AES CBC模式无文件写入链式加密实现失败求助

你的分段加密方案失败的核心原因有三个：

1. 错误的IV截取逻辑 #

AES-CBC模式下，下一段明文的IV应该是上一段明文加密后的最后一个密文块，但你的代码中每次调用encrypt方法都会执行FlushFinalBlock()，这会触发PKCS7填充规则：当输入长度刚好是块大小时，会自动添加一个完整的块作为填充（每个字节值等于块大小）。

比如你对16字节的输入加密后，encr1的实际长度是32字节——前16字节是真正的密文块，后16字节是填充的密文。你取subArray(encr1, blockSize, 16)拿到的是填充部分的密文，而非正确的IV，自然导致后续加密结果不匹配。

2. 分段加密时重复添加填充 #

你的encrypt方法对每个分段都单独执行了FlushFinalBlock()，意味着每个分段都被添加了额外的填充字节。而完整加密（encr0）只会在最后添加一次填充，两者的密文结构完全不同，断言必然失败。

3. 未复用加密器状态 #

每次调用encrypt都会创建新的AesManaged实例，重置了加密器的内部状态。CBC模式下加密器会自动维护IV的更新（用前一个密文块作为下一个块的IV），手动截取IV的方式不仅容易出错，还破坏了加密的连续性。

正确的分段加密实现 #

针对超大数据量（无法放入单个字节数组）且需要保留在内存中的场景，推荐复用同一个加密器持续处理分段，仅在最后执行填充操作：

方案1：使用单个MemoryStream处理（适用于数据量≤2GB） #

byte[] EncryptLargeData(IEnumerable<byte[]> dataChunks)
{
    var aes = new AesManaged();
    aes.KeySize = 128;
    aes.Key = new byte[16] { 0x0F, 0xD4, 0x33, 0x82, 0xF4, 0xDF, 0x62, 0xA5, 0x55, 0x7C, 0x6E, 0x92, 0xC5, 0x64, 0x67, 0xA9 };
    aes.IV = new byte[16] { 0xB3, 0x87, 0xDA, 0xA0, 0x47, 0x7C, 0x52, 0x76, 0xCB, 0x3A, 0x69, 0x9B, 0x0F, 0x82, 0xAF, 0xA7 };
    aes.Padding = PaddingMode.PKCS7;

    using (var encryptor = aes.CreateEncryptor())
    using (var memoryStream = new MemoryStream())
    using (var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
    {
        foreach (var chunk in dataChunks)
        {
            cryptoStream.Write(chunk, 0, chunk.Length);
        }
        cryptoStream.FlushFinalBlock(); // 仅最后执行一次填充
        return memoryStream.ToArray();
    }
}

方案2：分段存储加密结果（适用于数据量>2GB） #

如果数据超过MemoryStream的2GB限制，可以将加密后的分段存入列表，最后再合并：

List<byte[]> EncryptLargeDataToChunks(IEnumerable<byte[]> dataChunks, out byte[] initialIv)
{
    var aes = new AesManaged();
    aes.KeySize = 128;
    aes.Key = new byte[16] { 0x0F, 0xD4, 0x33, 0x82, 0xF4, 0xDF, 0x62, 0xA5, 0x55, 0x7C, 0x6E, 0x92, 0xC5, 0x64, 0x67, 0xA9 };
    initialIv = new byte[16] { 0xB3, 0x87, 0xDA, 0xA0, 0x47, 0x7C, 0x52, 0x76, 0xCB, 0x3A, 0x69, 0x9B, 0x0F, 0x82, 0xAF, 0xA7 };
    aes.Padding = PaddingMode.None; // 中间段不填充

    var encryptedChunks = new List<byte[]>();
    long totalBytes = 0;

    using (var encryptor = aes.CreateEncryptor(aes.Key, initialIv))
    {
        foreach (var chunk in dataChunks)
        {
            totalBytes += chunk.Length;
            var encryptedChunk = new byte[chunk.Length];
            encryptor.TransformBlock(chunk, 0, chunk.Length, encryptedChunk, 0);
            encryptedChunks.Add(encryptedChunk);
        }

        // 处理最后一段的PKCS7填充
        int paddingLength = aes.BlockSize / 8 - (int)(totalBytes % (aes.BlockSize / 8));
        if (paddingLength == 0) paddingLength = aes.BlockSize / 8;
        var padding = Enumerable.Repeat((byte)paddingLength, paddingLength).ToArray();
        
        var paddedEncrypted = encryptor.TransformFinalBlock(padding, 0, paddingLength);
        encryptedChunks.Add(paddedEncrypted);
    }

    return encryptedChunks;
}

修正后的测试代码 #

用复用加密器的方式重新测试，断言会成功：

byte[] subArray(byte[] source, int start, int length = -1)
{
    if (length == -1) length = source.Length - start;
    var target = new byte[length];
    Buffer.BlockCopy(source, start, target, 0, length);
    return target;
}

// 测试逻辑
var blockSize = 16;
var input = new byte[blockSize * 2];
for (int i = 0; i < input.Length; i++) input[i] = (byte)i;

var aes = new AesManaged();
aes.KeySize = 128;
aes.Key = new byte[16] { 0x0F, 0xD4, 0x33, 0x82, 0xF4, 0xDF, 0x62, 0xA5, 0x55, 0x7C, 0x6E, 0x92, 0xC5, 0x64, 0x67, 0xA9 };
aes.IV = new byte[16] { 0xB3, 0x87, 0xDA, 0xA0, 0x47, 0x7C, 0x52, 0x76, 0xCB, 0x3A, 0x69, 0x9B, 0x0F, 0x82, 0xAF, 0xA7 };

// 完整加密结果
byte[] encr0;
using (var ms = new MemoryStream())
using (var cs = new CryptoStream(ms, aes.CreateEncryptor(), CryptoStreamMode.Write))
{
    cs.Write(input, 0, input.Length);
    cs.FlushFinalBlock();
    encr0 = ms.ToArray();
}

// 分段加密
var encryptor = aes.CreateEncryptor(aes.Key, aes.IV);
var firstEncrypted = new byte[blockSize];
encryptor.TransformBlock(subArray(input, 0, blockSize), 0, blockSize, firstEncrypted, 0);

var secondEncrypted = new byte[blockSize];
encryptor.TransformBlock(subArray(input, blockSize, blockSize), 0, blockSize, secondEncrypted, 0);

// 处理填充
var padding = Enumerable.Repeat((byte)blockSize, blockSize).ToArray();
var paddingEncrypted = encryptor.TransformFinalBlock(padding, 0, blockSize);

// 合并分段结果
var encrCombined = new byte[firstEncrypted.Length + secondEncrypted.Length + paddingEncrypted.Length];
Buffer.BlockCopy(firstEncrypted, 0, encrCombined, 0, firstEncrypted.Length);
Buffer.BlockCopy(secondEncrypted, 0, encrCombined, firstEncrypted.Length, secondEncrypted.Length);
Buffer.BlockCopy(paddingEncrypted, 0, encrCombined, firstEncrypted.Length + secondEncrypted.Length, paddingEncrypted.Length);

// 断言成功
Assert.IsTrue(encrCombined.SequenceEqual(encr0));

内容的提问来源于stack exchange，提问作者Andrei Kalantarian