Rust数据加密插件库age的使用：安全高效的加密与解密工具

介绍

age是一个简单、现代且安全的文件加密工具和库，由Filippo Valsorda开发。它专注于提供简单易用的API，同时保持高安全性。age的设计目标是成为GPG的现代替代品，具有以下特点：

• 基于现代加密标准(X25519, ChaCha20-Poly1305等)
• 极简的API设计
• 无主密钥概念，每个密钥对独立工作
• 支持基于密码的加密
• 小巧高效，适合嵌入到其他应用中

安装方法

在Cargo.toml中添加依赖：

[dependencies]
age = "0.9"

完整示例代码

use age::{Encryptor, Decryptor, Recipient};
use age::x25519::{Identity, Recipient as X25519Recipient};
use age::secrecy::Secret;
use std::fs::File;
use std::io::{Read, Write};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // 示例1: 生成密钥对
    let identity = Identity::generate();
    let recipient = identity.to_public();
    println!("Generated private key: {}", identity.to_string());
    println!("Generated public key: {}", recipient.to_string());

    // 示例2: 使用公钥加密数据
    let encryptor = Encryptor::with_recipients(vec![Box::new(recipient.clone())])
        .expect("failed to create encryptor");

    let mut encrypted = vec![];
    {
        let mut writer = encryptor.wrap_output(&mut encrypted)?;
        writer.write_all(b"Hello, age! This is a secret message.")?;
        writer.finish()?;
    }

    // 示例3: 使用私钥解密数据
    let decryptor = match Decryptor::new(&encrypted[..])? {
        Decryptor::Recipients(d) => d,
        _ => panic!("not recipients encrypted"),
    };

    let mut decrypted = vec![];
    {
        let mut reader = decryptor.decrypt(std::iter::once(&identity as &dyn age::Identity))?;
        reader.read_to_end(&mut decrypted)?;
    }
    println!("Decrypted: {}", String::from_utf8(decrypted)?);

    // 示例4: 使用密码加密
    let password = Secret::new("my-super-secret-password".to_owned());
    let mut passphrase_encrypted = vec![];
    {
        let encryptor = Encryptor::with_user_passphrase(password.clone());
        let mut writer = encryptor.wrap_output(&mut passphrase_encrypted)?;
        writer.write_all(b"Message encrypted with password")?;
        writer.finish()?;
    }

    // 示例5: 使用密码解密
    let decryptor = match Decryptor::new(&passphrase_encrypted[..])? {
        Decryptor::Passphrase(d) => d,
        _ => panic!("not passphrase encrypted"),
    };
    let mut passphrase_decrypted = vec![];
    {
        let mut reader = decryptor.decrypt(&password, None)?;
        reader.read_to_end(&mut passphrase_decrypted)?;
    }
    println!("Passphrase decrypted: {}", String::from_utf8(passphrase_decrypted)?);

    // 示例6: 加密文件
    {
        // 创建测试文件
        let mut test_file = File::create("test_plain.txt")?;
        test_file.write_all(b"This is a test file content")?;

        let input_file = File::open("test_plain.txt")?;
        let output_file = File::create("test_encrypted.age")?;

        let encryptor = Encryptor::with_recipients(vec![Box::new(recipient)])
            .expect("failed to create file encryptor");

        let mut writer = encryptor.wrap_output(output_file)?;
        let mut buffer = [0; 1024];
        loop {
            let bytes_read = input_file.read(&mut buffer)?;
            if bytes_read == 0 {
                break;
            }
            writer.write_all(&buffer[..bytes_read])?;
        }
        writer.finish()?;
    }

    // 示例7: 解密文件
    {
        let input_file = File::open("test_encrypted.age")?;
        let output_file = File::create("test_decrypted.txt")?;

        let decryptor = match Decryptor::new(input_file)? {
            Decryptor::Recipients(d) => d,
            _ => panic!("not recipients encrypted file"),
        };

        let mut reader = decryptor.decrypt(std::iter::once(&identity as &dyn age::Identity))?;
        let mut buffer = [0; 1024];
        loop {
            let bytes_read = reader.read(&mut buffer)?;
            if bytes_read == 0 {
                break;
            }
            output_file.write_all(&buffer[..bytes_read])?;
        }
    }

    Ok(())
}

代码说明

1. 首先生成了X25519密钥对，包含公钥和私钥
2. 使用公钥加密了一段文本数据
3. 使用对应的私钥解密数据并验证
4. 演示了基于密码的加密和解密过程
5. 展示了如何加密和解密整个文件

注意事项

1. 私钥需要妥善保管，一旦丢失将无法解密数据
2. 使用密码加密时，密码强度直接影响安全性
3. 生产环境中建议结合age的CLI工具进行密钥管理
4. 该库不适合需要密钥撤销或轮换的场景

age提供了简单而强大的加密功能，非常适合需要轻量级加密解决方案的Rust应用程序。