敏感信息AES加密

@@ -5,31 +5,48 @@ from flask_sqlalchemy import SQLAlchemy
 import glob
 import traceback
 from pyDes import des, PAD_PKCS5, ECB
-
+import json
 import base64
-from gmssl import sm3, func, sm2
+from gmssl import sm3, func
+from Crypto.Cipher import AES
+from Crypto.Util.Padding import unpad, pad
+from cryptography.hazmat.primitives import padding
+from cryptography.hazmat.primitives.ciphers import algorithms
+from binascii import b2a_hex, a2b_hex
 
 
-class SM3():
+class AESHelper():
+    key = 'w03MyIgc3zMHM5Qe'.encode('utf-8')
+    iv = '8765432187654321'.encode('utf-8')
+
     @classmethod
-    def encode(self, data=""):
-        by_str = bytes(data, 'utf-8')
-        result = (sm3.sm3_hash(func.bytes_to_list(by_str)))
-        return result
+    def encode(self, instr):
+        plaintxt = self._pad(instr)
+        aes = AES.new(self.key, AES.MODE_CBC, self.iv)
+        ciphertext = aes.encrypt(plaintxt)
+        return b2a_hex(ciphertext).decode('utf-8')
 
+    @classmethod
+    def decode(self, instr):
+        encryptedData = instr
+        aes = AES.new(self.key, AES.MODE_CBC, self.iv)
+        plaintxt = aes.decrypt(a2b_hex(encryptedData))
+        return  bytes.decode(unpad(plaintxt, AES.block_size))
 
-class SM2():
-    privatekey = "EOpBYj1pH54b8BsAlkON71Q2c2FXEm+VTPNCgxz4+gVZ2C/pF/Bv152Qj3QH7cBRCUlNeO5SkI02DcwTASmVwESzR4F9IbMvUNxkDngINdcwaSWCTaaRTstNd4FIlJ0CqhDl/TPHFuBoRNBgUDfPJFfl7XYHs4VmOcrp02aXv8Q="
-    publickey = "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEsENe/8Sft6rK0h59t2a/6Pf4nzvxvJzc1SzalZe1xSDtUqW/10E/e+RjRbvykyjKzu3vAY1lwv9aU2Tnp6+isw=="
-    sm2_crypt = sm2.CryptSM2(public_key=publickey, private_key=privatekey)
+    def _pad(data):
+        if not isinstance(data, bytes):
+            data = data.encode()
+        padder = padding.PKCS7(algorithms.AES.block_size).padder()
+        padded_data = padder.update(data)+padder.finalize()
+        return padded_data
 
-    @classmethod
-    def decode(self, ciphertxt):
-        return self.sm2_crypt.decrypt(ciphertxt)
 
+class SM3():
     @classmethod
-    def encode(self, plaintxt):
-        return self.sm2_crypt.encrypt(plaintxt)
+    def encode(self, data=""):
+        by_str = bytes(data, 'utf-8')
+        result = sm3.sm3_hash(func.bytes_to_list(by_str))
+        return result
 
 
 class DES():

 from enum import auto
 from logging import error
+from unittest import result
 from flasgger import swag_from
 from app.util import BlueprintApi
 from app.util import BlueprintApi
 from flask import Blueprint, render_template, redirect, request, session, jsonify
 from .models import *
-from .oauth2 import authorization, generate_user_info,require_oauth
+from .oauth2 import authorization, generate_user_info, require_oauth
 from authlib.oauth2 import OAuth2Error
 from authlib.integrations.flask_oauth2 import current_token
 from . import user_create, client_create, client_query, user_query, user_update, user_delete
 import configure
 from app.decorators.auth_decorator import auth_decorator
 import time
-from app.models import SM3
+from app.models import SM3, AESHelper
+
 
 def current_user():
     if "id" in session:
@@ -71,8 +73,6 @@ class DataManager(BlueprintApi):
             return jsonify(dict(error.get_body()))
         return render_template("auth/authorize.html", user=user, grant=grant, error=error)
 
-       
-
     @staticmethod
     @bp.route("/token", methods=["POST"])
     def issue_token():
@@ -105,8 +105,7 @@ class DataManager(BlueprintApi):
         except OAuth2Error as error:
             return jsonify(dict(error.get_body()))
         return redirect(url)
-       
-       
+
     """接口"""
     @staticmethod
     @bp.route("/users", methods=["GET"])
@@ -165,7 +164,7 @@ class DataManager(BlueprintApi):
         获取client列表
         """
         return client_query.Api().result
-    
+
     @staticmethod
     @bp.route("/init", methods=["GET"])
     def init():
@@ -183,3 +182,11 @@ class DataManager(BlueprintApi):
         else:
             return "默认用户已存在"
 
+    @staticmethod
+    @bp.route("/test", methods=["GET"])
+    def test():
+        result = 'c78ca1de8139e62c99d4c4d2050ddd16'
+        result = AESHelper.encode('dataman2')
+        # result=DES.decode('U2FsdGVkX199Ncuh7+0/HVmonwM9Uz7SYnmF73wtW7c=')
+        result2 = AESHelper.decode(result)
+        return result2

@@ -7,6 +7,7 @@ from .models import *
 from app.util.component.ApiTemplate import ApiTemplate
 import time
 from app.models import SM3
+from app.models import AESHelper
 
 
 class Api(ApiTemplate):
@@ -27,13 +28,13 @@ class Api(ApiTemplate):
         res["result"] = False
         try:
             # 业务逻辑
-            username = self.para.get("username")
-            password = SM3.encode(self.para.get("pwd"))
-            role = self.para.get("role")
-            company = self.para.get("company", None)
-            position = self.para.get("position", None)
-            email = self.para.get("email", None)
-            phone = self.para.get("phone", None)
+            username = AESHelper.decode( self.para.get("username", ''))
+            password = SM3.encode(AESHelper.decode(self.para.get("pwd", '')))
+            role = AESHelper.decode(self.para.get("role", ''))
+            company = AESHelper.decode(self.para.get("company", ''))
+            position = AESHelper.decode(self.para.get("position", ''))
+            email = AESHelper.decode(self.para.get("email", ''))
+            phone = AESHelper.decode(self.para.get("phone", ''))
             # 是否重名
             if(User.query.filter_by(username=username).one_or_none()):
                 res["msg"] = "username 已存在"

@@ -23,19 +23,29 @@ Swagger(app, config=swagger_config,template=SWAGGER_TEMPLATE)
 from app.models import SM3
 password = SM3.encode('test')
 ```
-## 3 通过http传输的敏感信息要加密
-1. 使用sm2
-通过gmssl工具生成sm2的公钥、私钥。[教程](https://github.com/guanzhi/GmSSL)
+## 3 通过网络传输的敏感信息要加密
+~~使用sm2，通过gmssl工具生成sm2的公钥、私钥。~~
+~~[教程](https://github.com/guanzhi/GmSSL)~~
 
-privatekey使用的pem是`zhou@123`
+~~1.生成sm2公钥、私钥~~
+~~privatekey使用的pem是`zhou@123`~~
+
+~~2. 使用公钥加密，私钥解密~~
+~~前端使用sm-crypto，用户与python-gmssl互通~~
+~~[npm_sm-crypto](https://www.npmjs.com/package/sm-crypto)~~
+
+使用AES加密敏感信息，前端加密，后端解密。偏移量iv、加密密钥key与前端保持一致，保证解密正确。封装在models.py中
+依赖组件：
+* pycryptodome
+* Crypto
+* binascii
+参考资料
+[pycryptodome]()
 
-```shell
-gmssl sm2 -genkey -out skey.pem
-gmssl sm2 -pubout -in skey.pem -out vkey.pem
-```
 
-2. 使用公钥加密，私钥解密
 ```python
-privatekey="EOpBYj1pH54b8BsAlkON71Q2c2FXEm+VTPNCgxz4+gVZ2C/pF/Bv152Qj3QH7cBRCUlNeO5SkI02DcwTASmVwESzR4F9IbMvUNxkDngINdcwaSWCTaaRTstNd4FIlJ0CqhDl/TPHFuBoRNBgUDfPJFfl7XYHs4VmOcrp02aXv8Q="
-publickey="MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAEsENe/8Sft6rK0h59t2a/6Pf4nzvxvJzc1SzalZe1xSDtUqW/10E/e+RjRbvykyjKzu3vAY1lwv9aU2Tnp6+isw=="
+from app.models import  AESHelper
+
+encryption=AESHelper.encode('message')
+result=AESHelper.decode(encryption)
 ```
\ No newline at end of file

@@ -20,4 +20,5 @@ kazoo==2.8.0
 paramiko==2.8.0
 requests==2.26.0
 schedule==1.1.0
-gmssl==3.2.1
\ No newline at end of file
+gmssl==3.2.1
+pycryptodome==3.13.0
\ No newline at end of file