I'm trying to find an AES encryption method that will allow me to encrypt a string in PHP and use the encrypted string to be decrypted in C#
Can anyone help me out here. I've looked at nearly all the examples on the net and can't find a matching one that will let me do what I want.
Thanks
The problem with PHP is that mcrypt only supports null padding. C# does not support null padding for good reason, it goes haywire if you're encrypting binary information. If you switch to OpenSSL for your encryption on PHP you will get better padding options. Once you have switched you simply need to ensure the block size, mode and padding options are the same on both sides.
I would recommend phpseclib, a pure PHP AES implementation. It's interoperable with OpenSSL as demonstrated thusly:
AES Encrypt in PHP to decrypt in openssl
Related
I need to decrypt a string, returned from an API that was originally encrypted using c# functions based on those here >
http://www.codeproject.com/Tips/704372/How-to-use-Rijndael-ManagedEncryption-with-Csharp
I need to decrypt using PHP.
A password and a key have been provided I've made several attempts to decrypt using openssl_decrypt, but I'm unsure how to use the key in the decryption?
[update] I have been told that the password I have been given is the basis for the iv, and that the padding is PKCS7, the problem is that I have no idea how to create the iv.
I have the following example input/keys, but I'm not sure how to use the password as I've been told it is the iv do I need to pad it to the correct length, if so how?
Original string: 'Mondays Suck'
Password/salt: 'this_is_the_password'
Input key: 'this_is_the_input_key'
Encrypted String: 'mAqsxJaA0jpQdefBPug2tw=='
If there indeed is any ciphertext packing going on, it would be to include the initialization vector (IV), assuming one was even used in the first place.
In short, if I encrypted a string with AES-128:
I'd likely be using PBKDF2 to take a weak passphrase and a salt to generate secret key material used to do the encryption itself.
I'd generate a message-specific (i.e. one-time use) initialization vector for ciphering
I'd then use the secret key [material] and IV generated in the previous steps to encrypt the string using AES-128: E(plaintext, key, iv)
If the string is longer than 16 bytes, I'd have to also use an encryption mode such as CBC, CTR, etc.
For convenience, I would "pack" the IV (not required to be kept secret) in front of the ciphertext by simply concatenating: iv+ciphertext
If I was serious about doing it right, I would generate a message authentication code of the ciphertext and append that as well such that I would now have: iv+ciphertext+mac
On decrypt, I would then verify the MAC before decrypting (if I was to do it right), and I would then need to separate the IV from the ciphertext, and then run it through my decryption routine: D(ciphertext, key, iv).
Another thing to keep in mind is encoding as sometimes we pass around Base64-encoded strings as a more print-friendly format than raw data. You of course would have to decode that before working on unpacking, decrypting, etc.
For academic purposes, I created Crypto Implementation (DRAFT) back when I was teaching myself crypto and wanted to document processes and best practices as well as keep all "moving parts" in view as a reference when I had to work on this stuff. Lots of rules to follow, but all in all, a lot of good learning and professional development opportunities.
Hope that helps some!
Edit: Per my comment below, I just looked at the original source code for the C# implementation. It appears the only way to decrypt this in PHP would be to have a PHP equivalent of C#'s Rfc2898DeriveBytes as this is the part responsible for generating your IV. Study the DecryptRijndael routine and you'll see where it gets the IV from (it basically implies using the same salt). If you truly have no control or influence over the encryption routine, you might be inclined to hack up a solution involving using C# DLLs in PHP and then call the DecryptRijndael method from PHP.
is there any kind of Encryption and Decryption functions that are in c# and Oracle PL/SQL?
I mean I can encrypt a string in one and decrypt it in the other?
any help, I'm not good in security algorithm!
cheers
In Oracle, you can use the dbms_obfuscation_toolkit. If you want to encrypt and decrypt, you might try DES encryption. For Oracle, its dbms_obfuscation_toolkit.DESEncrypt, and for C# its DESCryptoServiceProvider (in System.Security.Cryptography). You'll also need to use the same key of course if encrypting/decrypting between the two.
Also, DBMS_CRYPTO is intended to replace DBMS_OBFUSCATION_TOOLKIT I believe, and should have various encryption algorithms for Oracle.
I've found a few answers to Encrypt in PHP, and Decrypt in C#, but as yet have been unable to reverse the process...
The background is I want to:
In C#:
AES encrypt a file's contents.
Upload the data (likely via http via POST) to a server.
In PHP:
Receive and save the file.
And in PHP (at a later date):
Decrypt the file.
I specifically want to encrypt it outside of using SSL/TLS (though I might have to do this as well), as I need to know the file remains encrypted (and decryptable!) when stored on the server.
To encrypt in C# I'm using:
Rijndael RijndaelAlg = Rijndael.Create();
RijndaelAlg.KeySize = 128;
RijndaelAlg.Mode = CipherMode.CBC;
CryptoStream cStream = new CryptoStream(fStream, RijndaelAlg.CreateEncryptor(Key, IV),
CryptoStreamMode.Read);
and to decrypt in PHP:
mcrypt_cbc(MCRYPT_RIJNDAEL_128, $key, $buffer, MCRYPT_DECRYPT, $iv);
Generally it only depends on selecting the right options on both sides:
Plaintext character format
how plaintext characters are encoded in the bit string
Padding
how to pad the plaintext to be an exact multiple of the block size
Key length
must be agreed if there is a choice
Key derivation
how to create the bit string to be used for the key
Mode
which mode of encryption to use
Storage format
how we store the ciphertext
Please see here for a lot of information about these things. Especially the padding seems to be the root of most interoperability problems as PHP's mcrypt uses a NULL-padding by default and has no built-in support for any other padding mode, while e.g. .NET doesn't even provide an option to use a NULL-padding (as it may cause issues when encrypting binary data).
I know this was asked a while ago but I thought I'd post my solution for others. I wrote up a quick code example in PHP and C# that lets you encrypt/decrypt both ways. I had a few issues with getting the settings on both sides to work out. A difference in padding would let it decrypt one way but not the other
https://github.com/dchymko/.NET--PHP-encryption
hope that helps some people.
Are you using the same mode with both? I.e. are you using CBC with both (and not ECB). If you don't understand what I just said then drop a comment and I'll explain in detail, as it has fairly major security repercussions.
I had a similar problem a few months ago - I had a project that had to use AES encryption and I had to make sure that the exact same algorithm is used between a C# and A C++ component. I ended up implementing a shared DLL library used by both based on the AES crypto wrapper from this codeplex article:
http://www.codeproject.com/KB/security/WinAESwithHMAC.aspx
I have an encrypted string from one of our customers.
This string was encrypted using the AES method in Java.
The only thing I have is the key: "xxxxxxxxxxxxxxxxxxxxxxxx" (24 chars) and the encrypted text: "56e84e9f6344826bcfa439cda09e5e96" (32 chars). (This really is the only data I have)
I can't seem to find a method to decrypt this string.
Could anyone provide me with a working example.
Here are two complete code samples for you:
How To: Encrypt and Decrypt Data Using a Symmetric (Rijndael) Key
How To: Encrypt Data With Salt (C#/VB.NET)
You might also find c# implementations of AES encryption here on SO interesting.
I found another example Simple encrypting and decrypting data in C# where they use only the Pass Phrase to decrypt.
Please go through this article "Simple Cryptographer - Simple DES/AES Implementation in C#"
link: http://www.codeproject.com/KB/recipes/Simple_Cryptographer.aspx
Hope this article will help you.
I am needing to encrypt using Perl and decrypt on .Net (C#). i.e. Perl encrypts a file and my .Net code decrypts the file (and even maybe validates integrity).
The problem is that I am not familiar with the encryption capabilities of Perl. Can anyone offer guidance on how best to approach this and what the possibilities are?
Thanks in advance!
DC
As Lars said, AES is probably the best choice these days. For a Perl implementation, see Crypt::Rijndael
Use AES encryption with a common secret key.
Perl
C#