Python3如何通过用户自定义密码实现安全的数据加密？

直接用cryptography库就能满足你的需求，这是Python生态里安全可靠的加密库，支持自定义密码，且遵循现代加密标准。

安装依赖 #

pip install cryptography

面向对象实现（匹配你的第一个伪代码） #

from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.backends import default_backend
import base64

class Crypt:
    def __init__(self, password: str):
        self.password = password.encode()
        # 生产环境建议每次加密生成随机salt，此处用固定salt仅作演示
        self.salt = b'random_salt_placeholder'  # 替换为16字节以上随机生成的salt
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=self.salt,
            iterations=480000,
            backend=default_backend()
        )
        self.key = base64.urlsafe_b64encode(kdf.derive(self.password))
        self.fernet = Fernet(self.key)

    def encrypt(self, plaintext: str) -> str:
        return self.fernet.encrypt(plaintext.encode()).decode()

    def decrypt(self, ciphertext: str) -> str:
        return self.fernet.decrypt(ciphertext.encode()).decode()

# 使用示例
encryptor = Crypt("my secret password")
encrypted = encryptor.encrypt("hello this is my very secret string")
print(encrypted)
decrypted = encryptor.decrypt(encrypted)
print(decrypted)  # 输出: hello this is my very secret string

函数式实现（匹配你的第二个伪代码） #

from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.backends import default_backend
import base64

def encrypt(plaintext: str, password: str) -> str:
    password_bytes = password.encode()
    salt = b'random_salt_placeholder'  # 生产环境建议随机生成salt并随密文返回
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        iterations=480000,
        backend=default_backend()
    )
    key = base64.urlsafe_b64encode(kdf.derive(password_bytes))
    return Fernet(key).encrypt(plaintext.encode()).decode()

def decrypt(ciphertext: str, password: str) -> str:
    password_bytes = password.encode()
    salt = b'random_salt_placeholder'  # 和加密时的salt保持一致
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        iterations=480000,
        backend=default_backend()
    )
    key = base64.urlsafe_b64encode(kdf.derive(password_bytes))
    return Fernet(key).decrypt(ciphertext.encode()).decode()

# 使用示例
encrypted = encrypt("hello this is my very secret string", "my secret password")
print(encrypted)
decrypted = decrypt(encrypted, "my secret password")
print(decrypted)  # 输出: hello this is my very secret string

生产环境优化建议 #

• 随机salt：不要用固定salt，每次加密时生成16字节以上的随机salt，将salt与密文一起存储（比如用分隔符拼接或打包成二进制），解密时拆分获取salt。
• 迭代次数调整：PBKDF2的迭代次数可根据当前硬件性能调高，提升暴力破解难度。
• 二进制存储：若无需字符串格式，可直接返回二进制加密结果，避免base64编码的额外开销。

内容的提问来源于stack exchange，提问作者user17411100