Question

I have implemented functions in my login model for decrypting/encrypting a users password (which in a encrypted version gets stored in a cookie). All works fine except when I restart the browser and try to login with the password through the cookies.

The parser tells me it’s the wrong password even though I can see that it’s the correct one when I echo it out. Therefore I tried a “strlen” to see how many characters the password has, and it says 32 (!). The only thing I can think of is that (in this case) 28 white spaces has been added, which cannot be seen with an echo.

I would really appreciate if someone can tell me what’s going on and how to fix it?

function decrypt($encrypedText) {
    $key = "The secret key is";
    $decryptedText = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, base64_decode($encrypedText), MCRYPT_MODE_ECB);

    echo $decryptedText;            //  "abcd" <- what I put in
    echo strlen($decryptedText);    //  32 (?)

    return $decryptedText;
}

Answer 1

That’s because 32 bytes is the block size of Rijndael 256 (i.e. 32 = 256 / 8) and the decrypted data is padded with '\0' to match that length.

To correct this you can remove those characters like so:

return rtrim($decryptedText, '\0');