求iOS Swift 5下与Java AES256类一致的加解密实现

以下是完全对齐你提供的Java AES256类逻辑的Swift 5实现，核心参数和流程完全匹配：

import Foundation
import Security

class AES256 {
    private let secretKey: String
    private let salt = "ssshhhhhhhhhhh!!!!".data(using: .utf8)!
    private let iv = Data(repeating: 0, count: 16) // 全0的16字节IV
    private let iterationCount = 65536
    private let keyLength = kCCKeySizeAES256
    
    init(secretKey: String) {
        self.secretKey = secretKey
    }
    
    func encrypt(_ stringToEncrypt: String) -> String? {
        guard let plainData = stringToEncrypt.data(using: .utf8),
              let key = deriveKey() else {
            print("加密前置步骤失败")
            return nil
        }
        
        var encryptedData = Data(count: plainData.count + kCCBlockSizeAES128)
        var encryptedLength = 0
        
        let status = CCCrypt(CCOperation(kCCEncrypt),
                             CCAlgorithm(kCCAlgorithmAES),
                             CCOptions(kCCOptionPKCS7Padding),
                             key.bytes, key.count,
                             iv.bytes,
                             plainData.bytes, plainData.count,
                             encryptedData.mutableBytes, encryptedData.count,
                             &encryptedLength)
        
        guard status == kCCSuccess else {
            print("加密错误: \(status)")
            return nil
        }
        
        encryptedData.removeSubrange(encryptedLength...)
        return encryptedData.base64EncodedString()
    }
    
    func decrypt(_ stringToDecrypt: String) -> String? {
        guard let encryptedData = Data(base64Encoded: stringToDecrypt),
              let key = deriveKey() else {
            print("解密前置步骤失败")
            return nil
        }
        
        var decryptedData = Data(count: encryptedData.count + kCCBlockSizeAES128)
        var decryptedLength = 0
        
        let status = CCCrypt(CCOperation(kCCDecrypt),
                             CCAlgorithm(kCCAlgorithmAES),
                             CCOptions(kCCOptionPKCS7Padding),
                             key.bytes, key.count,
                             iv.bytes,
                             encryptedData.bytes, encryptedData.count,
                             decryptedData.mutableBytes, decryptedData.count,
                             &decryptedLength)
        
        guard status == kCCSuccess else {
            print("解密错误: \(status)")
            return nil
        }
        
        decryptedData.removeSubrange(decryptedLength...)
        return String(data: decryptedData, encoding: .utf8)
    }
    
    // 对应Java的PBKDF2WithHmacSHA256密钥派生逻辑
    private func deriveKey() -> Data? {
        let passwordData = secretKey.data(using: .utf8)!
        var derivedKeyData = Data(count: keyLength)
        
        let status = CCKeyDerivationPBKDF(CCPBKDFAlgorithm(kCCPBKDF2),
                                          secretKey, secretKey.count,
                                          salt.bytes, salt.count,
                                          CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
                                          UInt32(iterationCount),
                                          derivedKeyData.mutableBytes, derivedKeyData.count)
        
        guard status == kCCSuccess else {
            print("密钥派生错误: \(status)")
            return nil
        }
        
        return derivedKeyData
    }
}

关键逻辑对齐说明 #

• 盐值与密钥派生：固定盐值与Java一致，使用CCKeyDerivationPBKDF实现PBKDF2WithHmacSHA256，迭代次数65536、密钥长度256位完全匹配Java代码
• AES模式与填充：采用CBC模式，PKCS7填充（Java的PKCS5Padding在AES 16字节块大小下与PKCS7完全等价）
• 初始化向量(IV)：使用全0的16字节数组，和Java的IvParameterSpec逻辑一致
• Base64编解码：加密结果转Base64字符串，解密时先解码Base64，与Java的Base64工具类行为一致

内容的提问来源于stack exchange，提问作者Sharjeel Ahmad Siddiqui