[mcly]

TL;DR : The aes decryption does not remove padding from my php encrypted data

So i have a php page that returns encrypted content, the client downloads this content and then decrypts it using aes, viewing this decrypted "text" it looks just like the original message, but when i tried to display the data, it seems like there are like 20 spaces after the decrypted text ( the stauts code displays the message up until to the decrypted message, then there is space that covers the rest of the message)

So i've when you debug this, you can only see the decrypted message, no space, no "0", no nothing, just the decrypted message in quotes

for example : "hello"

Now when i viewed the lenght of this string, the lenght was way above it was supposed to be (32) which leads to the conclusion that there is some random space/nulls (which is probably padding) that didnt get removed from the aes decryption function..

hexing this string showed that the "hello" part existed, but after that it was filled with around twenty 0's

So ive made a temporary fix by hexing the string, then removing the 0's and converting the hex back to a string..

Now lets show you some code im using, first of all, yes the keysize, the blocksize, the Ciphermode and the padding for both php and vbnet match (i use mcrypt_encrypt for php, which only supports zero padding as ive read, vbnet uses zero padding too)

Anyway, here is my php aes encryption code

PHP Code


<?php 
function encryptRJ256($string_to_encrypt){
    $key = "_mykeyhere_";
    $iv  = "_mykeyhere_"; 
    $rtn = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $string_to_encrypt, MCRYPT_MODE_CBC, $iv);
    $rtn = base64_encode($rtn);
    return($rtn);} 


Seems pretty simple right? Anyway, here is my matching vb.net code

PHP Code


<?php 
Public Function PHPDecrypt(ByVal prm_text_to_decrypt As String) As String
      Try
      Dim sEncryptedString As String = prm_text_to_decrypt
      Dim myRijndael As New RijndaelManaged
      myRijndael.Padding = PaddingMode.Zeros
      myRijndael.Mode = CipherMode.CBC
      myRijndael.KeySize = 256
      myRijndael.BlockSize = 256
      Dim key() As Byte = System.Text.Encoding.ASCII.GetBytes("_mykeyhere_") ' Key
      Dim IV() As Byte = System.Text.Encoding.ASCII.GetBytes("_mykeyhere_") 'IV
      Dim decryptor As ICryptoTransform = myRijndael.CreateDecryptor(key, IV)
      Dim sEncrypted As Byte() = Convert.FromBase64String(sEncryptedString)
      Dim fromEncrypt() As Byte = New Byte(sEncrypted.Length) {}
      Dim msDecrypt As New MemoryStream(sEncrypted)
      Dim csDecrypt As New CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read)
      csDecrypt.Read(fromEncrypt, 0, fromEncrypt.Length)
      Return System.Text.Encoding.ASCII.GetString(fromEncrypt)
      Catch ex As Exception
      Return prm_text_to_decrypt
      End Try
    End Function 


Now this will result in me getting a message that is properly decrypted, but has the padding not removed (as i desribed, "hello" gets decrypted fine, but it contains 0's from the padding.. (the amount of 0's are always different and go from 20-40)

Can someone help me or guide me to what im doing wrong?

[Only3]

all u need here http://www.php.net/manual/en/function.mc...ncrypt.php

[mcly]

all u need here http://www.php.net/manual/en/function.mc...ncrypt.php

Did you read my post mate? :(
Im using this, and the encryption is working fine, the decryption (the padding removal part) is the problem (i believe)

[Only3]

did u read about padding there ? No !
here working example read the replys u cant just c&p http://stackoverflow.com/questions/12789...decryption

[mcly]

did u read about padding there ? No !
here working example read the replys u cant just c&p http://stackoverflow.com/questions/12789...decryption

Yes i did!
I understand the code and i did not "blindly" copy paste it without trying to understand it, why do you accuse me of that?
PHP uses zero as default pedding method, maybe you should read it up?
http://www.php.net/manual/en/function.mc...ncrypt.php

Code

# creates a cipher text compatible with AES (Rijndael block size = 128)
    # to keep the text confidential
    # only suitable for encoded input that never ends with value 00h
    # (because of default zero padding)

The encryption process does not work without a padding (because otherwise it wouldnt fit to a multiply of 8 or 16 i believe)

Anyway, even if it didnt use ANY padding at all, how comes the decrypted messages have 20-40 null bytes (zeros) appended to the text? (Clearly, that has to be the ZERO padding)

My question is not how to add padding to the php encryption method, it rather is how to remove the padding, normally it should do that in the decryption process (that is why you have to specify the padding method before you can decrypt)

Here is, (in case you didn't notice) a part of the padding from my vb.net decryption code to show you that i infact DID declare the correct padding

Code

Dim myRijndael As New RijndaelManaged
      myRijndael.Padding = PaddingMode.Zeros
      myRijndael.Mode = CipherMode.CBC
      myRijndael.KeySize = 256

Can anyone tell me what im doing wrong? Maybe someone experienced in here?

[Banksу]

Stream.Read(byte[], int, int) returns an integer indicating the amount of bytes read. Just get that value and then resize the array to what was returned.

[mcly]

Stream.Read(byte[], int, int) returns an integer indicating the amount of bytes read. Just get that value and then resize the array to what was returned.

Im pretty sure that that would just return the length of the string + the 0 bytes, so that would be kind of useless!?

Because the response from the php site would obviously be lets say

hello000000 (something like that encrypted ofcourse)

Now the decryption method is supposed to remove the 0 (zero padding) while decrypting, but it doesnt do that.. Now when i read the length of this , it will obviously return the wrong value for me to just take the substring for the hello..

The only way this would work is if the server would respond with the encrypted data+ data length, but encrypting the data length response would cause the same problem.. If i return the data length in plaintext without encryption, then im pretty sure that that would compromise the encryption security (im pretty sure that knowing the data length would compromise the encryption security )

But the big main question is, why does my decryption not remove the zero padding? What am i doing wrong? Does noone of you guys use aes encryption for php/vb.net? Dont you have a crypter too that uses encrypted traffic?

[Banksу]

Im pretty sure that that would just return the length of the string + the 0 bytes, so that would be kind of useless!?

Because the response from the php site would obviously be lets say

hello000000 (something like that encrypted ofcourse)

Now the decryption method is supposed to remove the 0 (zero padding) while decrypting, but it doesnt do that.. Now when i read the length of this , it will obviously return the wrong value for me to just take the substring for the hello..

The only way this would work is if the server would respond with the encrypted data+ data length, but encrypting the data length response would cause the same problem.. If i return the data length in plaintext without encryption, then im pretty sure that that would compromise the encryption security (im pretty sure that knowing the data length would compromise the encryption security )

But the big main question is, why does my decryption not remove the zero padding? What am i doing wrong? Does noone of you guys use aes encryption for php/vb.net? Dont you have a crypter too that uses encrypted traffic?

Have you tried what I told you to try?

[mcly]

Have you tried what I told you to try?

Sure, but where is the point? I dont understand it..
It returns the length of the string+padding (32 as double)

the string i expected (without the padding) has the length of 8

Like i said, the problem seems to be that the decryption does not remove the zero padding.. I just dont understand why it does not

[Banksу]

http://forums.asp.net/t/1545978.aspx?AES...ption+help

This might help you.