Cookie确实在WEB应用方面为访问者和编程者都提供了方便,但是也许你并不留意这些数据,不过我们可以按下列方法查看Cookie数据:打开IE,选择“工具”菜单里的“Internet选项”,然后在弹出的对话框里点击“设置”按钮,在设置对话框里点击“查看”钮,就会打开一个窗口显示浏览器放在硬盘里的所有缓存数据,其中就有大量的Cookie文件。但是还是建议大家重要的数据不要保存在这里面,这样很容易被人看到,有被窃取的可能性。但是我们可以对这些Cookie数据进行加密,我们可以利用ASP.NET对Cookie数据进行加密。

一、.NET的概要

简单讲,加密就是将原始字符(字节)串转变为完全不同的字符串的处理过程,达到原始字符无法破译的目的。这个处理过程是用另一个字符串(称为“密钥”),采取复杂的、混合的算法,“捣进”原始字符串。有时还使用一个称为“初始向量”的字符串,在密钥捣进之前先打乱目标字符串,预防目标字符串中较明显的内容被识破。加密的功效取决于所用密钥的大小,密钥越长,保密性越强。

目前有两种加密方法:对称加密(或称私有密钥)和非对称加密(或称公共密钥)。对称加密技术的数据交换两边(即加密方和解密方)必须使用一个保密的私有密钥。非对称加密技术中,解密方向加密方要求一个公共密钥,加密方在建立一个公共密钥给解密方后,用公共密钥创建唯一的私有密钥。加密方用私有密钥加密送出的信息,对方用公共密钥解密。保护HTTP传输安全的SSL就是使用非对称技术。

我们对Cookie数据的加密采取对称加密法。.NET构架从基本的SymmetricAlgorithm类扩展出来四种算法:

  • System.Security.Cryptography.DES
  • System.Security.Cryptography.TripleDES
  • System.Security.Cryptography.RC2
  • System.Security.Cryptography.Rijndael

下面将示范DES和TripleDES算法。DES的密钥大小限制在64位,但用于Cookie的加密是有效的。TripleDES完成了三次加密,并有一个较大的密钥位数,所以它更安全。使用那一种算法不仅要考虑加密强度,还要考虑Cookie的大小。因为加密后的Cookie数据将变大,并且,密钥越大,加密后的数据就越大,然而Cookie数据的大小限制在4KB,这是一个必须考虑的问题。再者,加密的数据越多或算法越复杂,就会占有更多的服务器资源,进而减慢整个站点的访问速度。

二、创建一个简单的加密应用类

.NET的所有加密和解密通过CryptoStream类别来处理,它衍生自System.IO.Stream,将字符串作为以资料流为基础的模型,供加密转换之用。下面是一个简单的加密应用类的代码:

Imports System.Diagnostics

Imports System.Security.Cryptography

Imports System.Text

Imports System.IO

Public Class CryptoUtil

'随机选8个字节既为密钥也为初始向量

Private Shared KEY_64() As Byte = {42, 16, 93, 156, 78, 4, 218, 32}

Private Shared IV_64() As Byte = {55, 103, 246, 79, 36, 99, 167, 3}

'对TripleDES,采取24字节或192位的密钥和初始向量

Private Shared KEY_192() As Byte = {42, 16, 93, 156, 78, 4, 218, 32, _

15, 167, 44, 80, 26, 250, 155, 112, _

2, 94, 11, 204, 119, 35, 184, 197}

Private Shared IV_192() As Byte = {55, 103, 246, 79, 36, 99, 167, 3, _

42, 5, 62, 83, 184, 7, 209, 13, _

145, 23, 200, 58, 173, 10, 121, 222}

'标准的DES加密

Public Shared Function Encrypt(ByVal value As String) As String

If value <> "" Then

Dim cryptoProvider As DESCryptoServiceProvider = _

New DESCryptoServiceProvider()

Dim ms As MemoryStream = New MemoryStream()

Dim cs As CryptoStream = _

New CryptoStream(ms, cryptoProvider.CreateEncryptor(KEY_64, IV_64), _

CryptoStreamMode.Write)

Dim sw As StreamWriter = New StreamWriter(cs)

sw.Write(value)

sw.Flush()

cs.FlushFinalBlock()

ms.Flush()

'再转换为一个字符串

Return Convert.ToBase64String(ms.GetBuffer(), 0, ms.Length)

End If

End Function

'标准的DES解密

Public Shared Function Decrypt(ByVal value As String) As String

If value <> "" Then

Dim cryptoProvider As DESCryptoServiceProvider = _

New DESCryptoServiceProvider()

'从字符串转换为字节组

Dim buffer As Byte() = Convert.FromBase64String(value)

Dim ms As MemoryStream = New MemoryStream(buffer)

Dim cs As CryptoStream = _

New CryptoStream(ms, cryptoProvider.CreateDecryptor(KEY_64, IV_64), _

CryptoStreamMode.Read)

Dim sr As StreamReader = New StreamReader(cs)

Return sr.ReadToEnd()

End If

End Function

'TRIPLE DES加密

Public Shared Function EncryptTripleDES(ByVal value As String) As String

If value <> "" Then

Dim cryptoProvider As TripleDESCryptoServiceProvider = _

New TripleDESCryptoServiceProvider()

Dim ms As MemoryStream = New MemoryStream()

Dim cs As CryptoStream = _

New CryptoStream(ms, cryptoProvider.CreateEncryptor(KEY_192, IV_192), _

CryptoStreamMode.Write)

Dim sw As StreamWriter = New StreamWriter(cs)

sw.Write(value)

sw.Flush()

cs.FlushFinalBlock()

ms.Flush()

'再转换为一个字符串

Return Convert.ToBase64String(ms.GetBuffer(), 0, ms.Length)

End If

End Function

'TRIPLE DES解密

Public Shared Function DecryptTripleDES(ByVal value As String) As String

If value <> "" Then

Dim cryptoProvider As TripleDESCryptoServiceProvider = _

New TripleDESCryptoServiceProvider()

'从字符串转换为字节组

Dim buffer As Byte() = Convert.FromBase64String(value)

Dim ms As MemoryStream = New MemoryStream(buffer)

Dim cs As CryptoStream = _

New CryptoStream(ms, cryptoProvider.CreateDecryptor(KEY_192, IV_192), _

CryptoStreamMode.Read)

Dim sr As StreamReader = New StreamReader(cs)

Return sr.ReadToEnd()

End If

End Function

End Class

上面我们将一组字节初始化为密钥,并且使用的是数字常量,如果你在实际应用中也这样做,这些字节一定要在0和255之间,这是一个字节允许的范围值。

三、创建一个Cookie的应用类

下面我们就创建一个简单的类,来设置和获取Cookies。

Public Class CookieUtil

'设置COOKIE *****************************************************

'SetTripleDESEncryptedCookie (只针对密钥和Cookie数据)

Public Shared Sub SetTripleDESEncryptedCookie(ByVal key As String, _

ByVal value As String)

key = CryptoUtil.EncryptTripleDES(key)

value = CryptoUtil.EncryptTripleDES(value)

SetCookie(key, value)

End Sub

'SetTripleDESEncryptedCookie (增加了Cookie数据的有效期参数)

Public Shared Sub SetTripleDESEncryptedCookie(ByVal key As String, _

ByVal value As String, ByVal expires As Date)

key = CryptoUtil.EncryptTripleDES(key)

value = CryptoUtil.EncryptTripleDES(value)

SetCookie(key, value, expires)

End Sub

'SetEncryptedCookie(只针对密钥和Cookie数据)

Public Shared Sub SetEncryptedCookie(ByVal key As String, _

ByVal value As String)

key = CryptoUtil.Encrypt(key)

value = CryptoUtil.Encrypt(value)

SetCookie(key, value)

End Sub

'SetEncryptedCookie (增加了Cookie数据的有效期参数)

Public Shared Sub SetEncryptedCookie(ByVal key As String, _

ByVal value As String, ByVal expires As Date)

key = CryptoUtil.Encrypt(key)

value = CryptoUtil.Encrypt(value)

SetCookie(key, value, expires)

End Sub

'SetCookie (只针对密钥和Cookie数据)

Public Shared Sub SetCookie(ByVal key As String, ByVal value As String)

'编码部分

key = HttpContext.Current.Server.UrlEncode(key)

value = HttpContext.Current.Server.UrlEncode(value)

Dim cookie As HttpCookie

cookie = New HttpCookie(key, value)

SetCookie(cookie)

End Sub

'SetCookie(增加了Cookie数据的有效期参数)

Public Shared Sub SetCookie(ByVal key As String, _

ByVal value As String, ByVal expires As Date)

'编码部分

key = HttpContext.Current.Server.UrlEncode(key)

value = HttpContext.Current.Server.UrlEncode(value)

Dim cookie As HttpCookie

cookie = New HttpCookie(key, value)

cookie.Expires = expires

SetCookie(cookie)

End Sub

'SetCookie (只针对HttpCookie)

Public Shared Sub SetCookie(ByVal cookie As HttpCookie)

HttpContext.Current.Response.Cookies.Set(cookie)

End Sub

'获取COOKIE *****************************************************

Public Shared Function GetTripleDESEncryptedCookieValue(ByVal key As String) _

As String

'只对密钥加密

key = CryptoUtil.EncryptTripleDES(key)

'获取Cookie值

Dim value As String

value = GetCookieValue(key)

'解密Cookie值

value = CryptoUtil.DecryptTripleDES(value)

Return value

End Function

Public Shared Function GetEncryptedCookieValue(ByVal key As String) As String

'只对密钥加密

key = CryptoUtil.Encrypt(key)

'获取Cookie值

Dim value As String

value = GetCookieValue(key)

'解密Cookie值

value = CryptoUtil.Decrypt(value)

Return value

End Function

Public Shared Function GetCookie(ByVal key As String) As HttpCookie

'编码密钥

key = HttpContext.Current.Server.UrlEncode(key)

Return HttpContext.Current.Request.Cookies.Get(key)

End Function

Public Shared Function GetCookieValue(ByVal key As String) As String

Try

'编码在GetCookie里完成

'获取Cookie值

Dim value As String

value = GetCookie(key).Value

'解码所存储的值

value = HttpContext.Current.Server.UrlDecode(value)

Return value

Catch

End Try

End Function

End Class

对Cookie数据进行加密后,我们就可以在方便使用的同时增强文件的安全性!这样我们也不会担心自己的有关网页,密码和其他用用户信息被窃取。