在AIX上如何實現(xiàn)對于文件的加密和解密

daqianmen

環(huán)境: AIX 5L

解答: 在AIX 5.2的expansion pack光盤中，提供一個文件集des，我們可以利用該文件集提供的命令crypt實現(xiàn)文件的加密和解密。

1. 安裝文件集des
# lslpp -l des
Fileset Level State Description
----------------------------------------------------------------------------
Path: /usr/lib/objrepos
des 5.2.0.0 COMMITTED Data Encryption Standard
Library Routines

2. 加密一個文件
# cp /etc/hosts testfile
# crypt <testfile >testfile.cry
Enter key:

3. 查看文件testfile是文本格式，查看文件testfile.cry是亂碼。
# more testfile
# @(#)47 1.1 src/bos/usr/sbin/netstart/hosts, cmdnet, bos520 7/24/91 10:00:46
# IBM_PROLOG_BEGIN_TAG
# This is an automatically generated prolog.

# more testfile.cry
韃Q?{籲]^Vk犲WM-^I?C\(M8^\^[M-^D??q縶鐿.??^P亟^^蕩d]r^X遃硍M-^O^AM蓋
M-^C?M-^Z^Gy師6JM-^P-Yznm!鯩-^O[Y壕e黕?^Q盥玘誥_LK^][l蚟_i螹-^\;矼-^M鰐9

4. 解密一個文件
# crypt <testfile.cry
Enter key:
# @(#)47 1.1 src/bos/usr/sbin/netstart/hosts, cmdnet, bos520 7/24/91 10:00:46
# IBM_PROLOG_BEGIN_TAG
# This is an automatically generated prolog.


下面是crypt命令的man幫助，供參考。

NAME
crypt - encode or decode a file

SYNOPSIS

crypt [ password ]

DESCRIPTION

crypt encrypts and decrypts the contents of a file. crypt
reads from the standard input and writes on the standard
output. The password is a key that selects a particular
transformation. If no password is given, crypt demands a
key from the terminal and turns off printing while the key
is being typed in. crypt encrypts and decrypts with the
same key:

example% crypt key <clear.file >encrypted.file
example% crypt key <encrypted.file | pr

will print the contents of clear.file.

Files encrypted by crypt are compatible with those treated
by the editors ed(1), ex(1) and vi(1) in encryption mode.

The security of encrypted files depends on three factors:
the fundamental method must be hard to solve; direct search
of the key space must be infeasible; "sneak paths" by which
keys or cleartext can become visible must be minimized.

crypt implements a one-rotor machine designed along the
lines of the German Enigma, but with a 256-element rotor.
Methods of attack on such machines are widely known, thus
crypt provides minimal security.

The transformation of a key into the internal settings of
the machine is deliberately designed to be expensive, that
is, to take a substantial fraction of a second to compute.
However, if keys are restricted to (say) three lower-case
letters, then encrypted files can be read by expending only
a substantial fraction of five minutes of machine time.

Since the key is an argument to the crypt command, it is
potentially visible to users executing ps(1) or a derivative
command. To minimize this possibility, crypt takes care to
destroy any record of the key immediately upon entry. No
doubt the choice of keys and key security are the most
vulnerable aspect of crypt.