MCrypt rijndael-128 for converting OpenSSL aes-128-ecb

Question

Since Mcrypt is deprecated, I want to use OpenSSL instead in my code, since we already use php 7.0.17 on our server and they don’t tell when they update it.

Some third-party APIs (hosted on PHP 5.x , possibly using mcrypt as well ) accept encrypted data. They provided the methods that they use to encrypt / decrypt strings.

Here they are

$secret = 'a0a7e7997b6d5fcd55f4b5c32611b87c' ; public function encrypt128($str) { $block = mcrypt_get_block_size("rijndael_128", "ecb"); $pad = $block - (strlen($str) % $block); $str .= str_repeat(chr($pad), $pad); return base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $secret, $str, MCRYPT_MODE_ECB)); } public function decrypt128($str) { $str = base64_decode($str); $str = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $secret, $str, MCRYPT_MODE_ECB); $len = strlen($str); $pad = ord($str[$len - 1]); return substr($str, 0, strlen($str) - $pad); } 

using these methods string small1 if encrypted becomes v7IXp5vVaFVXXlt/MN8BVw==

---

We want to use openssl_encrypt on our side so that if we encrypt the same string with OpenSSL, it should give the same results as Mcrypt. I researched that mcrypt using rijndael-128 Mode ecb should be compatible with OpenSSL aes-128-ecb .

Over the past few hours, I have been trying to make my own method for encrypting strings serving the same result using OpenSSL. So far i have come to this

 public function sslEncrypt128($str) { $secret = 'a0a7e7997b6d5fcd55f4b5c32611b87c'; return base64_encode(openssl_encrypt($str, 'aes-128-ecb', $secret, OPENSSL_RAW_DATA)); } 

But it creates a different line SxJ3+EdaeItZx3/EwGTUbw== for the same as for input. I do not know if the problem is with a flag or a padding, any pointers would be welcome.

I added the code here to check online https://3v4l.org/v2J2N

Thanks in advance.

Answer 1

In your specific example, I found that changing aes-128-ecb to aes-256-ecb will aes-256-ecb the same result as the inherited mcrypt_encrypt .

Answer 2

Most likely, the key should have been used as hex (it is already in hexadecimal format) not as a string that should be converted to hex.

---

mcrypt:

mcrypt does not support the standard PKCS # 7 add-on (née PKCS # 5), only non-standard zero padding , but the add is explicitly added before mcrypt .

Encryption v7IXp5vVaFVXXlt/MN8BVw== is the correct encryption based on the PKCS # 7 add-on. ECB and the key as a string.

See: mcrypt - AES CALCULATOR .

In hexadecimal, notice that the data filling is clearly visible:
key: 6130613765373939376236643566636435356634623563333236313162383763
data: 736D616C6C310A0A0A0A0A0A0A0A0A0A
encrypted: BFB217A79BD56855575E5B7F30DF0157

In Base64:
encrypted: v7IXp5vVaFVXXlt/MN8BVw==

---

OpenSSL:

Note that the key has 256 bits, but calling OpenSSL with "aes-128-ecb" seems to imply a 128-key. Thus, the keys do not match.

See: OpenSSL - AES CALCULATOR

In hexadecimal, notice that the data filling is clearly visible:
key: 61306137653739393762366435666364
data: 736D616C6C310A0A0A0A0A0A0A0A0A0A
encrypted: 4B1277F8475A788B59C77FC4C064D46F

In Base64:
encrypted: SxJ3+EdaeItZx3/EwGTUbw==