Simple decrypt/encrypt for java and PHP

Question

Previously, I had a working system to encrypt data in PHP and decrypt it using JAVA. This is the PHP code:

function encrypt($message, $initialVector, $secretKey) {

return base64_encode(
  mcrypt_encrypt(
    MCRYPT_RIJNDAEL_128,
    md5($secretKey),
    $message,
    MCRYPT_MODE_CFB,
    $initialVector
    )
  );
}

function decrypt($message, $initialVector, $secretKey) {
  $decoded = base64_decode($message);
  return mcrypt_decrypt(
    MCRYPT_RIJNDAEL_128,
    md5($secretKey),
    $decoded,
    MCRYPT_MODE_CFB,
    $initialVector
  );
}

and the java code

 public String decrypt(String encryptedData, String initialVectorString, String secretKey) {
    String decryptedData = null;
    try {
        SecretKeySpec skeySpec = new SecretKeySpec(md5(secretKey).getBytes(), "AES");
        IvParameterSpec initialVector = new IvParameterSpec(initialVectorString.getBytes());
        Cipher cipher = Cipher.getInstance("AES/CFB8/NoPadding");
        cipher.init(Cipher.DECRYPT_MODE, skeySpec, initialVector);
        byte[] encryptedByteArray = (new org.apache.commons.codec.binary.Base64()).decode(encryptedData.getBytes());
        byte[] decryptedByteArray = cipher.doFinal(encryptedByteArray);
        decryptedData = new String(decryptedByteArray, "UTF8");
    } catch (Exception e) {
        e.printStackTrace();
    }
    return decryptedData;

}

However, I've recently switched from PHP 5.x to 7.1 and now get the following message:

"Function mcrypt_encrypt() is deprecated"

So it seems mcrypt isn't such a good choice anymore. I've googled a lot but most examples still use mcrypt. The only other good options refer to tools like RNCryptor or defuse but don't come with any working examples. Are there some simple working examples out there that work for PHP and JAVA? I need to be able to decrypt the data to its original form since I need to perform certain tasks with it.

Thanks in advance

Answer 1

This looks like the code from this link: http://php.net/manual/de/function.mcrypt-encrypt.php#119395. But anyway, I think it should be replaced by openssl_encrypt().

This is a port of your functions (without md5 of course).

<?php

function encrypt_new($data, $iv, $key, $method)
{
    return base64_encode(openssl_encrypt($data, $method, $key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $iv));
}

function decrypt_new($data, $iv, $key, $method)
{
    return openssl_decrypt(base64_decode($data), $method, $key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $iv);
}

$data = "plain text";
$method = 'AES-128-CFB8'; // AES/CFB8/NoPadding
$ivSize = openssl_cipher_iv_length($method);
$iv = openssl_random_pseudo_bytes($ivSize);
$password = 'default-secret-salt';
$key = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);

$encrypted = encrypt_new($data, $iv, $key, $method);
echo $encrypted. "\n";
$decrypted = decrypt_new($encrypted, $iv, $key, $method);
echo $decrypted. "\n"; // plain text