Question

I have an issue when communicating encrypted between iOS and PHP. I have an app that encrypts a string and sends it to a PHP server that decrypts it. That part works just fine. Now the PHP server needs to send an encrypted response back to the app, which seems to be causing a bit
more gray hair.

The issue is, that when I encrypt a string in PHP it looks different from the same string encrypted in iOS and even .NET – obviously all places use the same algorithm, key and IV.

I use Rijndael 128 in CBC mode with an IV consisting of empty bytes (so far).

The PHP encryption looks so:

$encrypted = mcrypt_encrypt( MCRYPT_RIJNDAEL_128, $this->secret_key, $str, MCRYPT_MODE_CBC, $this->iv );
$encrypted = base64_encode( $encrypted );

The iOS encryption is attached in this file:

StringEncryption.m: http://pastie.org/1365766

I hope someone can help me spot where I’m missing something or have some different parameters of values. I have looked at this for several hours, and can’t find anything else to try.

Answer 1

Most likely it’s a padding issue… Please see here or here for more information.

EDIT after OP comment:

PHP has no built-in support for other padding modes than the NULL-padding. At least .Net allows you to specify NULL-padding (I think), the other option would be to implement PKCS#7-padding in PHP which is not that difficult to do.

Pad the input with a padding string of
between 1 and 8 bytes to make the
total length an exact multiple of 8
bytes. The value of each byte of the
padding string is set to the number of
bytes added – i.e. 8 bytes of value
0x08, 7 bytes of value 0x07, …, 2
bytes of 0x02, or one byte of value
0x01.

$blockSize = mcrypt_get_block_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
$padding   = $blockSize - (strlen($data) % $blockSize);
$data      .= str_repeat(chr($padding), $padding);