Encryption Algorithm returning different value in php and javascript

Question

In PHP

<?php
  $token = '[email protected]|ts=1412917909|hash=r1xWbgfHUxDLlppGYuOKQJdIM1MTrkryEArkMQx9ERw=|url=http://myintranet.com';
  $key = 'a1cbbb6eb5cb2c1c27a9f02a4434d3af';
  $token =  mb_convert_encoding( $token ,'UTF-16LE' );
  $blockSize = 16;
  $pad = $blockSize - (strlen($token) % $blockSize);
  $token .= str_repeat(chr($pad), $pad);
  $token = mcrypt_encrypt(MCRYPT_RIJNDAEL_128,$key, $token, MCRYPT_MODE_CBC, $iv);

  $token = base64_encode($token);
  echo "\n This is the token $token \n";
?>

Output -:

 This is the token TXz3UEgAdjGhyriNGcMJBUk4QcW3dA7rttzjbKztw19X8bSIMDZt8s6uSQy2OP5QcSpJuReKv73wFXzPyCXt05CNY6XWlx9Lfrv6Nosj0+4mHdD7/Wvx0QWqxuuv5qv4sgtgSif59Wy/ZAoYhfH8yzN/3hWnx6zzOrV6jxyDttmffk1zcBwtJ3X41mMVbPLOd1/2K3ZYxCcJ1VxESFDNB4N1okvGMRkCM0tL77oZiKv+n6CP9FEgKivCfvytFB8JWc9K++8vbLdV/iGgkEa7h0pfAZtYpryQQjFzqLx8NSQ=

In Javascript

'use strict';

var CryptoJS = require("crypto-js");

String.prototype.repeat = function( num )
{
    return new Array( num + 1 ).join( this );
}

function encodeUTF16LE(str) {
    var out, i, len, c;
    var char2, char3;

    out = "";
    len = str.length;
    i = 0;
    while(i < len) {
        c = str.charCodeAt(i++);
        switch(c >> 4)
        {
          case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
            // 0xxxxxxx
            out += str.charAt(i-1);
            break;
          case 12: case 13:
            // 110x xxxx   10xx xxxx
            char2 = str.charCodeAt(i++);
            out += String.fromCharCode(((c & 0x1F) << 6) | (char2 & 0x3F));
            out += str.charAt(i-1);
            break;
          case 14:
            // 1110 xxxx  10xx xxxx  10xx xxxx
            char2 = str.charCodeAt(i++);
            char3 = str.charCodeAt(i++);
            out += String.fromCharCode(((c & 0x0F) << 12) | ((char2 & 0x3F) << 6) | ((char3 & 0x3F) << 0));
            break;
        }
    }

    var byteArray = new Uint8Array(out.length * 2);
    for (var i = 0; i < out.length; i++) {
        byteArray[i*2] = out.charCodeAt(i); // & 0xff;
        byteArray[i*2+1] = out.charCodeAt(i) >> 8; // & 0xff;
    }

    return String.fromCharCode.apply( String, byteArray );
}

var token = '[email protected]|ts=1412917909|hash=r1xWbgfHUxDLlppGYuOKQJdIM1MTrkryEArkMQx9ERw=|url=http://myintranet.com';
var key = 'a1cbbb6eb5cb2c1c27a9f02a4434d3af';
var blockSize = 16;
token =  encodeUTF16LE(token);
var pad = blockSize - (token.length % blockSize);

token = token + (String.fromCharCode(pad)).repeat(pad);

token = CryptoJS.AES.encrypt(token, key,
    {   iv: iv,
        mode: CryptoJS.mode.CBC
    });

console.log("\n This is the token " + token + "\n");

token = token.ciphertext.toString(CryptoJS.enc.Base64);
console.log("\n This is the token " + token + "\n");

Output

This is the token U2FsdGVkX19iQjVHkx/vmhljCsRyTBUA0QFJ8I+pPvxAa2dK6iO4r9FUw2Um2j0H+iyXZ/G0UO0fhJTFzfJEfS1cMfAaq0Z7UBUpVhtrH5IArr2F3BI6yWC8Kpo4ZimyW+xnWp0BYUpLUNQTLsFooiIqPHv3s9HHMe3k0altm6ou1pAKaIr8IAY1OzIDTbaRO55mPf0rU6Z2XTLGR6kYoAx9Lk4dZ3RA66cynXWFMuHznL0fik3phZ8cUiKd/Twquil97YHT+CB/1ulxEBD17VQvnsCJI1lYNn9dyWAUG96KMgGk3jFxiW9eRzV5Poywnt0QNaRpmZiG41KNFmtMtw==


This is the token GWMKxHJMFQDRAUnwj6k+/EBrZ0rqI7iv0VTDZSbaPQf6LJdn8bRQ7R+ElMXN8kR9LVwx8BqrRntQFSlWG2sfkgCuvYXcEjrJYLwqmjhmKbJb7GdanQFhSktQ1BMuwWiiIio8e/ez0ccx7eTRqW2bqi7WkApoivwgBjU7MgNNtpE7nmY9/StTpnZdMsZHqRigDH0uTh1ndEDrpzKddYUy4fOcvR+KTemFnxxSIp39PCq6KX3tgdP4IH/W6XEQEPXtVC+ewIkjWVg2f13JYBQb3ooyAaTeMXGJb15HNXk+jLCe3RA1pGmZmIbjUo0Wa0y3

I think the problem is CryptoJS.AES.encrypt where I am not passing it the correct configuration?

Really stuck on this, so if you have any suggestions, I'd like to know.

What is $key and key? PHP's mcrypt and CryptoJS treat the key input differently: stackoverflow.com/a/24343162/371137 — Perseids
– Perseids, Commented Oct 10, 2014 at 12:54
@Perseids - Just updated the key value. The key is generated out of a algorithm, but that is at least same in both cases. I'm using MCRYPT_RIJNDAEL_128 so I think it can be done, but I'm very unsure about how padding works. — Pratik Bothra
– Pratik Bothra, Commented Oct 10, 2014 at 17:27

Community · Accepted Answer · 2017-05-23 11:49:21Z

2

In both cases the key is not treated in the way you expect. 'a1cbbb6eb5cb2c1c27a9f02a4434d3af' is the hex representation of a 16 byte (= 128 bit) key, that can be used for AES128.

mcrypt does not know its getting a hex representation and treats it as 32 byte string and - IIRC - throws away everything except its first 16 bytes ('a1cbbb6eb5cb2c1c'). You need to unhexlify the key to get the raw bytes: $key=pack('H*', 'a1cbbb6eb5cb2c1c27a9f02a4434d3af').

CryptoJS also does not know it's presented a hex representation of the key and treats it as password instead, which is used as input to PBKDF2. The library has its own unhexlify routines: var key = CryptoJS.enc.Hex.parse('a1cbbb6eb5cb2c1c27a9f02a4434d3af'); The resulting WordArray will be treated by CryptoJS as binary key input.

edited May 23, 2017 at 11:49

CommunityBot

11 silver badge

answered Oct 10, 2014 at 22:21

Perseids

13.3k6 gold badges43 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Encryption Algorithm returning different value in php and javascript

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related