解密AES密文

Question

Consider the following test:

    [Test]
    public void TestAes256EcbPkcs7Stream()
    {
        // 504 bytes of plain text
        const string inputString = new string('z', 504);
        var inputBytes = Encoding.UTF8.GetBytes(inputString);
        byte[] key = {
            0, 0, 0, 0, 0, 0, 0, 0,
            1, 0, 0, 0, 0, 0, 0, 0,
            2, 0, 0, 0, 0, 0, 0, 0,
            3, 0, 0, 0, 0, 0, 0, 0
        };
        var rij = new RijndaelManaged
        {
            BlockSize = 256, // 256 bits == 32 bytes
            Key = key,
            IV = key, // just for test
            Mode = CipherMode.ECB,
            Padding = PaddingMode.PKCS7
        };
        var enc = rij.CreateEncryptor();
        var encBytes = enc.TransformFinalBlock(inputBytes, 0, inputBytes.Length);
        Assert.AreEqual(512, encBytes.Length);
        var dec = rij.CreateDecryptor();
        byte[] decBytes = new byte[inputBytes.Length];
        int decPos = 0;
        using (var cipherMs = new MemoryStream(encBytes))
        {
            var buf = new byte[32];
            // process all blocks except the last one
            while (cipherMs.Read(buf, 0, buf.Length)==buf.Length &&
                cipherMs.Length!=cipherMs.Position)
            {
                for (int w = 0; w!=buf.Length;)
                {
                    w += dec.TransformBlock(buf, 0, buf.Length, decBytes, decPos);
                    decPos += w;
                }
            }
            // ensure that we read all blocks
            Assert.IsTrue(cipherMs.Length==cipherMs.Position);
            // process the last block
            var tailBytes = dec.TransformFinalBlock(buf, 0, buf.Length);
            // here decPos==480, that means 480 bytes were written to decBytes
            // and 504-480 = 24 bytes come from TransformFinalBlock
            Assert.AreEqual(24, tailBytes.Length); // <- fail, because the actual length is 56
            Buffer.BlockCopy(tailBytes, 0, decBytes, decPos, tailBytes.Length);
        }
        Assert.AreEqual(inputBytes, decBytes);
    }

For some reason I got 56-byte final block instead of 24-byte. I suppose, TransformBlock / TransformFinalBlock should be used in some other way, but unfortunately, MSDN docs don't explain much about these methods. Any thoughts?

Answer 1

Ok, here's the thing: When TransformBlock is called first time, it copies the last block of the input buffer to the so called depad buffer and then transforms and writes remaining blocks to the output buffer. During next calls it transforms data from depad buffer, writes it to the output buffer, copies the last block of the input buffer to the depad buffer again, and writes transformed remaining blocks to the output, just as the first time.

TL;DR: TransformBlock caches the last block of input data so when TransformFinalBlock is called, it can grab the last block and remove padding. Without caching, the last block may be handled by TransformBlock . In that case, padding wouldn't be removed.