首页 > 后端开发 > Golang > 现实世界的加密魔法:让 Go 的加密包发挥作用,Go Crypto 13

现实世界的加密魔法:让 Go 的加密包发挥作用,Go Crypto 13

DDD
发布: 2024-12-31 11:06:11
原创
371 人浏览过

Real-World Crypto Magic: Putting Go

嘿,加密向导!准备好用 Go 的加密包来看看现实世界的魔法了吗?我们已经学习了所有这些很酷的加密咒语,现在让我们将它们用于一些实际的魔法中!我们将创建两个强大的神器:安全文件加密咒语和公钥基础设施 (PKI) 召唤仪式。

魔法#1:安全文件加密咒语

让我们创建一个神奇的卷轴,可以使用强大的 AES-GCM(伽罗瓦/计数器模式)魔法安全地加密和解密文件。此咒语提供保密性和完整性保护!

package main

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "errors"
    "fmt"
    "io"
    "os"
)

// Our encryption spell
func encrypt(plaintext []byte, key []byte) ([]byte, error) {
    block, err := aes.NewCipher(key)
    if err != nil {
        return nil, err
    }

    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return nil, err
    }

    nonce := make([]byte, gcm.NonceSize())
    if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
        return nil, err
    }

    return gcm.Seal(nonce, nonce, plaintext, nil), nil
}

// Our decryption counter-spell
func decrypt(ciphertext []byte, key []byte) ([]byte, error) {
    block, err := aes.NewCipher(key)
    if err != nil {
        return nil, err
    }

    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return nil, err
    }

    if len(ciphertext) < gcm.NonceSize() {
        return nil, errors.New("ciphertext too short")
    }

    nonce, ciphertext := ciphertext[:gcm.NonceSize()], ciphertext[gcm.NonceSize():]
    return gcm.Open(nil, nonce, ciphertext, nil)
}

// Enchant a file with our encryption spell
func encryptFile(inputFile, outputFile string, key []byte) error {
    plaintext, err := os.ReadFile(inputFile)
    if err != nil {
        return err
    }

    ciphertext, err := encrypt(plaintext, key)
    if err != nil {
        return err
    }

    return os.WriteFile(outputFile, ciphertext, 0644)
}

// Remove the encryption enchantment from a file
func decryptFile(inputFile, outputFile string, key []byte) error {
    ciphertext, err := os.ReadFile(inputFile)
    if err != nil {
        return err
    }

    plaintext, err := decrypt(ciphertext, key)
    if err != nil {
        return err
    }

    return os.WriteFile(outputFile, plaintext, 0644)
}

func main() {
    // Summon a magical key
    key := make([]byte, 32) // AES-256
    if _, err := rand.Read(key); err != nil {
        panic("Our magical key summoning failed!")
    }

    // Cast our encryption spell
    err := encryptFile("secret_scroll.txt", "encrypted_scroll.bin", key)
    if err != nil {
        panic("Our encryption spell fizzled!")
    }
    fmt.Println("Scroll successfully enchanted with secrecy!")

    // Remove the encryption enchantment
    err = decryptFile("encrypted_scroll.bin", "decrypted_scroll.txt", key)
    if err != nil {
        panic("Our decryption counter-spell backfired!")
    }
    fmt.Println("Scroll successfully disenchanted!")
}
登录后复制

这个神奇的卷轴演示了使用 AES-GCM 的安全文件加密。它包括防止魔法事故(错误处理)、安全调用随机数的随机数以及适当的魔法密钥管理实践。

结界#2:PKI 召唤仪式

现在,让我们执行一个更复杂的仪式来调用基本的公钥基础设施 (PKI) 系统。该系统可以生成神奇的证书,用证书颁发机构(CA)对其进行签名,并验证这些神秘的文件。

package main

import (
    "crypto/ecdsa"
    "crypto/elliptic"
    "crypto/rand"
    "crypto/x509"
    "crypto/x509/pkix"
    "encoding/pem"
    "fmt"
    "math/big"
    "os"
    "time"
)

// Summon a magical key pair
func generateKey() (*ecdsa.PrivateKey, error) {
    return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
}

// Create a mystical certificate
func createCertificate(template, parent *x509.Certificate, pub interface{}, priv interface{}) (*x509.Certificate, []byte, error) {
    certDER, err := x509.CreateCertificate(rand.Reader, template, parent, pub, priv)
    if err != nil {
        return nil, nil, err
    }

    cert, err := x509.ParseCertificate(certDER)
    if err != nil {
        return nil, nil, err
    }

    return cert, certDER, nil
}

// Summon a Certificate Authority
func generateCA() (*x509.Certificate, *ecdsa.PrivateKey, error) {
    caPrivKey, err := generateKey()
    if err != nil {
        return nil, nil, err
    }

    template := x509.Certificate{
        SerialNumber: big.NewInt(1),
        Subject: pkix.Name{
            Organization: []string{"Wizards' Council"},
        },
        NotBefore:             time.Now(),
        NotAfter:              time.Now().AddDate(10, 0, 0),
        KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
        ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
        BasicConstraintsValid: true,
        IsCA:                  true,
    }

    caCert, _, err := createCertificate(&template, &template, &caPrivKey.PublicKey, caPrivKey)
    if err != nil {
        return nil, nil, err
    }

    return caCert, caPrivKey, nil
}

// Generate a certificate for a magical domain
func generateCertificate(caCert *x509.Certificate, caPrivKey *ecdsa.PrivateKey, domain string) (*x509.Certificate, *ecdsa.PrivateKey, error) {
    certPrivKey, err := generateKey()
    if err != nil {
        return nil, nil, err
    }

    template := x509.Certificate{
        SerialNumber: big.NewInt(2),
        Subject: pkix.Name{
            Organization: []string{"Wizards' Guild"},
            CommonName:   domain,
        },
        NotBefore:   time.Now(),
        NotAfter:    time.Now().AddDate(1, 0, 0),
        KeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
        ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
        DNSNames:    []string{domain},
    }

    cert, _, err := createCertificate(&template, caCert, &certPrivKey.PublicKey, caPrivKey)
    if err != nil {
        return nil, nil, err
    }

    return cert, certPrivKey, nil
}

// Inscribe a certificate onto a magical parchment (PEM)
func saveCertificateToPEM(cert *x509.Certificate, filename string) error {
    certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
    return os.WriteFile(filename, certPEM, 0644)
}

// Inscribe a private key onto a magical parchment (PEM)
func savePrivateKeyToPEM(privKey *ecdsa.PrivateKey, filename string) error {
    privKeyBytes, err := x509.MarshalECPrivateKey(privKey)
    if err != nil {
        return err
    }
    privKeyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: privKeyBytes})
    return os.WriteFile(filename, privKeyPEM, 0600)
}

func main() {
    // Summon the Certificate Authority
    caCert, caPrivKey, err := generateCA()
    if err != nil {
        panic("The CA summoning ritual failed!")
    }

    // Inscribe the CA certificate and private key
    err = saveCertificateToPEM(caCert, "ca_cert.pem")
    if err != nil {
        panic("Failed to inscribe the CA certificate!")
    }
    err = savePrivateKeyToPEM(caPrivKey, "ca_key.pem")
    if err != nil {
        panic("Failed to inscribe the CA private key!")
    }

    // Generate a certificate for a magical domain
    domain := "hogwarts.edu"
    cert, privKey, err := generateCertificate(caCert, caPrivKey, domain)
    if err != nil {
        panic("The domain certificate summoning failed!")
    }

    // Inscribe the domain certificate and private key
    err = saveCertificateToPEM(cert, "domain_cert.pem")
    if err != nil {
        panic("Failed to inscribe the domain certificate!")
    }
    err = savePrivateKeyToPEM(privKey, "domain_key.pem")
    if err != nil {
        panic("Failed to inscribe the domain private key!")
    }

    fmt.Println("The PKI summoning ritual was successful! CA and domain certificates have been manifested.")
}
登录后复制

这个神秘的仪式演示了一个简单的 PKI 系统的创建,包括:

  1. 调用证书颁发机构 (CA)
  2. 使用 CA 为域证书加持其神奇的签名
  3. 将证书和私钥刻在神奇的羊皮纸上(PEM 格式)

这些示例展示了 Go 加密包的实际应用,展示了安全文件加密和基本的 PKI 系统。它们融合了我们讨论过的许多最佳实践和概念,例如正确的密钥管理、安全随机数生成以及现代加密算法的使用。

请记住,年轻的巫师,在现实世界中实施这些加密系统时,请始终确保您的咒语经过其他大师巫师的彻底审查和测试。对于最关键的魔法组件,请尽可能考虑使用已建立的魔法书(库)。

现在就出去负责任地施展你的加密咒语吧!愿您的秘密始终保密,您的身份始终得到验证!

以上是现实世界的加密魔法:让 Go 的加密包发挥作用,Go Crypto 13的详细内容。更多信息请关注PHP中文网其他相关文章!

来源:dev.to
本站声明
本文内容由网友自发贡献,版权归原作者所有,本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容,请联系admin@php.cn
热门教程
更多>
最新下载
更多>
网站特效
网站源码
网站素材
前端模板