php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27746 Decrypt routines not working as per v4.3.4
Submitted: 2004-03-29 03:30 UTC Modified: 2004-04-07 13:27 UTC
Votes:3
Avg. Score:4.7 ± 0.5
Reproduced:3 of 3 (100.0%)
Same Version:3 (100.0%)
Same OS:3 (100.0%)
From: taomyn at myway dot com Assigned:
Status: Not a bug Package: mcrypt related
PHP Version: 4.3.6RC1 OS: Windows Server 2003
Private report: No CVE-ID: None
 [2004-03-29 03:30 UTC] taomyn at myway dot com
Description:
------------
My decrypting routines now fail to decrypt and in fact seem to return the encrypted value.

Reproduce code:
---------------
function encrypt_pwd($password)
{
/* Return encrypted password */
	global $config;
	$password = trim($password);
	$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB);
	$key = mhash(MHASH_MD5,substr($config['pass_phrase'], 0, mcrypt_get_key_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB)));
 error_log("EP===".$password."===");
 error_log("EK===".$key."===");
	$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
	$enc_pwd = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $password, MCRYPT_MODE_ECB, $iv);
 error_log("EE===".$enc_pwd."===");
	return $enc_pwd;
}

function decrypt_pwd($password)
{
/* Return decrypted password */
	global $config;
	$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB);
	$key = mhash(MHASH_MD5,substr($config['pass_phrase'], 0, mcrypt_get_key_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB)));
 error_log("DP===".$password."===");
 error_log("DK===".$key."===");
	$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
	$dec_pwd = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $password, MCRYPT_MODE_ECB, $iv);
 error_log("DD===".trim(chop($dec_pwd))."===");
	return trim(chop($dec_pwd));
}



Expected result:
----------------
[29-Mar-2004 09:35:31] EP===bubbles10===

[29-Mar-2004 09:35:31] EK===-? ?WqG9??\6?===

[29-Mar-2004 09:35:31] EE===u!??+?_Yi??O?t===

[29-Mar-2004 09:35:50] DP===u!??+?_Yi??O?t===

[29-Mar-2004 09:35:50] DK===-? ?WqG9??\6?===

[29-Mar-2004 09:35:50] DD===bubbles10===


Actual result:
--------------
[29-Mar-2004 09:35:31] EP===bubbles10===

[29-Mar-2004 09:35:31] EK===-? ?WqG9??\6?===

[29-Mar-2004 09:35:31] EE===u!??+?_Yi??O?t===

[29-Mar-2004 09:35:50] DP===u!??+?_Yi??O?t===

[29-Mar-2004 09:35:50] DK===-? ?WqG9??\6?===

[29-Mar-2004 09:35:50] DD===u!??+?_Yi??O?t===


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-29 15:30 UTC] taomyn at myway dot com
<?
	$password = "muppets";

	$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB);
	$key = mhash(MHASH_MD5,substr("dimwits", 0, mcrypt_get_key_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB)));
	print "EP===".$password."===\n";
	print "EK===".$key."===\n";
	$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND); 
	$enc_pwd = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $password,MCRYPT_MODE_ECB, $iv);
	print "EE===".$enc_pwd."===\n";

	$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB);
	$key = mhash(MHASH_MD5,substr("dimwits", 0, mcrypt_get_key_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB)));
	print "DP===".$password."===\n";
	print "DK===".$key."===\n";
	$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
	$dec_pwd = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $enc_pwd, MCRYPT_MODE_ECB, $iv);
	print "DD===".trim(chop($dec_pwd))."===\n";
?>

Under v4.3.4

EP===muppets===
EK===(?^&#8962;&#9658;?A?&#9617;z?&#9474;zE|&#9472;===
EE===&#9827;?&#9574;        &#8616;?6(Z&#9571;&#9571;k&#9668;F?`===
DP===muppets===
DK===(?^&#8962;&#9658;?A?&#9617;z?&#9474;zE|&#9472;===
DD===muppets===

Under v4.3.5

EP===muppets===
EK===(?^&#8962;&#9658;?A?&#9617;z?&#9474;zE|&#9472;===
EE===&#9827;?&#9574;        &#8616;?6(Z&#9571;&#9571;k&#9668;F?`===
DP===muppets===
DK===(?^&#8962;&#9658;?A?&#9617;z?&#9474;zE|&#9472;===
DD===&#9827;?&#9574;        &#8616;?6(Z&#9571;&#9571;k&#9668;F?`===

I.E. IT DOESN'T DECRYPT - HAPPY?
 [2004-04-07 11:19 UTC] sniper@php.net
Assigned to the maintainer. :)

 [2004-04-07 13:27 UTC] derick@php.net
Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions. 

Thank you for your interest in PHP.

You need to use the same IV for encrypting and decrypting (so don't use create_iv() like this!)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Dec 08 22:01:27 2024 UTC