简易文件加密工具怎么做 基本加密算法实现方案

import os
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
import hashlib

def derive_key(password: str, salt: bytes) -> bytes:
    """从密码和salt生成256位密钥"""
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        iterations=100000,
    )
    key = kdf.derive(password.encode())
    return key

def encrypt_file(input_path: str, output_path: str, password: str):
    # 生成随机salt和IV
    salt = os.urandom(16)
    iv = os.urandom(16)

    # 生成密钥
    key = derive_key(password, salt)

    # 初始化AES加密器
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
    encryptor = cipher.encryptor()

    with open(input_path, 'rb') as f_in, open(output_path, 'wb') as f_out:
        # 先写入salt和IV（用于解密）
        f_out.write(salt)
        f_out.write(iv)

        chunk = f_in.read(16)
        while len(chunk) > 0:
            if len(chunk) % 16 != 0:
                # 填充到16字节对齐（PKCS7）
                padding_len = 16 - (len(chunk) % 16)
                chunk += bytes([padding_len]) * padding_len
            encrypted_chunk = encryptor.update(chunk)
            f_out.write(encrypted_chunk)
            chunk = f_in.read(16)
        # 完成加密
        f_out.write(encryptor.finalize())

def decrypt_file(input_path: str, output_path: str, password: str):
    with open(input_path, 'rb') as f_in, open(output_path, 'wb') as f_out:
        # 读取salt和IV
        salt = f_in.read(16)
        iv = f_in.read(16)

        # 用相同密码生成密钥
        key = derive_key(password, salt)

        cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
        decryptor = cipher.decryptor()

        chunk = f_in.read(16)
        buffer = b''
        while len(chunk) > 0:
            buffer += chunk
            if len(buffer) % 16 == 0:
                decrypted = decryptor.update(buffer)
                f_out.write(decrypted)
                buffer = b''
            chunk = f_in.read(16)

        # 处理最后一块（包含填充）
        final_data = decryptor.finalize()
        f_out.write(final_data)

        # 可选：移除PKCS7填充（从末尾判断填充字节）
        # 这里省略，实际应用中需处理