Cookie解密(Cookie Decryption)

Cookie解密(Cookie Decryption)

我有一个奇怪的问题; 我无法解密cookie值。 我用机器密钥加密它：

网络配置：

<machineKey decryptionKey="9931B3DF5DAD70FC6696E7F882AC2F51E4D78A72E3A7A2D0" validationKey="3471B0113B1F47164560DAC7AC89694A548B707A332F2BFAF80CBC5F4536217B9B1124F11A13B4E5E02D9EB976205708D9CF2E96F55845B16C4B1EFD8CE1BFAC" validation="SHA1" decryption="AES" />

加密：

private string Protect(string text, string purpose) { if (string.IsNullOrEmpty(text)) return null; byte[] stream = Encoding.UTF8.GetBytes(text); byte[] encodedValue = MachineKey.Protect(stream, purpose); return Convert.ToBase64String(encodedValue); }

解密：

private string Unprotect(string text, string purpose) { if (string.IsNullOrEmpty(text)) return null; byte[] stream = Convert.FromBase64String(text); byte[] decodedValue = MachineKey.Unprotect(stream, purpose); // Here i have error return Encoding.UTF8.GetString(decodedValue); }

从我读到的这与机器密钥有关，但我在应用程序中定义了这一部分，所以我真的不明白问题出在哪里。

错误：

I have a strange problem; i can't decrypt a cookie value. I'm encrypting it with machine Key:

Web config :

<machineKey decryptionKey="9931B3DF5DAD70FC6696E7F882AC2F51E4D78A72E3A7A2D0" validationKey="3471B0113B1F47164560DAC7AC89694A548B707A332F2BFAF80CBC5F4536217B9B1124F11A13B4E5E02D9EB976205708D9CF2E96F55845B16C4B1EFD8CE1BFAC" validation="SHA1" decryption="AES" />

Encryption :

private string Protect(string text, string purpose) { if (string.IsNullOrEmpty(text)) return null; byte[] stream = Encoding.UTF8.GetBytes(text); byte[] encodedValue = MachineKey.Protect(stream, purpose); return Convert.ToBase64String(encodedValue); }

Decryption :

private string Unprotect(string text, string purpose) { if (string.IsNullOrEmpty(text)) return null; byte[] stream = Convert.FromBase64String(text); byte[] decodedValue = MachineKey.Unprotect(stream, purpose); // Here i have error return Encoding.UTF8.GetString(decodedValue); }

From what i read this is related to the machine key but I'm defining this section in the application so i don't really understand where the problem is.

Error :

最满意答案

您的验证过程是SHA1。

Hashing不能逆转（解密）回来。 （至少在可预见的未来）。 如果您只需要加密和解密，那么使用加密而不是Hash方法。 Hash方法用于密码，因此您不会将其解密。

在web配置中将validation过程更改为AES中的machinekey标记。

<machineKey decryptionKey="9931B3DF5DAD70FC6696E7F882AC2F51E4D78A72E3A7A2D0" validationKey="3471B0113B1F47164560DAC7AC89694A548B707A332F2BFAF80CBC5F4536217B9B1124F11A13B4E5E02D9EB976205708D9CF2E96F55845B16C4B1EFD8CE1BFAC" validation="AES" decryption="AES" />

Your validation process is SHA1.

Hashing cannot be reversed(decrypted) back. (not at least for a forseeable future). If you need just encryption and decryption, then use an encryption and not Hash methods. Hash methods are for passwords, so you don't decrypt them back.

Change the validation process to AES for your machinekey tag in web config.

<machineKey decryptionKey="9931B3DF5DAD70FC6696E7F882AC2F51E4D78A72E3A7A2D0" validationKey="3471B0113B1F47164560DAC7AC89694A548B707A332F2BFAF80CBC5F4536217B9B1124F11A13B4E5E02D9EB976205708D9CF2E96F55845B16C4B1EFD8CE1BFAC" validation="AES" decryption="AES" />