基于Socket实现安全Diffie-Hellman密钥交换协议实验

实验程序设计思路：

客户端和服务器端建立TCP连接
客户端和服务器端进行Diffie-Hellman密钥交换，计算最终生成的密钥
客户端和服务器端使用生成的密钥进行加密和解密
客户端和服务器端使用消息认证码(MAC)来确保消息的完整性和真实性
伪代码：

客户端代码

import socket
from cryptography.hazmat.primitives.asymmetric import dh
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import hmac
from cryptography.hazmat.backends import default_backend

# 与服务器端建立TCP连接
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client_socket.connect(('127.0.0.1', 8888))

# 生成Diffie-Hellman密钥对
params = dh.generate_parameters(generator=2, key_size=2048, backend=default_backend())
private_key = params.generate_private_key()
public_key = private_key.public_key()

# 将公钥发送给服务器端
client_socket.send(public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
))

# 从服务器端接收公钥
server_public_key_bytes = client_socket.recv(1024)
server_public_key = serialization.load_pem_public_key(
    server_public_key_bytes,
    backend=default_backend()
)

# 计算共享密钥
shared_key = private_key.exchange(server_public_key)

# 使用共享密钥进行加密和解密
cipher = Cipher(algorithms.AES(shared_key), modes.CBC(b'�' * 16), backend=default_backend())
encryptor = cipher.encryptor()
decryptor = cipher.decryptor()

# 使用消息认证码(MAC)保证消息的完整性和真实性
key = shared_key[:16]
h = hmac.HMAC(key, hashes.SHA256(), backend=default_backend())

# 发送消息
message = b'Hello, server!'
iv = b'�' * 16
ciphertext = encryptor.update(message) + encryptor.finalize()
h.update(ciphertext)
tag = h.finalize()
client_socket.send(iv + ciphertext + tag)

# 接收消息
data = client_socket.recv(1024)
iv = data[:16]
ciphertext = data[16:-32]
tag = data[-32:]
h = hmac.HMAC(key, hashes.SHA256(), backend=default_backend())
h.update(ciphertext)
h.verify(tag)
plaintext = decryptor.update(ciphertext) + decryptor.finalize()
print('Received:', plaintext)

# 关闭连接
client_socket.close()


### 服务器端代码
```python
import socket
from cryptography.hazmat.primitives.asymmetric import dh
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import hmac
from cryptography.hazmat.backends import default_backend

# 建立TCP服务器
server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server_socket.bind(('127.0.0.1', 8888))
server_socket.listen(1)

# 等待客户端连接
client_socket, address = server_socket.accept()

# 生成Diffie-Hellman密钥对
params = dh.generate_parameters(generator=2, key_size=2048, backend=default_backend())
private_key = params.generate_private_key()
public_key = private_key.public_key()

# 将公钥发送给客户端
client_socket.send(public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
))

# 从客户端接收公钥
client_public_key_bytes = client_socket.recv(1024)
client_public_key = serialization.load_pem_public_key(
    client_public_key_bytes,
    backend=default_backend()
)

# 计算共享密钥
shared_key = private_key.exchange(client_public_key)

# 使用共享密钥进行加密和解密
cipher = Cipher(algorithms.AES(shared_key), modes.CBC(b'�' * 16), backend=default_backend())
encryptor = cipher.encryptor()
decryptor = cipher.decryptor()

# 使用消息认证码(MAC)保证消息的完整性和真实性
key = shared_key[:16]
h = hmac.HMAC(key, hashes.SHA256(), backend=default_backend())

# 接收消息
data = client_socket.recv(1024)
iv = data[:16]
ciphertext = data[16:-32]
tag = data[-32:]
h = hmac.HMAC(key, hashes.SHA256(), backend=default_backend())
h.update(ciphertext)
h.verify(tag)
plaintext = decryptor.update(ciphertext) + decryptor.finalize()
print('Received:', plaintext)

# 发送消息
message = b'Hello, client!'
iv = b'�' * 16
ciphertext = encryptor.update(message) + encryptor.finalize()
h.update(ciphertext)
tag = h.finalize()
client_socket.send(iv + ciphertext + tag)

# 关闭连接
client_socket.close()
server_socket.close()