使用Python cryptography库解密时遇InvalidTag异常问题咨询

Hey there, let's break down why you're hitting that InvalidTag exception when using your high-level encryption class, but everything works smoothly when handling variables directly. This error almost always links to integrity check failures (super common in AEAD algorithms like AES-GCM), so let's walk through the most likely differences between your two approaches:

1. Accidental Modification of Stored Class Variables #

When you use a class to hold keys, nonces, or that "authorized unencrypted data" (which is almost certainly associated data/AD for AEAD encryption), you risk these values getting altered between encryption and decryption. Here's how that might happen:

• Encoding mismatches: If you convert raw bytes (like a key or nonce) to a string for storage and convert back incorrectly, you'll end up with a different value than what was used for encryption. Direct variable usage avoids this because you're working with raw bytes the entire time.
• Unintended overwrites: Class properties might get modified by other methods in your code. For example, if your class reuses the same nonce field for multiple encryption calls without resetting it, you'll be using a stale nonce for decryption. Direct variables are short-lived and far less likely to be tampered with.

2. Mismatched Associated Data (AD) #

That "authorized unencrypted data" is critical for AEAD integrity checks—decryption requires the exact same AD (byte-for-byte) as was used during encryption. If your class stores or retrieves this data incorrectly:

• Maybe you're trimming whitespace, changing encoding, or modifying the content in some subtle way between encryption and decryption. Direct usage keeps the AD intact because you're passing it immediately without long-term storage.
• Double-check that the AD's length and byte content are identical in both encryption and decryption steps when using your class.

3. Nonce Reuse or Mismanagement #

Most symmetric AEAD algorithms (like AES-GCM) strictly require that a nonce is never reused with the same key. If your class:

• Reuses a nonce for multiple encryption operations, decryption will fail with InvalidTag because the integrity check depends on a unique nonce per encryption.
• Fails to preserve the exact nonce used for encryption when storing it for decryption (e.g., truncating bytes or converting to a string incorrectly), you'll end up with a mismatch.

Direct variable usage probably generates a fresh nonce each time and passes it immediately to decryption, avoiding these pitfalls entirely.

4. Botched Ciphertext/Tag Handling #

AEAD algorithms often append an authentication tag to the ciphertext. If your class stores the ciphertext and tag separately and fails to recombine them correctly during decryption, or truncates part of the ciphertext/tag, the integrity check will fail. When using direct variables, you're likely passing the full ciphertext+tag as a single byte sequence, so no splicing errors occur.

Quick Debugging Steps #

To narrow it down fast:

• Right after encryption, print the raw byte values of your key, nonce, AD, and ciphertext+tag from both the class and direct variable approach. Compare them side-by-side—any difference is your culprit.
• Check if any methods in your class modify the stored key, nonce, or AD between encryption and decryption calls.
• Verify that your class uses the exact same nonce and AD for decryption that was used for encryption.

内容的提问来源于stack exchange，提问作者user9748870