induces some weaknesses so ECB mode is best avoided for block ciphers.
RSA is not a block cipher. In particular, RSA necessarily enlarges the encrypted message: with a 1024-bit RSA key (a fairly typical size), one can encrypt a message up to 117 bytes, but the result is a 128-byte value.
One could imagine taking a larger message, split it into individual blocks of length 117 bytes (or less) and RSA-encrypt each of them individually, but nobody ever does that, mostly because of the size increase, and the CPU cost. Also, security issues related to that splitting and recombining are not studied at all, so it is quite possible that the result would be quite weak. Usually, when a cryptographic library requires a padding mode as part of an algorithm name, such as in "
RSA/ECB/PKCS1Padding", this is only due to the syntaxic constraints on the name, and the chaining part (ECB) is actually ignored (this is what Java does, for instance).In practice, when encrypting some data which may be larger than the maximum RSA input size, hybrid encryption is used: what is RSA-encrypted is a random symmetric key (e.g. a bunch of 16 uniformly random bytes), and that key is used to symmetrically encrypt (e.g. with AES) the actual data. This is more space-effective (because symmetric encryption does not enlarge blocks) and CPU-efficient (symmetric encryption is vastly faster than asymmetric encryption, and in particular RSA decryption).