Python中RSA公钥加密密码无效，与在线工具结果不符求排查

获取到的RSA公钥 #

"publicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZj/8FWa9e2PmHIBzdMwA/Wo5HYyOHBOxORU5bVBOsb8ZJekhgNWplZxskpuMx1GC9m0WTvCHK+lLmlxKyOomu85q7MxocM8n7iF8Cc0Qrgjushut35FM1bT36em46eCCuO4WqG9/GhCsUeLTsQFBTUxF2Zk6++EJcmBgwU1yNvFZNUScfTmNSMpOcnWlGgt0GpOCdsx8GECOgZhwkJFDnUa01k4BeHYDJEufgNkq4lXh8wxep03S6RyZIAye9zDTaGhGvA5+loQq8bBWCbBzNTJWNhn1kpsnPQJHFcugLMYUyglzxk6phy1Et/s1ANH8H8jdRojhoJEVjg7+Y0JwwIDAQAB"

需求 #

使用上述公钥加密密码，输出Base64格式密文，要求加密结果与指定在线工具完全一致，且密文可正常调用目标API。

问题现象 #

• 在线工具加密的密文可通过Postman成功调用API
• 自行编写的Python代码加密后的密文无法被API识别，代码无任何报错信息

现有Python代码 #

@staticmethod
def get_pem_format(publickey: str):
    lenkey = int(len(publickey) / 64)

    key = ""
    for x in range(0, lenkey+1):
        startpos = x*64
        endpos = startpos + 64
        keylen = str(publickey[startpos:endpos])
        key += f"{keylen}\n" if len(keylen) == 64 else keylen

    key = f"-----BEGIN PUBLIC KEY-----\n{key}\n-----END PUBLIC KEY-----"

    return key

def get_rsa_credentials(self, sourceid, newpass):
    userkeyinfo = self._query_password_info(sourceid)

    # Save public key
    with open('/tmp/public_key.pem', 'w') as f:
        f.write(self.get_pem_format(userkeyinfo["publicKey"]))

    # Get public key
    with open('/tmp/public_key.pem', 'rb') as f:
        publickey = RSA.importKey(f.read())

    cipher = PKCS1_OAEP.new(publickey)
    encryptedpass = cipher.encrypt(newpass.encode())
    base64encryptedpass = base64.b64encode(encryptedpass).decode()

    return base64encryptedpass, userkeyinfo["publicKeyId"]
    
newpass = "Oliveir4souz@"
sourceid = "2c9180878168627f018192ff06f66ccb"
ecryptedpass, publickeyid = self.get_rsa_credentials(sourceid, newpass)

注：_query_password_info方法负责调用API获取公钥；get_pem_format方法用于将公钥转换为PEM格式，依赖的库仅支持从文件加载密钥。

排查方向及修正方案 #

1. 填充模式不匹配（最可能原因） #

在线工具默认使用PKCS1_v1_5填充，而你的代码使用的是PKCS1_OAEP，这是加密结果不一致的核心原因。修改代码改用PKCS1_v1_5填充：

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5
import base64

@staticmethod
def get_pem_format(publickey: str):
    # 更可靠的PEM拆分方式，避免手动计算的误差
    lines = [publickey[i:i+64] for i in range(0, len(publickey), 64)]
    key_body = "\n".join(lines)
    return f"-----BEGIN PUBLIC KEY-----\n{key_body}\n-----END PUBLIC KEY-----"

def get_rsa_credentials(self, sourceid, newpass):
    userkeyinfo = self._query_password_info(sourceid)
    pem_key = self.get_pem_format(userkeyinfo["publicKey"])
    publickey = RSA.importKey(pem_key)
    
    # 替换为PKCS1_v1_5填充
    cipher = PKCS1_v1_5.new(publickey)
    encryptedpass = cipher.encrypt(newpass.encode('utf-8'))
    base64encryptedpass = base64.b64encode(encryptedpass).decode('utf-8')
    
    return base64encryptedpass, userkeyinfo["publicKeyId"]

2. PEM格式转换错误 #

手动拆分Base64字符串时可能存在换行或拼接错误，可改用cryptography库直接加载DER格式公钥，跳过手动拼接PEM的步骤：

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.backends import default_backend
import base64

def get_rsa_credentials(self, sourceid, newpass):
    userkeyinfo = self._query_password_info(sourceid)
    # 直接解码Base64为DER格式公钥，无需生成PEM文件
    der_key = base64.b64decode(userkeyinfo["publicKey"])
    publickey = serialization.load_der_public_key(der_key, backend=default_backend())
    
    # 使用PKCS1_v1_5填充匹配在线工具
    encryptedpass = publickey.encrypt(
        newpass.encode('utf-8'),
        padding.PKCS1v15()
    )
    base64encryptedpass = base64.b64encode(encryptedpass).decode('utf-8')
    
    return base64encryptedpass, userkeyinfo["publicKeyId"]

3. 其他验证点 #

• 确认密码编码为UTF-8，与在线工具保持一致
• 检查Base64编码是否为标准模式，无额外换行或特殊字符

内容的提问来源于stack exchange，提问作者Bruno Souza