课下作业：IPSec协议验证

最新推荐文章于 2025-05-20 16:29:00 发布

白#泽

最新推荐文章于 2025-05-20 16:29:00 发布

阅读量2.8k

点赞数 15

CC 4.0 BY-SA版权

文章标签：密码学 ssl 算法

本文链接：https://blog.csdn.net/wzy20031004/article/details/143658982

课下作业：IPSec协议验证

文章目录

1. 参考云班课课程资源中“ch03 密码技术-协议验证”的“VPN协议验证.pdf”和“ch03 密码技术-10-密码协议验证IPSec.mp4”，对 IPSec 协议进行验证，提交验证过程。（79分）
2. 不使用 “VPN协议验证.pdf”中的商用密码工具，使用 OpenSSL或者 GmSSL命令进行验证，提交验证过程（选做,加分项目，加20分）
提交要求 (1')

1. 参考云班课课程资源中“ch03 密码技术-协议验证”的“VPN协议验证.pdf”和“ch03 密码技术-10-密码协议验证IPSec.mp4”，对 IPSec 协议进行验证，提交验证过程。（79分）

第一阶段发起方的验证

使用工具解析发起方加密私钥文件“left_enc.key”，得到发起方加密公私钥对内容
私钥

2eb464dc25937be59938549f4cc6306cea1c2ecdcc491a4e3b4fc0bd29af1f99

公钥

7dbea54543458172bd3b688e509c2df54586ace00b58ec941499f94a50a58c675d6f9adaff089e8137a76343acd2f35ca30a8a5ccf81b7cdce5266a016b9e364

在Wireshark中打开“left.pcapng”包，用isakmp协议过滤一下数据包3+ipisec-left.pcapng
导出ski密文

307902210083e6ecef3fb62d7d4683132d920a298dd88efc8342256fb751987a5c37300cd30220398674a09fc955c21d9218a5016994738d9eddb2939b133e8ed2273aa3a215d30420cf1f2e14abe2de8c81fc9f2fbf028648570af88dcdaa98659a4c3eb1f96975100410ac34d8306c55b50003a96045184deb81

参考“GM/T0009-2023SM2密码算法使用规范”的加密数据的定义，实际的加密值是X||Y||Hash||C。SKi密文包，按TLV分割：

3079 T
022100 L
83e6ecef3fb62d7d4683132d920a298dd88efc8342256fb751987a5c37300cd3 X
0220
398674a09fc955c21d9218a5016994738d9eddb2939b133e8ed2273aa3a215d3 Y
0420
cf1f2e14abe2de8c81fc9f2fbf028648570af88dcdaa98659a4c3eb1f9697510 Hash
0410ac34d8306c55b50003a96045184deb81

所以SKi密文X||Y||Hash||C为

83e6ecef3fb62d7d4683132d920a298dd88efc8342256fb751987a5c37300cd3398674a09fc955c21d9218a5016994738d9eddb2939b133e8ed2273aa3a215d3cf1f2e14abe2de8c81fc9f2fbf028648570af88dcdaa98659a4c3eb1f9697510ac34d8306c55b50003a96045184deb81

解密得到明文

e6b74813213bfe4759c20225ade2678e

在Wireshark中通过导出获取Ni密文

NI密文

a73cb7e86cc9b2020ecb43baa4e96cf8fb83d3a176a3e11b618206b32b958c69

使用工具解密Ni密文:SM4算法，CBC模式密钥为Ski，iv为00000000000000000000000000000000
NI明文

450be90d637a4c714d129d13e15642370000000000000000000000000000000f

后面的0000000000000000000000000000000f为填充数据，Ni明文为

450be90d637a4c714d129d13e1564237

在Wireshark中通过导出获取IDi密文,注意Wireshark对IDi的解析有错误，IDi数据看截图，IDi为identificationpayload去掉前3项后的所有数据
IDi密文

eff5aaaddbce5efb2d9daca6f1de48c88096f24ada20e090aa45dc2e46a90517140fe404e0fa5c362423b9559a7dccb08d95ed049d05bf40fbe654ba7d0fae70a583343b9cb2a417d66032ca9a786ff901f6987c86bf733851bf8a46ea92a3ef

工具解密
使用工具解密的到IDi明文：SM4算法，CBC模式，密钥SKiiv：fb83d3a176a3e11b618206b32b958c69（Ni密文的最后一个分组）

在这里插入图片描述

IDi明文

09000000304a310b3009060355040613024141310b3009060355040813024242310b3009060355040a13024343310b3009060355040b13024444311430120603550403130b636c69656e74207369676e0000000000000000000000000000000f

在Wireshark中通过导出获取发起方加密证书CERT_enc_i
CERT_enc_i

05308201ed30820192a00302010202145b2ebfa257b547c1b04ebce83ad65e6c595addaa300a06082a811ccf550183753045310b3009060355040613024141310b300906035504080c024242310b3009060355040a0c024343310b3009060355040b0c024444310f300d06035504030c067375622063613020170d3233303232323032333031345a180f32313233303132393032333031345a3049310b3009060355040613024141310b300906035504080c024242310b3009060355040a0c024343310b3009060355040b0c0244443113301106035504030c0a636c69656e7420656e633059301306072a8648ce3d020106082a811ccf5501822d034200042920dde9348041de867e49a5caa1936d3241f9b79cb5dcc5c6d59b31f8d88467b05b38505b101f7dbf242bcba73daf394cf0879d3f0e8ec08739f1db00fa770ca35a305830090603551d1304023000300b0603551d0f040403020338301d0603551d0e041604147cf13c4f768f4733a2ffe2e259346b90cfb474a8301f0603551d23041830168014ac61eb22806259083e96c8d17fce745c02af3c99300a06082a811ccf550183750349003046022100e2131845079c82d4a4b09b4990b21bc4e281899b83b226c9916d5c5fee12139f022100e7d3e711561a7a0be92392ed9f94f63ca2aa899d9039611f4472488bf14565ea

得到签名原文SKi||Ni||IDi||CERT_enc_i

e6b74813213bfe4759c20225ade2678e450be90d637a4c714d129d13e156423709000000304a310b3009060355040613024141310b3009060355040813024242310b3009060355040a13024343310b3009060355040b13024444311430120603550403130b636c69656e74207369676e05308201ed30820192a00302010202145b2ebfa257b547c1b04ebce83ad65e6c595addaa300a06082a811ccf550183753045310b3009060355040613024141310b300906035504080c024242310b3009060355040a0c024343310b3009060355040b0c024444310f300d06035504030c067375622063613020170d3233303232323032333031345a180f32313233303132393032333031345a3049310b3009060355040613024141310b300906035504080c024242310b3009060355040a0c024343310b3009060355040b0c0244443113301106035504030c0a636c69656e7420656e633059301306072a8648ce3d020106082a811ccf5501822d034200042920dde9348041de867e49a5caa1936d3241f9b79cb5dcc5c6d59b31f8d88467b05b38505b101f7dbf242bcba73daf394cf0879d3f0e8ec08739f1db00fa770ca35a305830090603551d1304023000300b0603551d0f040403020338301d0603551d0e041604147cf13c4f768f4733a2ffe2e259346b90cfb474a8301f0603551d23041830168014ac61eb22806259083e96c8d17fce745c02af3c99300a06082a811ccf550183750349003046022100e2131845079c82d4a4b09b4990b21bc4e281899b83b226c9916d5c5fee12139f022100e7d3e711561a7a0be92392ed9f94f63ca2aa899d9039611f4472488bf14565ea

在Wireshark中通过导出获取签名值（处理后）
签名值

8fd24caa07d506eb6b88ebd5852839e127e875738747a8d2c356150e4b95c6f214a9f5aea118004276fbd8437b0f6e5db84d138b058236f7d6656f3dedefd740

发起方签名公钥，去掉第一字节04

04 2d617e74d5586dde23d2490fbd468e30f11d012d50a8f392cd1849b10b167e9a0661f7e3a2a00ee7ec4718ed937b4ab2c50aa0d341d15e4095743b3850af6d3c

使用工具验签成功

在这里插入图片描述

第一阶段响应方的验证

使用工具解析响应方加密私钥文件“right_enc.key”，得到响应方加密公私钥对内容
私钥

bb3d0ce3feaa521807031b86588d8d3ed35c888c266003780140e804491ad6d7

公钥

2920dde9348041de867e49a5caa1936d3241f9b79cb5dcc5c6d59b31f8d88467b05b38505b101f7dbf242bcba73daf394cf0879d3f0e8ec08739f1db00fa770c

导出SKr密文

3079022100e2fee5b1439937014b7ad1a585f4a62910787a7c885884c1370cd9fb8dadd12c02201c2f5ab9ba02bc9d9c21cf18afaa6b64f0b0a733bd730508d6567f9faac722aa042000376aa46646d90577b5ab0170f97043356acef83504b8a4b9ae159a0e834fc3041001734e922fa8c88ad