The documentation you are viewing is for Dapr v1.13 which is an older version of Dapr. For up-to-date documentation, see the latest version.

快速入门:加密

开始使用 Dapr 的 Cryptography 构建块

让我们来看看Dapr的cryptography构建块。 在此快速入门中,您将创建一个应用程序,使用 Dapr 加密和解密数据的 API。 您将:

  • 使用RSA密钥对短字符串进行加密和解密,在Go字节切片中读取结果。
  • 使用流加密和解密大文件(使用AES密钥),将加密和解密的数据存储到文件中。

当前,您可以使用Go SDK来体验密码学 API。


此快速入门包括一个名为 crypto-quickstart 的 JavaScript 应用程序。

先决条件

对于此示例,您将需要:

第1步:设置环境

克隆在Quickstarts存储库中提供的示例

git clone https://github.com/dapr/quickstarts.git

在终端中,从根目录导航到 cryptography 示例。

cd cryptography/javascript/sdk

导航到包含源代码的文件夹中:

cd ./crypto-quickstart

安装依赖项:

npm install

步骤 2:使用 Dapr 运行应用程序

应用程序代码定义了两个必需的键:

  • 私有RSA密钥
  • 一个256位的对称(AES)密钥

使用OpenSSL生成两个密钥,一个RSA密钥和一个AES密钥,并将其写入两个文件中:

mkdir -p keys
# Generate a private RSA key, 4096-bit keys
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out keys/rsa-private-key.pem
# Generate a 256-bit key for AES
openssl rand -out keys/symmetric-key-256 32

使用 Dapr 运行 Go 服务应用程序:

dapr run --app-id crypto-quickstart --resources-path ../../../components/ -- npm start

预期输出

== APP == 2023-10-25T14:30:50.435Z INFO [GRPCClient, GRPCClient] Opening connection to 127.0.0.1:58173
== APP == == Encrypting message using buffers
== APP == Encrypted the message, got 856 bytes
== APP == == Decrypting message using buffers
== APP == Decrypted the message, got 24 bytes
== APP == The secret is "passw0rd"
== APP == == Encrypting message using streams
== APP == Encrypting federico-di-dio-photography-Q4g0Q-eVVEg-unsplash.jpg to encrypted.out
== APP == Encrypted the message to encrypted.out
== APP == == Decrypting message using streams
== APP == Decrypting encrypted.out to decrypted.out.jpg
== APP == Decrypted the message to decrypted.out.jpg

发生了什么?

local-storage.yaml

早些时候,您在 crypto-quickstarts 中创建了一个名为 keys 的目录。 在local-storage组件的YAML文件中,path元数据映射到新创建的keys目录。

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: localstorage
spec:
  type: crypto.dapr.localstorage
  version: v1
  metadata:
    - name: path
      # Path is relative to the folder where the example is located
      value: ./keys

index.mjs

应用程序文件 使用您生成的RSA和AES密钥加密和解密消息和文件。 应用程序创建一个新的 Dapr SDK 客户端:

async function start() {
  const client = new DaprClient({
    daprHost,
    daprPort,
    communicationProtocol: CommunicationProtocolEnum.GRPC,
  });

  // Encrypt and decrypt a message from a buffer
  await encryptDecryptBuffer(client);

  // Encrypt and decrypt a message using streams
  await encryptDecryptStream(client);
}
使用 RSA 密钥加密和解密字符串

一旦客户端创建完成,应用程序会对消息进行加密:

async function encryptDecryptBuffer(client) {
  // Message to encrypt
  const plaintext = `The secret is "passw0rd"`

  // First, encrypt the message
  console.log("== Encrypting message using buffers");

  const encrypted = await client.crypto.encrypt(plaintext, {
    componentName: "localstorage",
    keyName: "rsa-private-key.pem",
    keyWrapAlgorithm: "RSA",
  });

  console.log("Encrypted the message, got", encrypted.length, "bytes");

然后应用程序解密消息:

  // Decrypt the message
  console.log("== Decrypting message using buffers");
  const decrypted = await client.crypto.decrypt(encrypted, {
    componentName: "localstorage",
  });

  console.log("Decrypted the message, got", decrypted.length, "bytes");
  console.log(decrypted.toString("utf8"));

  // ...
}
使用AES密钥加密和解密大文件

接下来,应用程序对一个大型图像文件进行加密:

async function encryptDecryptStream(client) {
  // First, encrypt the message
  console.log("== Encrypting message using streams");
  console.log("Encrypting", testFileName, "to encrypted.out");

  await pipeline(
    createReadStream(testFileName),
    await client.crypto.encrypt({
      componentName: "localstorage",
      keyName: "symmetric-key-256",
      keyWrapAlgorithm: "A256KW",
    }),
    createWriteStream("encrypted.out"),
  );

  console.log("Encrypted the message to encrypted.out");

接下来,应用程序解密大型图像文件:

  // Decrypt the message
  console.log("== Decrypting message using streams");
  console.log("Decrypting encrypted.out to decrypted.out.jpg");
  await pipeline(
    createReadStream("encrypted.out"),
    await client.crypto.decrypt({
      componentName: "localstorage",
    }),
    createWriteStream("decrypted.out.jpg"),
  );

  console.log("Decrypted the message to decrypted.out.jpg");
}

此快速入门包括一个名为 crypto-quickstart 的 Go 应用程序。

先决条件

对于此示例,您将需要:

第1步:设置环境

克隆在Quickstarts存储库中提供的示例

git clone https://github.com/dapr/quickstarts.git

在终端中,从根目录导航到 cryptography 示例。

cd cryptography/go/sdk

步骤 2:使用 Dapr 运行应用程序

导航到包含源代码的文件夹中:

cd ./crypto-quickstart

应用程序代码定义了两个必需的键:

  • 私有RSA密钥
  • 一个256位的对称(AES)密钥

使用OpenSSL生成两个密钥,一个RSA密钥和一个AES密钥,并将其写入两个文件中:

mkdir -p keys
# Generate a private RSA key, 4096-bit keys
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out keys/rsa-private-key.pem
# Generate a 256-bit key for AES
openssl rand -out keys/symmetric-key-256 32

使用 Dapr 运行 Go 服务应用程序:

dapr run --app-id crypto-quickstart --resources-path ../../../components/ -- go run .

预期输出

== APP == dapr client initializing for: 127.0.0.1:52407
== APP == Encrypted the message, got 856 bytes
== APP == Decrypted the message, got 24 bytes
== APP == The secret is "passw0rd"
== APP == Wrote decrypted data to encrypted.out
== APP == Wrote decrypted data to decrypted.out.jpg

发生了什么?

local-storage.yaml

早些时候,您在 crypto-quickstarts 中创建了一个名为 keys 的目录。 在local-storage组件的YAML文件中,path元数据映射到新创建的keys目录。

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: localstorage
spec:
  type: crypto.dapr.localstorage
  version: v1
  metadata:
    - name: path
      # Path is relative to the folder where the example is located
      value: ./keys

app.go

应用程序文件 使用您生成的RSA和AES密钥加密和解密消息和文件。 应用程序创建一个新的 Dapr SDK 客户端:

func main() {
	// Create a new Dapr SDK client
	client, err := dapr.NewClient()
    
    //...

	// Step 1: encrypt a string using the RSA key, then decrypt it and show the output in the terminal
	encryptDecryptString(client)

	// Step 2: encrypt a large file and then decrypt it, using the AES key
	encryptDecryptFile(client)
}
使用 RSA 密钥加密和解密字符串

一旦客户端创建完成,应用程序会对消息进行加密:

func encryptDecryptString(client dapr.Client) {
    // ...

	// Encrypt the message
	encStream, err := client.Encrypt(context.Background(),
		strings.NewReader(message),
		dapr.EncryptOptions{
			ComponentName: CryptoComponentName,
			// Name of the key to use
			// Since this is a RSA key, we specify that as key wrapping algorithm
			KeyName:          RSAKeyName,
			KeyWrapAlgorithm: "RSA",
		},
	)

    // ...

	// The method returns a readable stream, which we read in full in memory
	encBytes, err := io.ReadAll(encStream)
    // ...

	fmt.Printf("Encrypted the message, got %d bytes\n", len(encBytes))

然后应用程序解密消息:

	// Now, decrypt the encrypted data
	decStream, err := client.Decrypt(context.Background(),
		bytes.NewReader(encBytes),
		dapr.DecryptOptions{
			// We just need to pass the name of the component
			ComponentName: CryptoComponentName,
			// Passing the name of the key is optional
			KeyName: RSAKeyName,
		},
	)

    // ...

	// The method returns a readable stream, which we read in full in memory
	decBytes, err := io.ReadAll(decStream)

    // ...

	// Print the message on the console
	fmt.Printf("Decrypted the message, got %d bytes\n", len(decBytes))
	fmt.Println(string(decBytes))
}
使用AES密钥加密和解密大文件

接下来,应用程序对一个大型图像文件进行加密:

func encryptDecryptFile(client dapr.Client) {
	const fileName = "liuguangxi-66ouBTTs_x0-unsplash.jpg"

	// Get a readable stream to the input file
	plaintextF, err := os.Open(fileName)

    // ...

	defer plaintextF.Close()

	// Encrypt the file
	encStream, err := client.Encrypt(context.Background(),
		plaintextF,
		dapr.EncryptOptions{
			ComponentName: CryptoComponentName,
			// Name of the key to use
			// Since this is a symmetric key, we specify AES as key wrapping algorithm
			KeyName:          SymmetricKeyName,
			KeyWrapAlgorithm: "AES",
		},
	)

    // ...

	// Write the encrypted data to a file "encrypted.out"
	encryptedF, err := os.Create("encrypted.out")

    // ...

	encryptedF.Close()

	fmt.Println("Wrote decrypted data to encrypted.out")

接下来,应用程序解密大型图像文件:

	// Now, decrypt the encrypted data
	// First, open the file "encrypted.out" again, this time for reading
	encryptedF, err = os.Open("encrypted.out")

    // ...

	defer encryptedF.Close()

	// Now, decrypt the encrypted data
	decStream, err := client.Decrypt(context.Background(),
		encryptedF,
		dapr.DecryptOptions{
			// We just need to pass the name of the component
			ComponentName: CryptoComponentName,
			// Passing the name of the key is optional
			KeyName: SymmetricKeyName,
		},
	)

    // ...

	// Write the decrypted data to a file "decrypted.out.jpg"
	decryptedF, err := os.Create("decrypted.out.jpg")

    // ...

	decryptedF.Close()

	fmt.Println("Wrote decrypted data to decrypted.out.jpg")
}

观看演示

请观看 Dapr Community Call #83中的密码学API演示视频:

告诉我们您的想法

我们一直在努力改进我们的快速入门示例,并重视您的反馈。 您觉得此快速入门有帮助吗? 您有改进的建议吗?

加入我们的discord频道参与讨论。

下一步

探索 Dapr 教程 >>