Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

CryptoJS encrypt in aes-256-cbc returns an unexpected value

I am encrypting some data using CryptoJS and comparing it to an online tool and I am not getting the same result. In fact the result from CryptoJS in not decryptable with the tool.

I am trying to encrypt in AES-256-CBC with the following parameters:

text = '111222333'
iv = 'I8zyA4lVhMCaJ5Kg'
key = '6fa979f20126cb08aa645a8f495f6d85'

Here's my code:

let text = '111222333';

aesEncrypt(data) {
    let key = '6fa979f20126cb08aa645a8f495f6d85';    //length 32
    let iv = 'I8zyA4lVhMCaJ5Kg';                     //length 16
    let cipher = CryptoJS.AES.encrypt(data, key, {
        iv: iv,
        mode: CryptoJS.mode.CBC,
        padding: CryptoJS.pad.Pkcs7
    });
    return cipher.toString();
}

aesEncrypt(text);

The resulting encrypted string is U2FsdGVkX1+f3UywYmIdtb50bzdxASRCSqB00OijOb0= while the one obtained with the online tool is B6AeMHPHkEe7/KHsZ6TW/Q==. Why are they different, I seem to be using the same parameters?

My plan in using CryptoJS is to encrypt some data client side and then be able to decrypt it server side, if needed. But the differences in both encrypted values is stopping me to do so.

like image 427
Alex Blais Avatar asked Aug 08 '19 15:08

Alex Blais


People also ask

Is AES-256 CBC secure?

The AES-GCM mode of operation can actually be carried out in parallel both for encryption and decryption. The additional security that this method provides also allows the VPN to use only a 128-bit key, whereas AES-CBC typically requires a 256-bit key to be considered secure. CBC ciphers were removed in May of 2021.

What encryption does CryptoJS use?

CryptoJS supports AES-128, AES-192, and AES-256. It will pick the variant by the size of the key you pass in. If you use a passphrase, then it will generate a 256-bit key. DES is a previously dominant algorithm for encryption, and was published as an official Federal Information Processing Standard (FIPS).

Is CryptoJS secure?

CryptoJS is a growing collection of standard and secure cryptographic algorithms implemented in JavaScript using best practices and patterns. They are fast, and they have a consistent and simple interface.


1 Answers

How 'bout encoding your data as UTF-8. Just like the "online tool" is doing.

Use CryptoJS.enc.Utf8.parse to achieve what I'm saying.

aesEncrypt (data) {
   const key = '6fa979f20126cb08aa645a8f495f6d85'
   const iv = 'I8zyA4lVhMCaJ5Kg'
   
   const cipher = CryptoJS.AES.encrypt(data, CryptoJS.enc.Utf8.parse(key), {
       iv: CryptoJS.enc.Utf8.parse(iv), // parse the IV 
       padding: CryptoJS.pad.Pkcs7,
       mode: CryptoJS.mode.CBC
   })
   
   // e.g. B6AeMHPHkEe7/KHsZ6TW/Q==
   return cipher.toString()
}

Code snippet using CryptoJS.

function aesEncrypt (data) {
   const key = '6fa979f20126cb08aa645a8f495f6d85'
   const iv = 'I8zyA4lVhMCaJ5Kg'
   const cipher = CryptoJS.AES.encrypt(data, CryptoJS.enc.Utf8.parse(key), {
       iv: CryptoJS.enc.Utf8.parse(iv),
       padding: CryptoJS.pad.Pkcs7,
       mode: CryptoJS.mode.CBC
   })

   return cipher.toString()
}

// e.g. B6AeMHPHkEe7/KHsZ6TW/Q==
console.log(aesEncrypt('111222333'))
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/aes.js"></script>

Working Stackblitz example

like image 155
weegee Avatar answered Sep 29 '22 11:09

weegee