[SOLVED] Unusual encryption results with php's mcrypt

action_owl · 05-30-2010, 09:31 PM

I have a simple class that encrypts strings. It seemed to be working fine until I tried to compare the decrypted values to the original. below is the output of the php code. It appears to be decrypted but the length is incorrect.

String Before Encryption: a text string
String Length Before Encryption: 13

String After Encryption: rew2iSYotruIpmJ3llos3A==
String Length After Encryption: 24

String After Decryption: a text string
String Length After Decryption: 16

Any insight would be very helpful, thanks.

Code:

<?

class Encryption 
{
    private $key;
	
    public function __construct($key='Some_Encryption_Key')
    {
	$this->key = $key;
    }

    public function encrypt( $string )
    {
        return base64_encode
        (
        	mcrypt_encrypt
        	(
        		MCRYPT_RIJNDAEL_128, 
        		$this->key, 
        		$string, 
        		MCRYPT_MODE_ECB
        	) 
        );
    }
 
    public function decrypt( $string )
    {
        return mcrypt_decrypt
        ( 
        	MCRYPT_RIJNDAEL_128, 
        	$this->key, 
        	base64_decode( $string ), 
        	MCRYPT_MODE_ECB
        );
    }
}

$e = new Encryption();

$string = 'a text string';

echo "String Before Encryption: $string <br>";
echo 'String Length Before Encryption: ' . strlen($string) . "<br><br>";

$string = $e->encrypt($string);

echo "String After Encryption: $string <br>";
echo 'String Length After Encryption: ' . strlen($string) . "<br><br>";

$string = $e->decrypt($string);

echo "String After Decryption: $string <br>";
echo 'String Length After Decryption: ' . strlen($string) . "<br><br>";

?>

Same results when calling functions directly:

Encrypted Using mcrypt function directly: ì6‰&(¶»ˆ¦bw–Z,Ü
Decrypted Using mcrypt function directly: a text string
String After Decryption: a text string
String Length After Decryption: 16

Code:

$string = 'a text string';
$key = 'Some_Encryption_Key';

$string = mcrypt_encrypt
(
	MCRYPT_RIJNDAEL_128, 
	$key, 
	$string, 
	MCRYPT_MODE_ECB
);

echo "Encrypted Using mcrypt function directly: $string <br>";    	

$string = mcrypt_decrypt
(
	MCRYPT_RIJNDAEL_128, 
	$key, 
	$string, 
	MCRYPT_MODE_ECB
);

echo "Decrypted Using mcrypt function directly: $string <br>";    	
echo "String After Decryption: $string <br>";
echo 'String Length After Decryption: ' . strlen($string) . "<br><br>";

grail · 05-30-2010, 09:54 PM

Well on initial inspection I would say that your manual method is not the same as there is no reference to the use of base64_[en|de]code.
If you utilise these functions is your data still correct with the manual method?

action_owl · 05-30-2010, 10:10 PM

The data is still not returned correctly when using base64_[en|de]code and calling the functions directly.

Encrypted Using mcrypt function directly: rew2iSYotruIpmJ3llos3A==
Decrypted Using mcrypt function directly: a text string
String After Decryption: a text string
String Length After Decryption: 16

Code:

// with base64_[en|de]code

$string = 'a text string';
$key = 'Some_Encryption_Key';

$string = base64_encode
(
	mcrypt_encrypt
	(
		MCRYPT_RIJNDAEL_128, 
		$key, 
		$string, 
		MCRYPT_MODE_ECB
	) 
);

echo "Encrypted Using mcrypt function directly: $string <br>";    	

$string = mcrypt_decrypt
(
	MCRYPT_RIJNDAEL_128, 
	$key, 
	base64_decode( $string ), 
	MCRYPT_MODE_ECB
);

echo "Decrypted Using mcrypt function directly: $string <br>";    	
echo "String After Decryption: $string <br>";
echo 'String Length After Decryption: ' . strlen($string) . "<br><br>";

grail · 05-30-2010, 10:19 PM

My bad

I thought you had said it was working manually (RTFQ)

grail · 05-30-2010, 10:30 PM

hmmm ... I have not played a lot with php but when doing a similar exercise in Python you are required to supply the padding for some of the encryption methods.
I noticed after reading a little on mcrypt that it automatically pads for you, so I am wondering if it is this padding that you are getting in the length?
What happens if you try a slightly shorter or longer string? (maybe try 16 characters first to see if that shows us something?)

action_owl · 05-30-2010, 10:31 PM

If I use base64_[en|de]code on the string before and after encrypting,then it will produce the proper results, though I'm not exactly sure why I have to do this. Perhaps mcrypt requires a base64_encoded string to begin with?

Encrypted Using mcrypt function directly: pzQc7oBucoR7KBh+el31g0Rl5dZTwfPDSrNoy8Y9LHc=
Decrypted Using mcrypt function directly: a text string
String After Decryption: a text string
String Length After Decryption: 13

Code:

$string = base64_encode('a text string');
$key = 'Some_Encryption_Key';

$string = base64_encode
(
	mcrypt_encrypt
	(
		MCRYPT_RIJNDAEL_128, 
		$key, 
        $string, 
        MCRYPT_MODE_ECB
	) 
);

echo "Encrypted Using mcrypt function directly: $string <br>";    	

$string = mcrypt_decrypt
(
	MCRYPT_RIJNDAEL_128, 
	$key, 
	base64_decode( $string ), 
	MCRYPT_MODE_ECB
);

$string = base64_decode($string);

echo "Decrypted Using mcrypt function directly: $string <br>";    	
echo "String After Decryption: $string <br>";
echo 'String Length After Decryption: ' . strlen($string) . "<br><br>";

action_owl · 05-30-2010, 10:41 PM

Quote:

Originally Posted by grail

hmmm ... I have not played a lot with php but when doing a similar exercise in Python you are required to supply the padding for some of the encryption methods.
I noticed after reading a little on mcrypt that it automatically pads for you, so I am wondering if it is this padding that you are getting in the length?
What happens if you try a slightly shorter or longer string? (maybe try 16 characters first to see if that shows us something?)

I think this is what's happening.
I get proper string length returned with strings that are 16 or 32 characters in length but incorrect results with 13 and 31.

Here's is the properly working encryption class:

Code:

class Encryption 
{
    private $key;
	
    public function __construct($key='Some_Encryption_Key')
    {
	$this->key = $key;
    }

    public function encrypt( $string )
    {
        return base64_encode
        (
        	mcrypt_encrypt
        	(
        		MCRYPT_RIJNDAEL_128, 
        		$this->key, 
        		base64_encode( $string ), 
        		MCRYPT_MODE_ECB
        	) 
        );
    }
 
    public function decrypt( $string )
    {
        return base64_decode
        ( 
			mcrypt_decrypt
			(
				MCRYPT_RIJNDAEL_128, 
				$this->key, 
				base64_decode( $string ), 
				MCRYPT_MODE_ECB
			)
		);
    }
}

grail · 05-31-2010, 02:24 AM

Glad you got it, although I am curious what would happen if you just return the output from mcrypt_[en|de]crypt as it returns a string?