dpj997991 2018-04-05 17:19
浏览 299

RSA OAEP,Golang加密,Java Decrypt -BadPaddingException:解密错误

I'm trying to decrypt a string which is encrypted in Golang using RSA-OAEP. but getting BadPaddingException: Decryption error. Having hard time to figure out what am I missing..

Here is the Golang encrypt method

func encryptString() {
rootPEM := io_related.ReadFile("../../resources/pubkey.pem")
    //fmt.Printf("Cert String %q 
", rootPEM)

    block, _ := pem.Decode([]byte(rootPEM))
    var cert *x509.Certificate
    cert, _ = x509.ParseCertificate(block.Bytes)
    rsaPublicKey := cert.PublicKey.(*rsa.PublicKey)

    secretMessage := []byte("password")
    label := []byte("")

    // crypto/rand.Reader is a good source of entropy for randomizing the
    // encryption function.
    rng := rand.Reader

    ciphertext, err := rsa.EncryptOAEP(sha256.New(), rng, rsaPublicKey, secretMessage, label)
    if err != nil {
        fmt.Fprintf(os.Stderr, "Error from encryption: %s
", err)

    // Since encryption is a randomized function, ciphertext will be
    // different each time.

    base64EncodedString := base64.StdEncoding.EncodeToString(ciphertext)

and my java decrypt method as

public void decryptString(String base64String) throws NoSuchAlgorithmException, CertificateException, IOException, KeyStoreException, UnrecoverableKeyException, NoSuchPaddingException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException{
        FileInputStream is = new FileInputStream("priv.p12");
        KeyStore keystore = KeyStore.getInstance("PKCS12");
        keystore.load(is, "".toCharArray());
        System.out.println("Successfully loaded");

        String keyAlias = "1";

        PrivateKey key = (PrivateKey)keystore.getKey(keyAlias, "".toCharArray());

        System.out.println("key "+Base64.encodeBase64String(key.getEncoded()));
        Cipher rsaDecryptCipher;
        rsaDecryptCipher = Cipher.getInstance("RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING");
        rsaDecryptCipher.init(Cipher.DECRYPT_MODE, key);
        final byte[] plainText = rsaDecryptCipher.doFinal(Base64.decodeBase64(base64String));

        System.out.println("Plain   : " + new String(plainText));

  1. I made sure I'm using the same key pair and not a different private key
  2. Made sure hash algorithm used same in both encrypt and decrypt "SHA256"

I might be missing something, Please let me know if anyone need more details. Appreciate the help!!. Thanks

  • 写回答

1条回答 默认 最新

  • dsjpqpdm620596 2018-04-05 23:46

    OAEP uses two hash algorithms: one on the label (fka parameters) and one within the Mask Generation Function (MGF1); these can be different. See 7.1.1 and B.2.1 in rfc8017.

    I don't know whether that Go code sets one (and which) or both, but what Java does with that getInstance varies depending on which provider you are using, which in turn depends at least partly on what implementation of Java you are using. The SunJCE provider configured by default in Sun/Oracle and OpenJDK implementations changes only the label hash, keeping MGF1 at SHA1; the BouncyCastle provider changes both. I don't know what IBM and Android do here.

    Once you determine (or guess) what Go is doing you can match it by adding to your .init call an appropriate OAEPParameterSpec and related MGF1ParameterSpec.

    Mostly dupe OAEPwithMD5andMGF1Padding in node-rsa
    (copied at https://security.stackexchange.com/questions/97548/breaking-down-rsa-ecb-oaepwithsha-256andmgf1padding )

    本回答被题主选为最佳回答 , 对您是否有帮助呢?



  • ¥50 基于TwinCAT3实现力传感器的实时读取
  • ¥20 python求解八元一次不定方程,无数解中随机输出几组即可(相关搜索:用python)
  • ¥50 libreoffice导出PPTX到PDF中的错误换行问题
  • ¥15 python实现网页视频下载
  • ¥15 如何通过深度图获得物体的完整、正确点云?
  • ¥15 有没有操作系统适用白丁的经典的书籍,如何解决?(标签-学习)
  • ¥15 Catia V5 R20 64位 安装过程中选择orbix配置创建套接字失败
  • ¥100 C51单片机设计交通灯时出现的问题
  • ¥15 R语言爬虫的时候元素和园代码不一样怎么解决呀
  • ¥15 SQL删除添加数据后序号不连续问题。