客户端/服务器密码加密
我正在用 C++ 构建客户端/服务器应用程序，并需要每个客户端提供密码。显然，我希望它在传输过程中是安全的，所以我一直在研究一种加密密码的方法；这样只有服务器应用程序才能再次解密。
我遇到的问题不一定是让函数正常工作，而是理解我需要做什么才能将其关联到代码中。我正在尝试理解并阅读了 MSDN（感觉很像），但我仍然只是在学习，所以确实需要一些关于我的实施的清晰而准确的指导。
这听起来对吗？
- 我在服务器和客户端上获取 CSP 的上下文。
- 我在服务器上生成一个密钥，或者加载一个密钥（无论如何）。
然后我
从服务器导出公钥并发送给客户端，客户端导入密钥然后加密密码并返回，这样只有服务器才能再次解密。 （当我尝试时失败）。
或者，然后我是否
导出会话密钥或使用交换密钥对加密的交换密钥对（单个公共）？
哦，我很迷茫，我什至无法解释清楚。
请帮助我理解这一点......
I am building a client/server application in C++ and need each client to provide a password. Obviously I want this to be secure during transport so I have been looking into a way of encrypting the password; so that only the server application can decrypt it again.
The problem I am having is not necessarily getting the functions to work, but rather understanding what it is I need to do in order to relate that into code. I am trying to understand and have read MSDN (feels like it) but still I am only learning so really need some clear and accurate guidance on my implementation.
Does this sound right?
- I aquire a context to the CSP on both server and client.
- I generate a key on the server, or load one (whatever).
and then I
export a public key from the server and send it to the client, the client imports the key and then encrypts the password and returns it so that only the server can decrypt it again.
(Fails when I try).
OR, do I then
export a session key, or an exchange key pair ( single public) which is encrypted with the exchange key pair?
Oh I am so lost, I cannot even explain clearly.
Please help me to understand this...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这实际上取决于您想要基于哪种身份验证解决方案。选项多种多样。
例如，您可以依赖底层操作系统身份验证。您根本不需要管理密码。但这需要与应用程序运行所在的域进行更紧密的集成。
另一种选择是使用 HTTPS 和简单身份验证。它基本上使用 SSL 来加密通信，然后发送用户名/密码对。非常简单，并且所有网络服务器都支持。如果您不想依赖现有的 Web 服务器（例如正在安装的 IIS），您可能可以很容易地找到 C++ 代码来为您解决这个问题（在 StackOverflow 中搜索此类问题）。
It really depends on what sort of authentication solution you want to be based one. The options are varied.
You could, for example, rely on the underlying OS authentication. You wouldn't need to manage passwords at all. But this requires a somewhat tighter integration with the domain in which your application is running.
Another option is to use HTTPS and simple authentication. It basically uses SSL to encrypt communication and then sends a username/password pair. Pretty simple, and supported by all web servers. You could probably find C++ code quite easily that takes care of this for you (search StackOverflow for such a question) if you don't want to rely on an existing web server like IIS being installed.
如果您不需要加密通信来进行其他事情（例如数据传输），您可以使用挑战-响应 用于密码验证。密码不需要通过网络传输，并且不存在第三方仅重新发送一些数据包的重放攻击的风险。不利的一面是，中间人 (MITM) 攻击是可能的。
如果您需要防范 MITM 或需要加密通道进行其他通信，则应使用带有证书的 TLS 或带有两个密钥对的公钥加密。
If you do not need the encrypted Communication for other things like data transfer, you can use Challenge-Response for password verification. The Password does not need to be transferred over the network and there is no risk of a replay attack in wich a third party just resends some packets. On the downside, a man in the middle (MITM) attack is possible.
If you need protection from MITM or need an encrypted channel for other communication, you should use TLS with certificates or Public-Key-Encryption with two keypairs.
不要做任何事情。
这非常重要。不要自己实现这个。
重复一遍，不要做任何事情，否则会出错。
您应该使用已经可用的东西。只需打开与 SSL 套接字的连接，流的内容将在另一端自动加密和解密。
您的应用程序应该简单地采用用户名/密码元组并验证它们是否正确。不要尝试实现加密部分。
Do not do anything.
This is very important. Do not implement this yourself.
Repeat do not do anything you will get it wrong.
You should use what is already available. Simply open a connection to an SSL socket and the content of the stream will be automatically encrypted and de-crypted at the other end.
Your application should simply take a username/password tupple and validate if they are correct. Do not attempt to implement the cryptographic part.