Cryptography is mandatory in the current modern world. In this era of big data and data science, it is important to make sure your data is protected from a malicious attack.

在当前现代世界中，密码术是必不可少的。 在当今大数据和数据科学时代，确保保护您的数据免受恶意攻击非常重要。

There are many algorithms and techniques to ensure that your system is secure and no unauthorized access will be done to your data.

有许多算法和技术可以确保您的系统安全，并且不会对数据进行未经授权的访问。

Symmetric encryption is one of these techniques, and in this tutorial, I will show you how to do it in Go.

对称加密是这些技术之一，在本教程中，我将向您展示如何在Go中进行加密。

Note: The version of Go used in this tutorial is 1.14.7.

注意：本教程中使用的Go版本是1.14.7。

介绍 (Introduction)

The symmetric-key encryption is a technique used to encrypt a message where there is only one secret key. This key is used on both parts of the process, that is, to encrypt and decrypt the message.

对称密钥加密是一种用于加密只有一个秘密密钥的消息的技术。 该密钥在过程的两个部分都使用，即加密和解密消息。

Using any kind of symmetric-key algorithm, a message is converted into a form that cannot be understood. Unless someone has the secret key. In this case, both the sender and the receiver have the same key (exchanged in some secure way) so they can send messages and understand each other.

使用任何一种对称密钥算法，都会将消息转换为无法理解的形式。 除非有人拥有密钥。 在这种情况下，发送方和接收方都具有相同的密钥(以某种安全方式进行了交换)，因此它们可以发送消息并相互理解。

The algorithm used determines the size of the key and the mode that the process of encryption or decryption is done. And, usually, longer the key, harder is to hack it and more secure is your encryption. For example, a 128-bits key can take up to billions of years to be broken by a normal computer.

所使用的算法确定密钥的大小以及完成加密或解密过程的方式。 而且，通常，密钥越长，破解就越困难，而加密则更加安全。 例如，一个128位的密钥可能需要数十亿年才能被普通计算机破解。

There are two types of algorithms:

有两种算法：

• Block: the message is encrypted using fixed-size blocks. Example: DES, AES, etc.

  块 ：使用固定大小的块对消息进行加密。 例如： DES ， AES等。

• Stream: the message is encrypted taking individual characters. Example: RC4, Salsa20, etc.

  流 ：消息采用单个字符进行加密。 例如： RC4 ， Salsa20等

模式 (Modes)

Since the block ciphers only operate over a fixed-length group of bits, you have to describe how to repeat the single operation to transform a data that is larger than a block.

由于块密码仅在固定长度的位组上运行，因此您必须描述如何重复单个操作来转换大于块的数据。

Most of the modes require a unique initial sequence, often called an Initialization Vector (IV). The IV has to be non-repeating and sometimes also random.

大多数模式需要唯一的初始序列，通常称为初始化向量(IV)。 IV必须是非重复的，有时还必须是随机的。

If the data length is not multiple of the block size, the last block is padded to a full block. However, some modes do not require it since they use it as a stream cipher. Some common modes:

如果数据长度不是块大小的倍数，则将最后一个块填充为完整块。 但是，某些模式不需要它，因为它们将其用作流密码。 一些常见的模式：

• ECB: the simplest. Encrypt each block separately. This mode is not safe at all and should not be used.

  ECB ：最简单。 分别加密每个块。 此模式根本不安全，不应使用。

• CBC: in this mode, each block of the original message is XORed with the previous ciphered block before being encrypted.

  CBC ：在此模式下，原始消息的每个块在加密之前都会与先前的加密块进行异或。

• CFB / OFB / CTR: these modes make a block cipher into a stream cipher, by using the message block only after the encryption part.

  CFB / OFB / CTR ：这些模式仅在加密部分之后才使用消息块，从而将块密码转换为流密码。

• XTS: used for encoding random accessible data (like a hard disk or RAM).

  XTS ：用于编码随机可访问的数据(例如硬盘或RAM)。

消息认证 (Message authentication)

To increase the security of the message, a short piece of information is added to authenticate it. In other words, it confirms the message really came from the sender and has not been modified.

为了提高消息的安全性，添加了一小段信息以对其进行身份验证。 换句话说，它确认邮件确实来自发件人并且尚未被修改。

This piece of information is called Message Authentication Code (MAC) and protects the message’s data integrity as well as its authenticity. There are many algorithms that implement it, such as HMAC, GCM, etc.

此信息称为消息验证码(MAC) ，可保护消息的数据完整性及其真实性。 实现它的算法很多，例如HMAC ， GCM等。

加密 (Encryption)

The process of encrypting a file using Go is simple. Using the package crypto we can do all the necessary steps to encrypt a file.

使用Go加密文件的过程很简单。 使用包crypto我们可以执行所有必要的步骤来加密文件。

The first step is to open the file and read its content.

第一步是打开文件并读取其内容。

The next step is to create the block for our algorithm. This object implements the actual code so we don’t have to worry about it. In this tutorial, we are going to use AES.

下一步是为我们的算法创建块。 该对象实现了实际的代码，因此我们不必担心。 在本教程中，我们将使用AES。

The key must be 16 bytes (AES-128), 24 bytes (AES-192), or 32 bytes (AES-256), which we read from a file.

密钥必须是16字节(AES-128)，24字节(AES-192)或32字节(AES-256)，这些是我们从文件中读取的。

Note: Never save your key on your code.

注意 ： 切勿将密钥保存在代码中。

As mentioned above, there are some modes you can encrypt your message. For our convenience, the package crypto/cipher already implements some of them for us.

如上所述，您可以使用某些模式来加密邮件。 为了我们的方便，软件包crypto/cipher已经为我们实现了其中的一些。

We are going to use the GCM mode, which is a stream mode with authentication. So we don’t have to worry about the padding or doing the authentication, since it is already done by the package.

我们将使用GCM模式，这是带有身份验证的流模式。 因此，我们不必担心填充或进行身份验证，因为它已经由程序包完成了。

This mode requires a nonce array. It works like an IV. Make sure this is never the same value, that is, change it every time you will encrypt, even if it is the same file. You can do this with a random value, using the package crypto/rand.

此模式需要一个随机数数组。 它像IV一样工作。 确保此值永远不会相同，也就是说，即使您是同一文件，也要在每次加密时都对其进行更改。 您可以使用crypto/rand软件包使用随机值来执行此操作。

To encrypt the data, we use the function Seal. It will encrypt the file using the GCM mode, appending the nonce and tag (MAC value) to the final data, so we can use it to decrypt it later.

为了加密数据，我们使用功能Seal 。 它将使用GCM模式加密文件，将nonce和tag (MAC值)附加到最终数据中，因此我们以后可以使用它解密它。

After this, we just need to save the ciphertext into our destination file.

之后，我们只需要将密文保存到目标文件中即可。

That’s it! You’ve encrypted a file. And the complete code:

而已！ 您已加密文件。 以及完整的代码：

解密方式 (Decryption)

To decrypt the file, the process is basically the same. We have now to read the encrypted file instead.

解密文件的过程基本相同。 现在，我们必须读取加密的文件。

Creating the key and the mode block is the same as in the encryption process. Make sure you use the same key as you used to encrypt since this is a symmetric-key algorithm.

创建密钥和模式块与加密过程中的相同。 由于这是对称密钥算法，因此请确保使用与加密相同的密钥。

To decrypt our file, we use the Open function. It is necessary to indicate the nonce value we used in the encryption process. In our encryption process, this value is saved at the beginning of the file.

要解密文件，我们使用“ Open功能。 有必要指出我们在加密过程中使用的nonce值。 在我们的加密过程中，此值保存在文件的开头。

Finally, we just have to save our decrypt content into a file.

最后，我们只需要将解密内容保存到文件中即可。

加密大文件 (Encrypting large files)

Although this is a simple method to encrypt files, it can be a bad option for large files. All the content is read into memory before it is encrypted. To avoid any problem, we have to read and encrypt by chunks.

尽管这是一种加密文件的简单方法，但是对于大文件而言，这可能是一个糟糕的选择。 加密之前，所有内容都会读入内存。 为了避免任何问题，我们必须按块读取和加密。

To do this, we first open the file we are interested in encrypting using the os.Open function.

为此，我们首先使用os.Open函数打开要加密的文件。

The key and block creation is the same as the previous example, so I am not going to repeat here.

密钥和块的创建与前面的示例相同，因此在此不再重复。

We can use the CTR mode since is a stream mode and very close to the GCM. This mode also needs an IV, the same size as the block (for AES, 16 bytes).

我们可以使用CTR模式，因为它是流模式并且非常接近GCM。 此模式还需要一个IV，其大小与块相同(对于AES，为16字节)。

Before entering the actual reading loop, we have to open the destination file to be able to write into it.

在进入实际的读取循环之前，我们必须打开目标文件才能进行写入。

After that, we read the file by chunks. In this tutorial, we choose a buffer of 1024 bytes, but you can choose any size you prefer.

之后，我们按块读取文件。 在本教程中，我们选择一个1024字节的缓冲区，但是您可以选择自己喜欢的任何大小。

For each block read from the input file, we perform the encryption process using the function XORKeyStream.

对于从输入文件读取的每个块，我们使用功能XORKeyStream进行加密过程。

After that, we save the IV that we used into the destination file so we can use it to decrypt. The complete code:

之后，我们将使用的IV保存到目标文件中，以便我们可以使用它进行解密。 完整的代码：

解密大文件 (Decrypting large files)

To decrypt it, we have to change only a thing: read the IV from the file instead of the random value. This value is saved on the final of the file, so it’s easy to read.

要解密它，我们只需要改变一点：从文件中读取IV，而不是随机值。 此值保存在文件的末尾，因此很容易阅读。

In the CTR mode, the encryption and decryption processes are the same, so we actually don’t need to change anything.

在CTR模式下，加密和解密过程相同，因此我们实际上不需要更改任何内容。

The complete code for the decryption part:

解密部分的完整代码：

It is important to note that we did not use any form of authentication. This can be done easily using the crypto/hmac package. After the MAC value is calculated, you can append it to the destination file. To the decryption process, you have to read it and compare it with the new calculation you perform.

重要的是要注意，我们没有使用任何形式的身份验证。 使用crypto/hmac包可以很容易地做到这一点。 计算MAC值后，可以将其附加到目标文件。 在解密过程中，您必须阅读它并将其与执行的新计算进行比较。

结论 (Conclusion)

Encrypting a file using the Go language is not difficult using the crypto package.

使用crypto软件包使用Go语言加密文件并不困难。

If you are also interesting in how to create a hash using Go, check out this other article:

如果您对如何使用Go创建哈希也很感兴趣，请查看另一篇文章：

Follow me on Twitter if you want to receive more articles about programming.

如果您想获得更多有关编程的文章，请在Twitter上关注我。