Question

I’m working on an encryption system that passes the data to a 3rd party application. The encryption is done in Java and the decryption is done in PHP. Despite several attempts I can’t get the encrypted string to be opened by the PHP application.

For testing purposes I created a PHP script that also encrypts the data, so I could compare the Java and PHP encrypted strings. The results match up to the 21st character, and then they differ. This is what I have:

// Java - Encrypt
private String EncryptAES(String text,String key) throws Exception
    {
      SecretKeySpec skeySpec = new SecretKeySpec(key.getBytes(), "AES");

      // Instantiate the cipher
      Cipher cipher = Cipher.getInstance("AES");

      cipher.init(Cipher.ENCRYPT_MODE, skeySpec);
      byte[] encrypted = cipher.doFinal(text.getBytes());

      String encrypttext = new BASE64Encoder().encode(encrypted);

      return encrypttext;
    }

RESULT: TeUZAFxoFoQy/roPm5tXyPzJP/TLAwR1aIGn2xHbZpsbY1qrKwXfO+F/DAqmeTwB0b8e6dsSM+Yy0zrQt22E2Q== 

and

// PHP - Encrypt
<?php

$encrypt =  $crypt = openssl_encrypt($toCrypt,"AES256","key-32-char-long");
echo $encrypt; 

?>

RESULT: TeUZAFxoFoQy/roPm5tXyC05wta1Z5YOXcq4OtgFoSbfVi/bHAuD6B5tDthT8EcGXQir08UAx0QvcqRJ2fJmbQ==

Obviously something is being done right because part of the strings match, but obviously not everything is correct because the rest does not match. Also, if I try to decrypt the Java string in PHP, nothing happens:

// PHP - Decrypt
<?php
$toDecrypt = "TeUZAFxoFoQy/roPm5tXyPzJP/TLAwR1aIGn2xHbZpsbY1qrKwXfO+F/DAqmeTwB0b8e6dsSM+Yy0zrQt22E2Q==";
$decrypt = openssl_decrypt($toDecrypt,"AES256","<key-32-char-long>");
echo $decrypt;

?>

RESULT: <nothing>

Does anyone have any ideas what might be happening?

Answer 1

Since both encrypted strings start with the same characters, it looks like you’re using ECB in one and CBC in the other.