AES encryption/decryption in javascript using CryptoJS

anthonyc

I am trying to send AES encrypted messages between javascript and php using a shared secret. In Javascript I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it in php using the shared secret. I can encrypt and decrypt a message in Javascript. I can encrypt and decrypt the same message in php - but the encryption is not the same between the two.

The Javascript

var encrypted = CryptoJS.AES.encrypt("Message", "Secret Passphrase");
alert(encrypted);

Gives

U2FsdGVkX18+k3pba4l4MbGZfmDjMc1yQ6uj1fg+BGo=

In php

<?php
$Pass = "Secret Passphrase";
$Clear = "Message";

$crypted = fnEncrypt($Clear, $Pass);
echo "Encrypted: ".$crypted."</br>";

$newClear = fnDecrypt($crypted, $Pass);
echo "Decrypted: ".$newClear."</br>";

function fnEncrypt($sValue, $sSecretKey) {
return rtrim(
        base64_encode(
                mcrypt_encrypt(
                        MCRYPT_RIJNDAEL_256,
                        $sSecretKey, $sValue,
                        MCRYPT_MODE_ECB,
                        mcrypt_create_iv(
                                mcrypt_get_iv_size(
                                        MCRYPT_RIJNDAEL_256,
                                        MCRYPT_MODE_ECB
                                ),
                                MCRYPT_RAND
                        )
                )
        ),"\0"
);
}

function fnDecrypt($sValue, $sSecretKey) {
return rtrim(
        mcrypt_decrypt(
                MCRYPT_RIJNDAEL_256,
                $sSecretKey,
                base64_decode($sValue),
                MCRYPT_MODE_ECB,
                mcrypt_create_iv(
                        mcrypt_get_iv_size(
                                MCRYPT_RIJNDAEL_256,
                                MCRYPT_MODE_ECB
                        ),
                        MCRYPT_RAND
                )
        ),"\0"
);
}

The output is

Encrypted: iqJ0R5ahRP7GpWKtW7+OBSCGnudDr99VbJC36OQlmgE=

Decrypted: Message

My question is, why are these not the same?

Chris

It would be a crypographic catastrophy if they would be the same...

However: Using the way you used your PHP Encryption (using EBC mode) you will always get the same result. You can see why this is a problem by looking at the tux pciture at http://en.wikipedia.org/wiki/Cipher_block_chaining#Electronic_codebook_.28ECB.29

CryptoJS seems to use CBC as a default block cipher mode (at least they say so in https://code.google.com/p/crypto-js/#Block_Modes_and_Padding), which has a random initial vector. This is better than CBC.

The result should be the same, if you use the same cipher, the same block cipher mode (e.g. CBC) and the same key and IV - and of course the same plaintext - the comments indicate that there also might be a unicode issue.

Additionally the MCRYPT_RIJNDAEL_256 is not AES. AES has a BLOCK size of 16 byte - AES-128 has a KEY size of 16 byte, AES-256 has a KEY size of 32 byte. MCRYPT_RIJNDAEL_256 has a BLOCK size of 32 byte - that's a big difference.

One last note: It is not enough to encrypt data! You must also authenticate it, by either using a HMAC or by using an authenticated block cipher mode like GCM - if you don't do this you may be vulnerable to at least a padding oracle attack: http://en.wikipedia.org/wiki/Padding_oracle_attack

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

From Dev

AES encryption/decryption in javascript using CryptoJS

From Dev

How to decrypt with CryptoJS using AES?

From Dev

Encrypt with AES using phpseclib and decrypt with CryptoJS

From Dev

Decrypting AES with Javascript CryptoJS after encrypting with PHP mcrypt

From Dev

AES decryption with password using CryptoJS returns a blank value

From Dev

How to achieve CryptoJS decryption using aes-128-cbc algorithm?

From Dev

Problems when using AES crypto between Node and CryptoJS in browser

From Dev

Decrypt openssl AES with CryptoJS

From Dev

CryptoJS incorrect AES encoding

From Dev

CryptoJS AES pattern always ends with =

From Dev

cryptojs: How to generate AES passphrase

From Dev

CryptoJS, check if AES passphrase is correct

From Dev

Are the default CryptoJS AES params secure?

From Dev

AES encryption with CryptoJS and decryption with CodeIgniter

From Dev

How to decrypt password from JavaScript CryptoJS.AES.encrypt(password, passphrase) in Python

From Dev

How to decrypt an encrypted AES-256 string from CryptoJS using Java?

From Java

Achieve same encryption using CryptoJS (JAVASCRIPT) and OpenSSL (PHP)

From Dev

AES encryption using Java and decryption using Javascript

From Dev

How to make a String out of a CryptoJS AES Object?

From Dev

AES Encryption in C# and decryption in CryptoJS

From Dev

Create CryptoJS AES Cipher Encryptor to Decrypt in .NET

From Dev

sync AES ecnryption between cryptoJS and openSSL (ruby)

From Dev

Create CryptoJS AES Cipher Encryptor to Decrypt in .NET

From Dev

Porting AES decryption from CryptoJS to PyCrypto

From Dev

Will this CryptoJS AES encryption code produce secure output?

From Dev

Getting 2 different decrypted values from very similar AES implementation using cryptoJS (getting a wrong result value for the 16th char)

From Dev

decrypt using cryptojs not working

From Dev

CryptoJS decrypting (AES) a file bytearray coming from Java

From Dev

AES algorithm value differences between .NET and nodejs, CryptoJS

Related Related

  1. 1

    AES encryption/decryption in javascript using CryptoJS

  2. 2

    How to decrypt with CryptoJS using AES?

  3. 3

    Encrypt with AES using phpseclib and decrypt with CryptoJS

  4. 4

    Decrypting AES with Javascript CryptoJS after encrypting with PHP mcrypt

  5. 5

    AES decryption with password using CryptoJS returns a blank value

  6. 6

    How to achieve CryptoJS decryption using aes-128-cbc algorithm?

  7. 7

    Problems when using AES crypto between Node and CryptoJS in browser

  8. 8

    Decrypt openssl AES with CryptoJS

  9. 9

    CryptoJS incorrect AES encoding

  10. 10

    CryptoJS AES pattern always ends with =

  11. 11

    cryptojs: How to generate AES passphrase

  12. 12

    CryptoJS, check if AES passphrase is correct

  13. 13

    Are the default CryptoJS AES params secure?

  14. 14

    AES encryption with CryptoJS and decryption with CodeIgniter

  15. 15

    How to decrypt password from JavaScript CryptoJS.AES.encrypt(password, passphrase) in Python

  16. 16

    How to decrypt an encrypted AES-256 string from CryptoJS using Java?

  17. 17

    Achieve same encryption using CryptoJS (JAVASCRIPT) and OpenSSL (PHP)

  18. 18

    AES encryption using Java and decryption using Javascript

  19. 19

    How to make a String out of a CryptoJS AES Object?

  20. 20

    AES Encryption in C# and decryption in CryptoJS

  21. 21

    Create CryptoJS AES Cipher Encryptor to Decrypt in .NET

  22. 22

    sync AES ecnryption between cryptoJS and openSSL (ruby)

  23. 23

    Create CryptoJS AES Cipher Encryptor to Decrypt in .NET

  24. 24

    Porting AES decryption from CryptoJS to PyCrypto

  25. 25

    Will this CryptoJS AES encryption code produce secure output?

  26. 26

    Getting 2 different decrypted values from very similar AES implementation using cryptoJS (getting a wrong result value for the 16th char)

  27. 27

    decrypt using cryptojs not working

  28. 28

    CryptoJS decrypting (AES) a file bytearray coming from Java

  29. 29

    AES algorithm value differences between .NET and nodejs, CryptoJS

HotTag

Archive