AESCrypt decryption between iOS and PHP

by

Disclaimer: I have zero iPhone development experience.

Short answer – what tc. said. Something is horribly wrong with the AES256EncryptWithKey:

Being AES256 you would expect it to require a 32 byte key, not a 16 byte key. But OK, say it pads shorter keys with null bytes to make them 32 bytes. This might explain why your 16 byte key is being padded with 16 null characters.

But, when it comes to the actual act of encryption, it’s using AES 128, but with the 32 byte key. Say wha?

Converting tc.’s Python to PHP:

$base64encoded_ciphertext="7opqbb7sEVNoXplyQv/X8g==";
$key = 'a16byteslongkey!';

$padded_key = $key . str_repeat(chr(0x00), 16); // Argh!

$result = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $padded_key, base64_decode($base64encoded_ciphertext), 'ecb');

// Yetch - $result ends up being padded with 0x0b's (vertical tab).
var_dump(rtrim($result, chr(0x0b)));

Result:

string(5) “Hello”

~~

Edit: This post from Henno has some relevant details.

~~

Did some additional research. The null padding on your key is likely because AES256 requires a 32 byte key. The 0x0B padding on the plaintext is thanks to PKCS7. PKCS7 is a padding scheme where the byte used for padding is equal in value to the number of bytes added. In this example, 11 bytes were added to the end of ‘Hello’ turning your 5 byte input into a 16 byte block for AES. 11 = 0x0B.

Thus, the code above will not work when the plaintext is not length = 5. Try the following instead:

$pad_char = ord(substr($result, -1));
$result_without_padding = substr($result, 0, strlen($result) - $pad_char);

More Related Contents:

  1. Check if PHP-page is accessed from an iOS device
  2. Fix iOS picture orientation after upload PHP
  3. Is it possible to use PHP inside Xcode for iOS app development? [closed]
  4. Best way to use PHP to encrypt and decrypt passwords? [duplicate]
  5. Simplest two-way encryption using PHP
  6. How to encrypt/decrypt data in php?
  7. mcrypt is deprecated, what is the alternative?
  8. How to add/remove PKCS7 padding from an AES encrypted string?
  9. PHP AES encrypt / decrypt
  10. Best solution to protect PHP code without encryption
  11. Using SSL in an iPhone App – Export Compliance
  12. Login without HTTPS, how to secure?
  13. Is it possible to hide/encode/encrypt php source code and let others have the system?
  14. GCM Notifications not receiving when app is in background mode in iOS
  15. RSA implementations in Objective C
  16. Two-way encryption in PHP
  17. Using php to output an mp4 video
  18. iPhone emoticons insert into MySQL but become blank value
  19. Create an encrypted zip archive with PHP
  20. MCrypt rijndael-128 to OpenSSL aes-128-ecb conversion
  21. How can I decrypt a password hash in PHP?
  22. Decrypting strings in Python that were encrypted with MCRYPT_RIJNDAEL_256 in PHP
  23. Is it secure to store a password in a session? [duplicate]
  24. Use openssl_encrypt to replace Mcrypt for 3DES-ECB encryption
  25. PHP Apple Enhanced Push Notification read error response
  26. Can anyone get access to my PHP source code?
  27. Encrypting SQLite Database file in iPhone OS
  28. MP4 plays when accessed directly, but not when read through PHP, on iOS
  29. Mcrypt js encryption value is different than that produced by PHP mcrypt / Mcrypt JS decrypt doesn’t work for UTF-8 chars
  30. What encryption algorithm is best for encrypting cookies?

Leave a Comment