2015-11-12 54 views
0

我有一個字節數組(我們稱之爲加密消息),我是Base64編碼來獲得輸出字符串(我們稱之爲令牌)。稍後,我Base64-解碼這個令牌,以恢復原始的加密消息。多個字符串Base64解碼到相同的字節數組

爲了測試的目的,我嘗試在令牌中注入一個隨機位翻轉來驗證在隨機位翻轉時加密/認證確實失敗。 99%的時間,事實確實如此。 1-3%的時間,這不會發生。我已經調試回到以下行爲:2種不同的標記,兩者在Base64解碼時導致相同的字節數組。

I can understand if this happens for the last character,但在我的情況下,2個標記實際上在中間不同。

發生這種情況的頻率也非常令人費解。假設字節緩衝區中有〜1kB,即使1-2字節僅用於填充並且沒有意義,隨機位翻轉填充字節的機率應該是〜0.1%。我看到這種行爲發生> 1%的時間。

這種行爲是否合理?或者在我的代碼中存在一些更深層次的問題?

問題摘要:在Base64解碼時,2個不同的字符串可能會產生相同的字節數組嗎?對於具有1個隨機位翻轉的1kB緩衝器,1%的時間是否合理?

全部細節

我使用Java的BASE64編碼器/解碼器類下面做的所有操作。

String token = new BASE64Encoder().encode(encryptedMessage); 
... 
byte[] tokenBytes = token.getBytes(); 
int randomIndex = new Random().nextInt(tokenBytes.length); 
int randomBit = 1 << new Random().nextInt(8); 
tokenBytes[randomIndex] ^= randomBit; 
token = new String(tokenBytes) 
.... 
byte[] finalEncryptedMessage = new BASE64Decoder().decodeBuffer(token); 
checkFinalEncryptedMessage!=initialEncryptedMessage 

原始加密的消息(字節陣列):

[52, -11, 14, -3, 10, 92, 65, -46, -54, -25, 117, -126, 15, 2, -72, 123, -119, 111, -115, 114, -11, 48, -6, 47, 72, -47, 117, 76, -17, 82, 98, 23, 124, -99, 92, -45, 92, 48, -116, 20, -90, 52, 94, -25, -116, 7, 112, -51, 20, -2, -66, 126, 11, 117, 81, 33, 27, -116, -46, -115, -64, -7, -83, 78, -113, 85, -106, -70, 46, 35, 42, -51, 118, -40, 40, 99, -29, -78, -117, -34, -65, -49, -18, -98, -84, 79, -115, -42, 93, 55, -115, -71, 6, 8, 106, -11, -5, 12, 11, -61, -9, -31, -114, 112, -119, 31, 37, 125, -9, 82, -53, 90, -43, 77, -53, -114, 118, 9, -68, 93, -48, 116, -116, 54, -82, 6, -52, 64, -66, 54, -34, 51, -3, -83, 49, -79, 81, -88, -122, -113, 6, -102, -11, 60, -128, 12, -105, -66, 4, -80, -2, -106, -73, 117, 55, -14, 96, 96, 107, -41, 16, 10, -83, -60, -88, -25, 49, -30, 19, 48, -85, -65, -70, -90, 0, -43, 100, 7, -106, 77, 70, -8, -87, 16, 108, 49, 102, -91, 41, -31, -45, 101, 61, -11, 108, -23, -117, 16, 52, -30, -46, -106, 78, 114, 64, -31, -82, 40, -109, 97, 61, -54, 50, -70, -106, -82, -21, -14, 78, -93, 101, -68, 107, 22, 18, 115, 3, 125, 44, -106, 126, -109, 8, -90, -81, 118, -34, 98, -111, -73, -67, -39, -51, -85, -104, 41, -37, 31, -29, 26, -114, -88, -116, -89, 27, -36, 74, -99, 101, -13, 76, 126, 1, -32, 59, 80, -102, -93, -92, 30, -49, -87, -28, -70, 88, 16, 117, 37, -49, 56, -6, 106, -74, -60, -71, -72, -91, -81, -9, -122, 53, -126, 28, -16, -126, -14, -24, -89, 19, -17, 20, 110, -25, 73, -74, 67, -65, 78, 103, 107, 116, -63, 84, -113, -114, -114, 24, 66, -6, -74, -71, 126, -112, 68, -37, 117, -88, 92, -13, 39, 18, -44, 92, 97, -84, -111, -118, -13, -73, -60, 69, -43, 74, 38, -89, 82, 74, 33, -41, 73, 87, 12, -114, 0, -48, 80, 1, -79, -53, -19, -4, 60, -8, 108, -85, -54, 104, 36, 77, -6, 30, 78, -104, 120, 33, 85, -87, -86, -57, -102, 97, -111, 43, 29, -63, 103, 101, 57, 64, 124, 53, -43, 118, 103, 107, 77, -97, 81, 90, 90, -102, 28, -57, 26, 18, -26, -21, 92, 36, -83, 22, 57, -33, 112, 1, -46, -23, -51, 121, 68, 45, -89, -25, -42, 103, 30, -113, -120, 36, 0, 19, 60, -28, 15, -63, -8, 97, -117, -69, -86, -55, -114, -89, -78, -5, -60, 86, 41, 117, -85, -38, -106, 2, -126, -107, 89, -93, -72, 20, 11, 48, 117, -57, -52, -9, 29, 54, -28, -13, 95, -100, 62, 107, -126, -22, -110, 40, -14, -110, 22, -10, -107, -87, -8, 45, -117, -3, -59, 22, 68, 92, 97, 48, -47, 90, 72, -13, 116, 50, 86, -44, -106, 95, -30, -89, 6, -69, 77, -64, 98, -110, 40, -59, -60, 58, 58, -11, -83, 81, -59, 65, 56, 105, 94, -2, 110, 73, 125, 46, 42, -52, 68, -28, 25, 97, -111, -98, -51, -50, 43, -31, -92, -88, 99, 26, -81, -62, 104, -117, -87, 70, -75, 26, -68, 18, -35, -4, 92, 79, -63, -24, 42, 34, 96, 63, -78, 58, -52, -71, 79, -121, 81, 65, 69, -24, -23, 55, -49, 10, 11, 33, -2, -8, 105, -95, -15, 6, 66, -121, 13, -124, -21, -103, -30, -56, -72, -44, 61, -67, -24, 96, -81, 20, -38, -21, -93, -35, 25, -105, -116, -15, -3, 71, 77, 0, -108, 85, 63, -114, 82, 31, -28, -61, -116, 74, 9, -1, -88, 67, 92, 14, 1, -90, -55, 105, -31, 5, -91, 123, 105, 2, -44, 71, 31, 8, 6, -68, 5, -35, 66, 112, 120, -38, 48, 85, 67, 89, -103, -43, 29, 120, 16, -4, 53, 72, -36, -56, 9, 42, -32, -98, -24, 66, 70, 54, -112, 73, -59, -124, 4, -51, 84, -120, 1, -18, -70, 66, -85, 27, 127, -85, -19, 117, -91, -63, 94, -46, 97, -35, -105, -84, -81, -118, -81, 107, 63, 65, -109, -36, -49, 111, -8, 77, 57, -91, -49, 2, 93, 103, 71, 48, 38, 28, 102, 9, -13, 25, 121, 95, -75, 69, -74, -18, -112, -122, -59, 17, -26, 81, 123, 54, 56, -127, -92, 32, 12, 86, 103, -84, 39, -18, 78, 100, 62, -78, -56, 84, -65, 80, -78, 102, -9, -48, 73, -98, 118, 74, 116, 39, -103, -127, 33, 48, -6, -48, 10, -69, -11, 118, -51, 1, -56, -59, -48, 103, -105, -109, -29, -100, 77, 66, 4, -85, -93, 46, -64, 61, -57, -111, -29, 89, -25, 126, -89, 65, -32, 33, -65, -70, 36, -19, -18, -79, 88, -79, 20, -91, -71, 13, -114, -44, 68, -14, -48, 106, -46, 105, 126, -6, -72, 113, -117, -46, 9, 27, -55, 113, 19, -69, -15, 36, -117, -90, 35, 122, 64, -108, -56] 

原始令牌(上述的Base64編碼後):

NPUO/QpcQdLK53WCDwK4e4lvjXL1MPovSNF1TO9SYhd8nVzTXDCMFKY0XueMB3DNFP6+fgt1USEb 
jNKNwPmtTo9VlrouIyrNdtgoY+Oyi96/z+6erE+N1l03jbkGCGr1+wwLw/fhjnCJHyV991LLWtVN 
y452Cbxd0HSMNq4GzEC+Nt4z/a0xsVGoho8GmvU8gAyXvgSw/pa3dTfyYGBr1xAKrcSo5zHiEzCr 
v7qmANVkB5ZNRvipEGwxZqUp4dNlPfVs6YsQNOLSlk5yQOGuKJNhPcoyupau6/JOo2W8axYScwN9 
LJZ+kwimr3beYpG3vdnNq5gp2x/jGo6ojKcb3EqdZfNMfgHgO1Cao6Qez6nkulgQdSXPOPpqtsS5 
uKWv94Y1ghzwgvLopxPvFG7nSbZDv05na3TBVI+OjhhC+ra5fpBE23WoXPMnEtRcYayRivO3xEXV 
SianUkoh10lXDI4A0FABscvt/Dz4bKvKaCRN+h5OmHghVamqx5phkSsdwWdlOUB8NdV2Z2tNn1Fa 
WpocxxoS5utcJK0WOd9wAdLpzXlELafn1mcej4gkABM85A/B+GGLu6rJjqey+8RWKXWr2pYCgpVZ 
o7gUCzB1x8z3HTbk81+cPmuC6pIo8pIW9pWp+C2L/cUWRFxhMNFaSPN0MlbUll/ipwa7TcBikijF 
xDo69a1RxUE4aV7+bkl9LirMROQZYZGezc4r4aSoYxqvwmiLqUa1GrwS3fxcT8HoKiJgP7I6zLlP 
h1FBRejpN88KCyH++Gmh8QZChw2E65niyLjUPb3oYK8U2uuj3RmXjPH9R00AlFU/jlIf5MOMSgn/ 
qENcDgGmyWnhBaV7aQLURx8IBrwF3UJweNowVUNZmdUdeBD8NUjcyAkq4J7oQkY2kEnFhATNVIgB 
7rpCqxt/q+11pcFe0mHdl6yviq9rP0GT3M9v+E05pc8CXWdHMCYcZgnzGXlftUW27pCGxRHmUXs2 
OIGkIAxWZ6wn7k5kPrLIVL9Qsmb30Emedkp0J5mBITD60Aq79XbNAcjF0GeXk+OcTUIEq6MuwD3H 
keNZ536nQeAhv7ok7e6xWLEUpbkNjtRE8tBq0ml++rhxi9IJG8lxE7vxJIumI3pAlMg= 

損壞令牌(見第7行位翻轉/替換爲?)

NPUO/QpcQdLK53WCDwK4e4lvjXL1MPovSNF1TO9SYhd8nVzTXDCMFKY0XueMB3DNFP6+fgt1USEb 
jNKNwPmtTo9VlrouIyrNdtgoY+Oyi96/z+6erE+N1l03jbkGCGr1+wwLw/fhjnCJHyV991LLWtVN 
y452Cbxd0HSMNq4GzEC+Nt4z/a0xsVGoho8GmvU8gAyXvgSw/pa3dTfyYGBr1xAKrcSo5zHiEzCr 
v7qmANVkB5ZNRvipEGwxZqUp4dNlPfVs6YsQNOLSlk5yQOGuKJNhPcoyupau6/JOo2W8axYScwN9 
LJZ+kwimr3beYpG3vdnNq5gp2x/jGo6ojKcb3EqdZfNMfgHgO1Cao6Qez6nkulgQdSXPOPpqtsS5 
uKWv94Y1ghzwgvLopxPvFG7nSbZDv05na3TBVI+OjhhC+ra5fpBE23WoXPMnEtRcYayRivO3xEXV 
SianUkoh10lXDI4A0FABscvt?Dz4bKvKaCRN+h5OmHghVamqx5phkSsdwWdlOUB8NdV2Z2tNn1Fa 
WpocxxoS5utcJK0WOd9wAdLpzXlELafn1mcej4gkABM85A/B+GGLu6rJjqey+8RWKXWr2pYCgpVZ 
o7gUCzB1x8z3HTbk81+cPmuC6pIo8pIW9pWp+C2L/cUWRFxhMNFaSPN0MlbUll/ipwa7TcBikijF 
xDo69a1RxUE4aV7+bkl9LirMROQZYZGezc4r4aSoYxqvwmiLqUa1GrwS3fxcT8HoKiJgP7I6zLlP 
h1FBRejpN88KCyH++Gmh8QZChw2E65niyLjUPb3oYK8U2uuj3RmXjPH9R00AlFU/jlIf5MOMSgn/ 
qENcDgGmyWnhBaV7aQLURx8IBrwF3UJweNowVUNZmdUdeBD8NUjcyAkq4J7oQkY2kEnFhATNVIgB 
7rpCqxt/q+11pcFe0mHdl6yviq9rP0GT3M9v+E05pc8CXWdHMCYcZgnzGXlftUW27pCGxRHmUXs2 
OIGkIAxWZ6wn7k5kPrLIVL9Qsmb30Emedkp0J5mBITD60Aq79XbNAcjF0GeXk+OcTUIEq6MuwD3H 
keNZ536nQeAhv7ok7e6xWLEUpbkNjtRE8tBq0ml++rhxi9IJG8lxE7vxJIumI3pAlMg= 

Final加密後的消息,在Base64解碼完之後:

[52, -11, 14, -3, 10, 92, 65, -46, -54, -25, 117, -126, 15, 2, -72, 123, -119, 111, -115, 114, -11, 48, -6, 47, 72, -47, 117, 76, -17, 82, 98, 23, 124, -99, 92, -45, 92, 48, -116, 20, -90, 52, 94, -25, -116, 7, 112, -51, 20, -2, -66, 126, 11, 117, 81, 33, 27, -116, -46, -115, -64, -7, -83, 78, -113, 85, -106, -70, 46, 35, 42, -51, 118, -40, 40, 99, -29, -78, -117, -34, -65, -49, -18, -98, -84, 79, -115, -42, 93, 55, -115, -71, 6, 8, 106, -11, -5, 12, 11, -61, -9, -31, -114, 112, -119, 31, 37, 125, -9, 82, -53, 90, -43, 77, -53, -114, 118, 9, -68, 93, -48, 116, -116, 54, -82, 6, -52, 64, -66, 54, -34, 51, -3, -83, 49, -79, 81, -88, -122, -113, 6, -102, -11, 60, -128, 12, -105, -66, 4, -80, -2, -106, -73, 117, 55, -14, 96, 96, 107, -41, 16, 10, -83, -60, -88, -25, 49, -30, 19, 48, -85, -65, -70, -90, 0, -43, 100, 7, -106, 77, 70, -8, -87, 16, 108, 49, 102, -91, 41, -31, -45, 101, 61, -11, 108, -23, -117, 16, 52, -30, -46, -106, 78, 114, 64, -31, -82, 40, -109, 97, 61, -54, 50, -70, -106, -82, -21, -14, 78, -93, 101, -68, 107, 22, 18, 115, 3, 125, 44, -106, 126, -109, 8, -90, -81, 118, -34, 98, -111, -73, -67, -39, -51, -85, -104, 41, -37, 31, -29, 26, -114, -88, -116, -89, 27, -36, 74, -99, 101, -13, 76, 126, 1, -32, 59, 80, -102, -93, -92, 30, -49, -87, -28, -70, 88, 16, 117, 37, -49, 56, -6, 106, -74, -60, -71, -72, -91, -81, -9, -122, 53, -126, 28, -16, -126, -14, -24, -89, 19, -17, 20, 110, -25, 73, -74, 67, -65, 78, 103, 107, 116, -63, 84, -113, -114, -114, 24, 66, -6, -74, -71, 126, -112, 68, -37, 117, -88, 92, -13, 39, 18, -44, 92, 97, -84, -111, -118, -13, -73, -60, 69, -43, 74, 38, -89, 82, 74, 33, -41, 73, 87, 12, -114, 0, -48, 80, 1, -79, -53, -19, -4, 60, -8, 108, -85, -54, 104, 36, 77, -6, 30, 78, -104, 120, 33, 85, -87, -86, -57, -102, 97, -111, 43, 29, -63, 103, 101, 57, 64, 124, 53, -43, 118, 103, 107, 77, -97, 81, 90, 90, -102, 28, -57, 26, 18, -26, -21, 92, 36, -83, 22, 57, -33, 112, 1, -46, -23, -51, 121, 68, 45, -89, -25, -42, 103, 30, -113, -120, 36, 0, 19, 60, -28, 15, -63, -8, 97, -117, -69, -86, -55, -114, -89, -78, -5, -60, 86, 41, 117, -85, -38, -106, 2, -126, -107, 89, -93, -72, 20, 11, 48, 117, -57, -52, -9, 29, 54, -28, -13, 95, -100, 62, 107, -126, -22, -110, 40, -14, -110, 22, -10, -107, -87, -8, 45, -117, -3, -59, 22, 68, 92, 97, 48, -47, 90, 72, -13, 116, 50, 86, -44, -106, 95, -30, -89, 6, -69, 77, -64, 98, -110, 40, -59, -60, 58, 58, -11, -83, 81, -59, 65, 56, 105, 94, -2, 110, 73, 125, 46, 42, -52, 68, -28, 25, 97, -111, -98, -51, -50, 43, -31, -92, -88, 99, 26, -81, -62, 104, -117, -87, 70, -75, 26, -68, 18, -35, -4, 92, 79, -63, -24, 42, 34, 96, 63, -78, 58, -52, -71, 79, -121, 81, 65, 69, -24, -23, 55, -49, 10, 11, 33, -2, -8, 105, -95, -15, 6, 66, -121, 13, -124, -21, -103, -30, -56, -72, -44, 61, -67, -24, 96, -81, 20, -38, -21, -93, -35, 25, -105, -116, -15, -3, 71, 77, 0, -108, 85, 63, -114, 82, 31, -28, -61, -116, 74, 9, -1, -88, 67, 92, 14, 1, -90, -55, 105, -31, 5, -91, 123, 105, 2, -44, 71, 31, 8, 6, -68, 5, -35, 66, 112, 120, -38, 48, 85, 67, 89, -103, -43, 29, 120, 16, -4, 53, 72, -36, -56, 9, 42, -32, -98, -24, 66, 70, 54, -112, 73, -59, -124, 4, -51, 84, -120, 1, -18, -70, 66, -85, 27, 127, -85, -19, 117, -91, -63, 94, -46, 97, -35, -105, -84, -81, -118, -81, 107, 63, 65, -109, -36, -49, 111, -8, 77, 57, -91, -49, 2, 93, 103, 71, 48, 38, 28, 102, 9, -13, 25, 121, 95, -75, 69, -74, -18, -112, -122, -59, 17, -26, 81, 123, 54, 56, -127, -92, 32, 12, 86, 103, -84, 39, -18, 78, 100, 62, -78, -56, 84, -65, 80, -78, 102, -9, -48, 73, -98, 118, 74, 116, 39, -103, -127, 33, 48, -6, -48, 10, -69, -11, 118, -51, 1, -56, -59, -48, 103, -105, -109, -29, -100, 77, 66, 4, -85, -93, 46, -64, 61, -57, -111, -29, 89, -25, 126, -89, 65, -32, 33, -65, -70, 36, -19, -18, -79, 88, -79, 20, -91, -71, 13, -114, -44, 68, -14, -48, 106, -46, 105, 126, -6, -72, 113, -117, -46, 9, 27, -55, 113, 19, -69, -15, 36, -117, -90, 35, 122, 64, -108, -56] 
+0

你有什麼認證?你期望發生什麼?加密「失敗」時究竟發生了什麼? –

+0

@JamesKPolk感謝您的關注。我想避免陷入關於加密的討論中,因爲這不是我的問題所在。它純粹是關於Base64編碼/解碼。如果我必須在一行中總結我的問題:*在Base64解碼時,是否有可能產生2個不同的字符串,它們在中間有1位翻轉不同,以產生相同的字節數組?對於具有1個隨機位翻轉的1kB緩衝器,這是否合理的發生在1%的時間?* – RvPr

+0

base64編碼是一對一的。更改任何字符可保證在解碼時生成不同的字節數組。 –

回答

1

您已將該字符更改爲無效的base64字符。因此結果將是解碼器特定的。

您的測試表明,一些base64解碼器處理無效的base64字符比其他人更好。最好的解決方案是使用Base64解碼器,並記錄下符合您期望的錯誤行爲。Java 8中有兩個,第一個是在Java 8中推出的java.util.Base64,第二個是javax.xml.bind.DatatypeConverter中的一些方法,這些方法至少在Java 6以後就已經出現了。還有其他類,例如描述a nice page的iHarder base64類它和其他base64解碼器,以及Apache Commons Codec中的base64解碼器。

請注意,上面提供的一些庫在解碼無效的Base64字符時也不會引發異常。這是我通過對不同的Base64庫進行實驗而發現的。最後,我通過明確檢查是否我的位翻轉產生了Base64字符來解決問題。如果沒有,我解開了位並翻轉了一下新的位。

1

簡短答案是「否」。

任何字節流B只有一個base64編碼E.編碼流E是解碼爲字節流B的唯一有效字節流。這正是B64的工作方式。

您的示例中發生的情況是,您將字符串中的字符更改爲標準base64中的某個字符。解碼器如何處理這將是特定於實現的。