jni使用openssl AES256位加解密（cbc模式），匹配java后端服务器算法,解决末尾乱码问题

前言：以下代码中统一的AES加密方式为”AES/CBC/PKCS7PADDING”,IV参数为”0102030405060708”(java中转为了byte数组，具体值看代码),之所以用CBC是因为它比ECB更安全
在使用openssl编写AES加解密算法代码时，发现c语言的AES加解密和JAVA的加解密并不能匹配，也就是说c语言加密的用c语言能解密，但是用java却解密不了，反之亦然；仔细对比发现，java中可以明确指定PKCS7PADDING,而C语言中（openssl）却没有相关函数实现，所以只能自己编写PKCS7PADDING填充算法,PCKS7PADDING填充代码如下：

unsigned char iv[17] = AES_CBC_IV;
    AES_KEY aes;
int nLen = plainInLen;

//16的倍数，AES_BLOCK_SIZE等于16，aes加密为每16个长度的区域为一个数据块
int nBei = nLen / AES_BLOCK_SIZE + 1;
int nTotal = nBei * AES_BLOCK_SIZE;
char *enc_s = (char*)malloc((size_t) (nTotal + 1));
//清空内存区域
memset(enc_s, '\0', (size_t) (nTotal + 1));
//计算PKCS7PADDING的值
int nNumber;
if (nLen % 16 > 0) {
        nNumber = nTotal - nLen;
    }
else {
        nNumber = 16;
    }
//进行PKCS7PADDING填充
memset(enc_s, nNumber, nTotal);
//将需要加密的数据放到数据块中
memcpy(enc_s, plainIn, nLen);

PKCS7PADDING填充原理：AES来说，因其属于分组加密，且每组数据为16字节（AES_BLOCK_SIZE，其为openssl中宏定义的值），故当明文不为16的整数倍时，就需要对明文做填充，填充到16的整数倍，设明文的长度为nLen ，则分组数为int nBei = nLen / AES_BLOCK_SIZE + 1，填充后的长度为nTotal，需要填充的值为nNumber，其值为“当明文长度刚好整除16，则填充值为16，填充的长度也为16，当明文长度不能整除16时，nNumber = nTotal - nLen，填充的长度也为nTotal - nLen，也就是说填充的长度与填充的值是相等的”；
对明文进行填充然后加密后的密文，经过解密得到的结果当然也是填充过后的明文，并不是真正的明文，当然需要去掉填充的内容，不然末尾就会出现乱码的（因为填充了嘛），只需要知道填充用的方式，便可以解决乱码问题了，具体可以看解密部分代码decryptLen变量的使用，decryptLen变量的值就是真实明文的长度，只需要对解密后的结果取decryptLen长度就是真实明文，没有乱码了
最后贴上完整的openssl代码(jni部分用了动态注册方式，故jni函数不带java类的签名)和java代码，此代码能够让c语言和java后端之间互相加解密:

int aes_decrypt(char *cryptoIn, int cryptoInLen, char *key, char *plainOut, int *outl)
{
char iv1[17] = AES_CBC_IV;
if(!cryptoIn || !key || !plainOut) return 0;

    AES_KEY aes;
if(AES_set_decrypt_key((unsigned char*)key, 256, &aes) < 0)
    {
return 0;
    }
    AES_cbc_encrypt((unsigned char*)cryptoIn, (unsigned char*)plainOut, cryptoInLen, &aes, (unsigned char *) iv1, AES_DECRYPT);
/**去掉padding字符串**/
//获取padding后的明文长度
int padLen = cryptoInLen;
//获取pad的值
int padValue = plainOut[padLen - 1];
int b = AES_BLOCK_SIZE;
//与opensslEVP_DecryptFinal_ex函数的if (n == 0 || n > (int)b) {判断一致
if (padValue == 0 || padValue > AES_BLOCK_SIZE) {
//错误的padding，解密失败
return 0;
    }
    *outl = padLen - padValue;
return 1;
}

/**
 * 加密测试
 * @param plainIn 明文输入
 * @param plainInLen 明文长度
 * @param key key密钥
 * @param cryptoOut 密文输出
 * @param cryptoOutLen 密文长度
 * @return 非0:加密成功，0:失败
 */
int aes_encrypt(char *plainIn, int plainInLen, char *key, char *cryptoOut, size_t *cryptoOutLen) {
    unsigned char iv[17] = AES_CBC_IV;
    AES_KEY aes;
int nLen = plainInLen;

//16的倍数，AES_BLOCK_SIZE等于16，aes加密为每16个长度的区域为一个数据块
int nBei = nLen / AES_BLOCK_SIZE + 1;
int nTotal = nBei * AES_BLOCK_SIZE;
char *enc_s = (char*)malloc((size_t) (nTotal + 1));
//清空内存区域
    memset(enc_s, '\0', (size_t) (nTotal + 1));
//计算PKCS7PADDING的值
int nNumber;
if (nLen % 16 > 0) {
        nNumber = nTotal - nLen;
    }
else {
        nNumber = 16;
    }
//进行PKCS7PADDING填充
    memset(enc_s, nNumber, nTotal);
//将需要加密的数据放到数据块中
    memcpy(enc_s, plainIn, nLen);

if (AES_set_encrypt_key((unsigned char*)key, 256, &aes) < 0) {
        fprintf(stderr, "Unable to set encryption key in AES\n");
        goto error;
    }

    AES_cbc_encrypt((unsigned char *)enc_s, (unsigned char*)cryptoOut, nBei * 16, &aes, (unsigned char*)iv, AES_ENCRYPT);
    *cryptoOutLen = (size_t) (nBei * 16);
// std::string enstr;
// enstr.assign(cryptoOut, (unsigned int) (nBei * 16));
// std::string base64 = TDBASE64::base64_encodestring(enstr);
// LOGD("aes_encrypt_test加密结果：%s",base64.c_str());
    free(enc_s);
return 1;
    error:
    free(enc_s);
return 0;
}

/**
 *
 * @param env
 * @param thiz
 * @param plainText
 * @return
 */
JNIEXPORT jstring tdOpenAesEncrypt(JNIEnv *env, jobject thiz, jstring keyText, jstring plainText) {
const char *cPlainText = env->GetStringUTFChars(plainText,NULL);

//需要加密的明文长度
int plainTextLen = env->GetStringUTFLength(plainText);
    std::string errMsg = "";
char key[32] = "12345678";
if (keyText != NULL) {
int keyLen = env->GetStringUTFLength(keyText);
        keyLen = keyLen <= 32 ? keyLen : 32;
const char *c_key = env->GetStringUTFChars(keyText,NULL);
        memset(key,'\0',32);
        memcpy(key, c_key, (size_t) keyLen);
        env->ReleaseStringUTFChars(keyText,c_key);
    }
//保存密文的buf
char cryptoTextArray[TD_OPEN_AES_CRYPTO_LEN] = {0};
    std::string cryptoText;
//加密后密文的长度
    size_t cryptoTextLen;
if (plainTextLen >= TD_OPEN_AES_CRYPTO_LEN) {
        errMsg.assign("PlainText length is limited to less than 4096!");
//长度限制
        goto enErr;
    }
if (!aes_encrypt((char *) cPlainText, plainTextLen, key, cryptoTextArray, &cryptoTextLen)) {
        errMsg.assign("Encrypt failed!");
//加密失败
        goto enErr;
    }
    cryptoText.assign(cryptoTextArray,cryptoTextLen);
//密文做base64编码
    cryptoText = TDBASE64::base64_encodestring(cryptoText);
    env->ReleaseStringUTFChars(plainText,cPlainText);
return env->NewStringUTF(cryptoText.c_str());
    enErr:
    env->ReleaseStringUTFChars(plainText,cPlainText);
    jclass clz = env->FindClass("java/security/GeneralSecurityException");
    jmethodID methodId = env->GetMethodID(clz, "<init>", "(Ljava/lang/String;)V");
    jthrowable throwable = (jthrowable) env->NewObject(clz, methodId,env->NewStringUTF(errMsg.c_str()));
    env->Throw(throwable);
return NULL;
}

/**
 *
 * @param env
 * @param thiz
 * @param cryptoText
 * @return
 */
JNIEXPORT jstring tdOpenAesDecrypt(JNIEnv *env, jobject thiz, jstring keyText, jstring cryptoText) {
const char *cCryptoText = env->GetStringUTFChars(cryptoText,NULL);
    std::string deBase64Crypto;
//需要解密的密文长度
int cryptoTextLen = env->GetStringUTFLength(cryptoText);
    deBase64Crypto.assign(cCryptoText, (unsigned int) cryptoTextLen);
//将密文解base64，结果为aes加密后的密文块，长度为16的倍数
    deBase64Crypto = TDBASE64::base64_decodestring(deBase64Crypto);
    cryptoTextLen = deBase64Crypto.size();
//定义解密后的明文
    std::string destr;
    std::string errMsg = "";
char key[32] = "12345678";
if (keyText != NULL) {
int keyLen = env->GetStringUTFLength(keyText);
        keyLen = keyLen <= 32 ? keyLen : 32;
const char *c_key = env->GetStringUTFChars(keyText,NULL);
        memset(key,'\0',32);
        memcpy(key, c_key, (size_t) keyLen);
        env->ReleaseStringUTFChars(keyText,c_key);
    }
//定义解密后的明文缓冲
char decrypt_string[TD_OPEN_AES_CRYPTO_LEN] = { 0 };
//解密后的明文长度
int decryptLen = 0;
if (cryptoTextLen < 16) {
        errMsg.clear();
        errMsg.assign("Bad cryptoText!");
        goto deErr;
    }
if (cryptoTextLen >= TD_OPEN_AES_CRYPTO_LEN) {
        errMsg.clear();
        errMsg.assign("CryptoText length is limited to less than 4096!");
        goto deErr;
    }
if (!aes_decrypt((char *) deBase64Crypto.c_str(), cryptoTextLen, key, decrypt_string, &decryptLen)) {
        errMsg.clear();
        errMsg.assign("Decrypt failed!");
        goto deErr;
    }
if (decryptLen <= 0) {
        errMsg.clear();
        errMsg.assign("Decrypt failed!");
        goto deErr;
    }
    destr.assign(decrypt_string, (unsigned int) decryptLen);
    env->ReleaseStringUTFChars(cryptoText,cCryptoText);
return env->NewStringUTF(destr.c_str());
    deErr:
    env->ReleaseStringUTFChars(cryptoText,cCryptoText);
    jclass clz = env->FindClass("java/security/GeneralSecurityException");
    jmethodID methodId = env->GetMethodID(clz, "<init>", "(Ljava/lang/String;)V");
    jthrowable throwable = (jthrowable) env->NewObject(clz, methodId,env->NewStringUTF(errMsg.c_str()));
    env->Throw(throwable);
return NULL;
}

private static final byte[] iv = { 0x30, 0x31, 0x30, 0x32, 0x30, 0x33, 0x30, 0x34, 0x30, 0x35, 0x30, 0x36, 0x30, 0x37, 0x30, 0x38 };

private static SecretKeySpec getKey(String aesPassword) throws UnsupportedEncodingException {
int keyLength = 256;
byte[] keyBytes = new byte[keyLength / 8];
        Arrays.fill(keyBytes, (byte) 0x0);
byte[] passwordBytes = aesPassword.getBytes("UTF-8");
int length = passwordBytes.length < keyBytes.length ? passwordBytes.length : keyBytes.length;
        System.arraycopy(passwordBytes, 0, keyBytes, 0, length);
        SecretKeySpec key = new SecretKeySpec(keyBytes, "AES");
return key;
    }

public static String encrypt(String clearText, String aesPassword) {
try {


            SecretKeySpec skeySpec = getKey(aesPassword);
byte[] clearTextBytes = clearText.getBytes("UTF8");
            IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding");
            cipher.init(Cipher.ENCRYPT_MODE, skeySpec, ivParameterSpec);
return Base64.encodeToString(cipher.doFinal(clearTextBytes),Base64.NO_WRAP);
        } catch (InvalidKeyException e) {
            e.printStackTrace();
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (BadPaddingException e) {
            e.printStackTrace();
        } catch (NoSuchPaddingException e) {
            e.printStackTrace();
        } catch (IllegalBlockSizeException e) {
            e.printStackTrace();
        } catch (InvalidAlgorithmParameterException e) {
            e.printStackTrace();
        }
return null;
    }

public static String decrypt(String cipherText, String aesPassword) {
if (aesPassword != null && aesPassword.length() > 0) {
try {
/**
 * 这个地方调用BouncyCastleProvider
 *让java支持PKCS7Padding
 */
                Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());

                SecretKeySpec skeySpec = getKey(aesPassword);
                IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
                Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding");
                cipher.init(Cipher.DECRYPT_MODE, skeySpec, ivParameterSpec);
return new String(cipher.doFinal(Base64.decode(cipherText,Base64.NO_WRAP)));
            } catch (InvalidKeyException e) {
                e.printStackTrace();
            } catch (UnsupportedEncodingException e) {
                e.printStackTrace();
            } catch (NoSuchAlgorithmException e) {
                e.printStackTrace();
            } catch (BadPaddingException e) {
                e.printStackTrace();
            } catch (NoSuchPaddingException e) {
                e.printStackTrace();
            } catch (IllegalBlockSizeException e) {
                e.printStackTrace();
            } catch (InvalidAlgorithmParameterException e) {
                e.printStackTrace();
            }
        }
return null;
    }

其实后面也发现openssl中的evp方式默认用的就是PKCS7PADDING填充方式，不过由于用evp方式会增加编译后的动态库体积（大概也就几十kb，不算多），所有不打算用EVP方式，最后也附上evp方式的测试代码：

unsigned char *testEvpAesPkcs7Padding() {
unsigned char key[32] = "12345678";
unsigned char iv[17] = AES_CBC_IV;
unsigned char *inStr = (unsigned char *) "ceshi123456789\1";
int inLen = strlen((const char *) inStr);
int encLen = 0;
int outlen = 0;
unsigned char encData[1024] = {0};


//加密
    EVP_CIPHER_CTX *ctx;
    ctx = EVP_CIPHER_CTX_new();

    EVP_CipherInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv, 1);
    EVP_CipherUpdate(ctx, encData, &outlen, inStr, inLen);
    encLen = outlen;
    EVP_CipherFinal(ctx, encData+outlen, &outlen);
    encLen += outlen;
    EVP_CIPHER_CTX_free(ctx);

std::string enstr;
    enstr.assign((char*)encData, (unsigned int) outlen);
std::string base64 = TDBASE64::base64_encodestring(enstr);
    LOGD("evp:%s:end",base64.c_str());
//解密
std::string cryptoText = TDBASE64::base64_decodestring("4KioIpEMfoHYZvrPWL5Gnw==");
int cryptoTextLen = cryptoText.length();
int decLen = 0;
    outlen = 0;
unsigned char decData[1024] = {0};
    EVP_CIPHER_CTX *ctx2;
    ctx2 = EVP_CIPHER_CTX_new();
    EVP_CipherInit_ex(ctx2, EVP_aes_256_cbc(), NULL, key, iv, 0);
    EVP_CipherUpdate(ctx2, decData, &outlen, (const unsigned char *) cryptoText.c_str(), cryptoTextLen);
    decLen = outlen;
    EVP_CipherFinal(ctx2, decData+outlen, &outlen);
    decLen += outlen;
    EVP_CIPHER_CTX_free(ctx2);
std::string decodeResult;
    decodeResult.append((const char *) decData, (unsigned int) decLen);
int a = decData[strlen((const char *) decData) - 1];
    LOGD("解密：%s",decodeResult.c_str());
unsigned char *t = (unsigned char *) malloc(strlen((const char *) decData));
memcpy(t,decData,strlen((const char *) decData));
return t;
}