PyCryptodome RSA签名验证报错：传输Salsa20密钥时哈希验证ValueError

Hey there, let's dig into that ValueError you're hitting when verifying hashes in your Salsa20 + RSA encryption flow. Based on the protocol you described, here are the most common culprits and actionable fixes:

1. Mismatched Hash Handling or Incorrect Data Splitting #

This is one of the top causes of hash verification failures. If you're appending the hash to your encrypted message, make sure:

• You're using consistent byte operations: Don't mix digest() (raw hash bytes) and hexdigest() (hex string representation) between client and server. For example, if your client generates the hash with hash.digest(), the server must compare raw bytes—not a hex-decoded version.
• You're splitting the received data correctly. For SHA-256, the hash is always 32 bytes. If your server slices the wrong number of bytes from the end of the received payload, you'll get a truncated or invalid hash that triggers a ValueError.

Example Fix for Data Splitting: #

# Client side: Package nonce + encrypted message + hash
import hashlib

plaintext = b"your sensitive data here"
# Calculate hash of plaintext
hash_obj = hashlib.sha256(plaintext)
hash_bytes = hash_obj.digest()
# Assume nonce is 8 bytes (standard for Salsa20) and encrypted_msg is your ciphertext
data_to_send = nonce + encrypted_msg + hash_bytes

# Server side: Split received data correctly
received_data = client_socket.recv(4096)
nonce = received_data[:8]
encrypted_msg = received_data[8:-32]  # Skip nonce, exclude last 32 bytes (hash)
received_hash = received_data[-32:]

2. Incorrect RSA Padding for Salsa20 Key Transfer #

RSA encryption requires proper padding—using the wrong type will corrupt your Salsa20 key, turning encrypted data into garbage and breaking hash verification. For encrypting symmetric keys like Salsa20's, always use OAEP padding (PKCS1_v1_5 is designed for signatures, not key encryption).

Correct RSA Key Encryption/Decryption Code: #

# Server side: Generate RSA pair and send public key to client
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP

private_key = RSA.generate(2048)
public_key = private_key.publickey()
client_socket.send(public_key.export_key())

# Client side: Encrypt Salsa20 key with server's public key
from Crypto.Random import get_random_bytes

salsa_key = get_random_bytes(32)  # Salsa20 requires a 32-byte key
imported_pub_key = RSA.import_key(received_public_key)
rsa_cipher = PKCS1_OAEP.new(imported_pub_key)
encrypted_salsa_key = rsa_cipher.encrypt(salsa_key)
client_socket.send(encrypted_salsa_key)

# Server side: Decrypt the Salsa20 key
rsa_cipher = PKCS1_OAEP.new(private_key)
decrypted_salsa_key = rsa_cipher.decrypt(encrypted_salsa_key)

3. Mismatched Salsa20 Nonce #

Salsa20 depends on a unique nonce (number used once) to encrypt data—if the client and server aren't using the exact same nonce, decrypted data will be gibberish, and your hash check will fail every time.

• Always send the nonce alongside your encrypted message (it doesn't need to be secret, just unique per message). Never hardcode it or assume both sides generate the same value.

Example Salsa20 Usage with Nonce: #

# Client side encryption
from Crypto.Cipher import Salsa20

nonce = get_random_bytes(8)
salsa_cipher = Salsa20.new(key=salsa_key, nonce=nonce)
encrypted_msg = salsa_cipher.encrypt(plaintext)

# Server side decryption
salsa_cipher = Salsa20.new(key=decrypted_salsa_key, nonce=nonce)
decrypted_plaintext = salsa_cipher.decrypt(encrypted_msg)

4. Hash Calculated on the Wrong Data #

Double-check what you're hashing:

• If the client hashes the plaintext before encryption, the server must hash the decrypted plaintext for comparison.
• Don't accidentally hash the encrypted message on one side and the plaintext on the other—this will never produce a matching hash.

Quick Debugging Tip #

To pinpoint the issue, add print statements (or loggers) to verify:

1. The decrypted Salsa20 key on the server matches the one generated by the client.
2. The nonce received by the server is identical to the one sent by the client.
3. The hash calculated by both sides is the same (use hash.hexdigest() for easy visual comparison).

内容的提问来源于stack exchange，提问作者purple_dot