Zadbaj o dobrą organizację dzięki kolekcji
Zapisuj i kategoryzuj treści zgodnie ze swoimi preferencjami.
Interfejsy API Tink przyjmują jako dane wejściowe dowolne binarne bloby. Oznacza to, że jeśli chcesz
szyfrować uporządkowane dane,
bufory protokołów, musisz
zakodować dane w pierwszej kolejności.
Szyfruj bufor protokołu
Aby zaszyfrować:
Zserializuj protobuf do tablicy bajtów.
Zaszyfruj zserializowane bajty, a następnie zapisz lub wyślij wynikowy tekst szyfrowany.
Użyj:
Przechowuj serializowane bajty razem z podpisem (lub MAC).
Weryfikacja:
Pobierz zserializowany protokół i jego podpis (lub MAC).
Sprawdź podpis (lub MAC).
Deserializuj protobuf.
Pamiętaj, że prawidłowy podpis lub adres MAC nie gwarantuje poprawności danych.
. Implementacja analizująca dane powinna zawsze oczekiwać, że
mogą ulec uszkodzeniu.
Ochrona wielu elementów danych
Aby chronić wiele elementów danych, użyj metody serializacji. Dodaj wszystkie dane
do protokołu i zaszyfrować (lub uwierzytelnić) go w sposób opisany powyżej.
[null,null,["Ostatnia aktualizacja: 2025-07-25 UTC."],[[["\u003cp\u003eTink APIs accept arbitrary binary data as input, requiring serialization of structured data like Protocol Buffers before encryption.\u003c/p\u003e\n"],["\u003cp\u003eTink provides various encryption methods like AEAD, hybrid encryption, and deterministic AEAD to secure serialized data.\u003c/p\u003e\n"],["\u003cp\u003eTink supports data integrity through digital signatures and MACs, but verification doesn't guarantee data formatting.\u003c/p\u003e\n"],["\u003cp\u003eProtecting multiple data items involves serialization, preferably using Protocol Buffers or length-prefixed concatenation, followed by encryption or authentication.\u003c/p\u003e\n"]]],["Tink API handles binary blobs, requiring structured data like protocol buffers to be encoded first. To encrypt a protobuf, serialize it to bytes, then encrypt using AEAD, hybrid, or deterministic AEAD methods. Decryption involves decrypting the ciphertext and deserializing the protobuf. To protect from tampering, serialize, then sign or authenticate using digital signature or MAC, storing the signature with the data, verifying the signature before deserializing. Protecting multiple items requires serialization via a protobuf or a length-prefixed method, followed by encryption or authentication.\n"],null,["# I want to protect structured data\n\nTink APIs take arbitrary binary blobs as input. This means that if you want to\nencrypt structured data, like\n[protocol buffers](https://developers.google.com/protocol-buffers), you need to\nencode the data first.\n\nEncrypt a protobuf\n------------------\n\nTo encrypt:\n\n1. Serialize the protobuf to a byte array.\n2. Encrypt the serialized bytes, then store or send the resulting ciphertext. Use:\n - [Authenticated encryption with associated data (AEAD)](/tink/aead)\n - [Hybrid encryption](/tink/hybrid)\n - [Deterministic AEAD](/tink/deterministic-aead)\n\nTo decrypt:\n\n1. Decrypt the ciphertext.\n2. If Step 1 was successful, deserialize the protobuf.\n\nProtect a protobuf from tampering\n---------------------------------\n\nIn most cases, encrypting a protobuf is preferable to authentication alone.\n\nTo protect a protobuf from tampering:\n\n1. Serialize the protobuf to a byte array.\n2. Sign or authenticate the serialized bytes. Use:\n - [Digital signature](/tink/digital-signature)\n - [MAC](/tink/mac)\n3. Store the serialized bytes together with the signature (or MAC).\n\nTo verify:\n\n1. Get the serialized protobuf and its signature (or MAC).\n2. Verify the signature (or MAC).\n3. Deserialize the protobuf.\n\nNote that a valid signature or MAC does not guarantee that the data is correctly\nformatted. An implementation that parses the data should always expect that the\ndata might be corrupt.\n\nProtect multiple data items\n---------------------------\n\nTo protect multiple data items, use a serialization method. Add all of the data\nitems to a protobuf, and encrypt (or authenticate) it as described above.\n\nYou can also serialize as follows: \n\n serialize(data1 , data2 , ..., datan) = 4-byte-data1's length || data1 || 4-byte-data2's length || data2 || ... || 4-byte-dataN's length || dataN\n\n| **Warning:** Concatenating without a length prefix, like `data1 || data2 || ... || dataN`, can lead to vulnerabilities as the resulting encoding is ambiguous. For example if `data1 = \"foo\"` and `data2 = \"bar\"`, this would lead to the same encoded data as `data1 = \"fooba\"` and `data2 = \"r\"`.\n\nFinally, encrypt (or authenticate) the resulting byte array."]]
