关于我应该使用的加密方法的建议
好的，所以我需要一些关于我当前项目应该使用哪种加密方法的建议。这里有关此主题的所有问题都与网络以及将加密数据从一台计算机传递到另一台计算机有关。
该系统工作原理的简要总结如下：
我有一些数据以文本格式保存在表格中。然后，我使用一个工具来解析这些数据并将其序列化为 dat 文件。这工作正常，但我需要加密这些数据，因为它将与应用程序一起存储在公共场所。数据不会发送到应用程序简单读取的任何地方。我只需要对其进行加密，这样如果它落入坏人之手，就不可能读取数据。
我正在使用 crypto++ 库进行加密，并且我已经了解到它可以执行大多数类型的加密算法。然而，我注意到大多数算法使用公钥和私钥来加密/解密数据。这意味着我必须将私钥与数据一起存储，这对我来说似乎违反直觉。有什么方法可以在不将私钥与数据一起存储的情况下执行加密？
Ok, so I need some advice on which encryption method I should use for my current project. All the questions about this subject on here are to do with networking and passing encrypted data from one machine to another.
A brief summary of how the system works is:
I have some data that is held in tables that are in text format. I then use a tool to parse this data and serialize it to a dat file. This works fine but I need to encrypt this data as it will be stored with the application in a public place. The data wont be sent anywhere it is simply read by the application. I just need it to be encrypted so that if it were to fall into the wrong hands, it would not be possible to read the data.
I am using the crypto++ library for my encryption and I have read that it can perform most types of encryption algorithms. I have noticed however that most algorithms use a public and private key to encrypt/decrypt the data. This would mean I would have to store the private key with the data which seems counter intuitive to me. Are there any ways that I can perform the encryption without storing a private key with the data?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
我认为没有理由在你的情况下使用非对称加密。根据互联网访问的可用性，我看到了两种不错的解决方案：
当然，如果攻击者有耐心并安装键盘记录器并等到您下次访问文件，那么所有这一切都会失败。一旦您的计算机受到威胁，就无法保护您的数据。
I see no reason to use asymmetric crypto in your case. I see two decent solutions depending on the availability of internet access:
Of course all of this fails if the attacker is patient and installs a keylogger and waits until you access the files the next time. There is no way to secure your data once your machine has been compromised.
简短的回答：别打扰。
长答案：如果您将 .DAT 文件与应用程序一起存储，则还必须将密钥存储在某个地方。最有可能在同一个地方（可能隐藏在代码中）。因此，如果恶意用户想要破解您的加密，他所要做的就是寻找该密钥，仅此而已。使用哪种方法或算法并不重要。即使您没有将解密密钥存储在应用程序中，它最终也会到达那里，并且恶意用户可以在运行时使用调试器捕获它（除非您使用专用的安全内存芯片并在设备上运行具有必要的保护）
也就是说，很多时候，仅仅数据被加密这一事实就足以提供足够的保护，因为数据不值得麻烦。如果这是您的情况 - 那么您可以将密钥嵌入到代码中并使用任何可用的对称算法（AES 将是最佳选择）。
Short answer: don't bother.
Long answer: If you store your .DAT file with the application, you'll have to store the key somewhere too. Most probably in the same place (maybe hidden in the code). So if a malicious user wants to break your encryption all he has to do is to look for that key, and that's it. It doesn't really matter which method or algorithm you use. Even if you don't store the decryption key with the application, it will get there eventually, and the malicious user can catch it with the debugger at run time (unless you're using a dedicated secured memory chip and running on a device that has the necessary protections)
That said, many times the mere fact that the data is encrypted is enough protection because the data is just not worth the trouble. If this is your case - then you can just embed the key in the code and use any symmetric algorithm available (AES would be the best pick).
解决您的问题的常见方法是：
在任何情况下，您都应该检查
如前所述，如果您的数据是由同一个应用程序读取和写入，无论如何，都很难防止恶意用户窃取这些数据。有多种方法可以在代码中隐藏密钥（您可以搜索白盒加密），但它肯定会相当复杂（并且显然不依赖于可以轻松模板化来窃取密钥的简单外部加密库）。
Common way to solve your issue is:
In any case, you should check
As previously said, if your data is read andwritten by same application, in any way, it will be very hard to prevent malicious users to steal these data. There are ways to hide keys in the code (you can search for Whitebox cryptography), but it will be definitely fairly complex (and obviously not relying on a simple external crypto library which can be easily templated to steal the key).
如果您的应用程序可以读取数据并且人们可以访问该应用程序，那么有足够动力和时间的人最终将弄清楚（通过反汇编您的应用程序）如何读取数据。
换句话说，破译加密数据所需的所有信息已经掌握在攻击者手中。在所有与 DRM 相关的设计中都存在消费者 = 攻击者问题，这就是为什么人们可以轻松解密 DVD、蓝光、M4A、加密电子书等……
If your application can read the data and people have access to that application, someone with enough motivation and time will eventually figure out (by disassembling your application) how to read the data.
In other words, all the information that is needed to decipher the encrypted data is already in the hand of the attacker. You have the consumer=attacker problem in all DRM-related designs and this is why people can easily decrypt DVDs, BluRays, M4As, encrypted eBooks, etc etc etc...
当您使用公钥/私钥对时，这称为非对称加密。
您可以使用对称加密算法，这样您只需要一个密钥。
该密钥仍然需要存储在某个地方（可能在可执行文件中）。但如果用户有权访问 .dat，他可能也有权访问 exe。这意味着他仍然可以提取该信息。但如果他有权访问电脑（以及所需的权限），他无论如何都可以从内存中读取所有信息。
您可以要求用户提供密码（也称为密码）并使用它进行对称加密。这样您就不需要在任何地方存储密码。
That is called an asymmetric encryption when you use public/private key pairs.
You could use a symmetric encryption algorithm, that way you would only require one key.
That key will still need to be stored somewhere (it could be in the executable). But if the user has access to the .dat, he probably also has access to the exe. Meaning he could still extract that information. But if he has access to the pc (and the needed rights) he could read all the information from memory anyways.
You could ask the user for a passphrase (aka password) and use that to encrypt symmetrically. This way you don't need to store the passphrase anywhere.