AES encryption with CryptoJS and decryption with CodeIgniter


fire brand

I'm trying to encrypt a username (written in Codeigniter 3) sent to my server via a POST request, so I'm using CryptoJS to do it client-side like this:

var user = $('.user').val();
var key = "<? echo($key);?>"; //$key is created on the server side
var encUser = CryptoJS.AES.encrypt(user, key, {
    mode: CryptoJS.mode.CBC
}).toString();

I get a nice looking 64 character long string which is sent to the server.

On my server (running CodeIgniter 3), I'm using the CI encryption library and loading it as needed, but when I try to decrypt the string like this:

$this->encryption->decrypt($this->input->post('encUser'), array(
    'cipher' => 'aes-128',
    'mode' => 'cbc',
    'hmac' => FALSE,
    'key' => $key
));

The function returns (bool)false, indicating that something went wrong.

What am I doing wrong?

Note: Not sure how much encryption I need to use ivsince the CI library only uses the first 16 characters of the string itself .

** edit **

I $kaycreated my passphrase with the help of random_int polyfill , here is my function:

private function random_str($length, $keyspace = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ')
{
    $str = '';
    $max = mb_strlen($keyspace, '8bit') - 1;
    for ($i = 0; $i < $length; ++$i) {
        $str .= $keyspace[random_int(0, $max)];
    }
    return $str;
}

I am calling random_str(32);

Example generated key:1xB8oBQgXGPhcKoD0QkP1Uj4CRZ7Sy1c

** UPDATE ** Thanks to Artjom.B's answer (and chat :)), we can use the client-side code from his answer and fix the server-side code to:

$user = $this->encryption->decrypt(base64_decode($this->input->post('encUser')), array(
        'cipher' => 'aes-256',
        'mode' => 'cbc',
        'hmac' => FALSE,
        'key' => $key
    ));

Everything works fine now.

Artjom B.

In CryptoJS, if it key's a string, it will assume it key's actually a password, generate a random salt, and derive the actual key and IV from password + salt (this is done in an OpenSSL-compatible way EVP_BytesToKey).

CodeIgniter's encryption library does not support this type of key derivation. You will have to change your CryptoJS code to pass the parsed code WordArray:

var key = CryptoJS.enc.Hex.parse("<? echo(bin2hex($key));?>");
var iv = CryptoJS.lib.WordArray.random(128/8);
var encUser = CryptoJS.AES.encrypt(user, key, {
    iv: iv
}).ciphertext;
return iv.concat(encUser).toString(CryptoJS.enc.Base64);

Since the IV is written in front of the ciphertext, CodeIgniter should read it correctly without having to specify it explicitly. Make sure keyit is properly encoded as Hex or Base64, as binary encoding doesn't work well in JavaScript. Again, on the PHP side, the ciphertext has to be decoded from Base64.

You can also do it in PHP EVP_BytesToKeyas I've shown here .

Related


AES encryption with CryptoJS and decryption with CodeIgniter

fire brand I'm trying to encrypt a username (written in Codeigniter 3) sent to my server via a POST request, so I'm using CryptoJS to do it client-side like this: var user = $('.user').val(); var key = "<? echo($key);?>"; //$key is created on the server side v

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES CBC: JavaScript/CryptoJS encryption -> Golang decryption

DjH Note: This is for personal use and learning only, I don't plan to use my encryption for public use. I need to AES256 encrypt the string, but my current attempt ends up with something like the server side string Salted__Vέ��|��l��ʼ8XCQlYwhen hex decoded . W

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES CBC: JavaScript/CryptoJS encryption -> Golang decryption

DjH Note: This is for personal use and learning only, I don't plan to use my encryption for public use. I need to AES256 encrypt the string, but my current attempt ends up with something like the server side string Salted__Vέ��|��l��ʼ8XCQlYwhen hex decoded . W

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES encryption in C# and decryption in CryptoJS

Pabitra Dash I want to perform AES encryption in C# and decryption in CryptoJS. Pabitra Dash After getting some references from the Google CryptoJS group ( https://groups.google.com/forum/#!msg/crypto-js/ysgzr2Wxt_k/_Wh8l_1rhQAJ ) it now works fine . Here is t

AES encryption/decryption in javascript using CryptoJS

Anthracene I am trying to send AES encrypted messages between javascript and php using a shared key. In Javascript, I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it in

AES encryption/decryption in javascript using CryptoJS

Anthracene I am trying to send AES encrypted messages between javascript and php using a shared secret. In Javascript, I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it

AES encryption/decryption in javascript using CryptoJS

Anthracene I am trying to send AES encrypted messages between javascript and php using a shared secret. In Javascript, I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it

AES CBC: JavaScript/CryptoJS encryption -> Golang decryption

DjH Note: This is for personal use and learning only, I don't plan to use my encryption for public use. I need to AES256 encrypt the string, but Salted__Vέ��|��l��ʼ8XCQlYwhen hex decodes it , my current attempt ends up with something like the string on the ser

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES encryption/decryption in javascript using CryptoJS

Anthracene I am trying to send AES encrypted messages between javascript and php using a shared secret. In Javascript, I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it

CryptoJS encryption Go decryption

Ivaylo Ivanov: I have the following Go code ciphertext := "Zff9c+F3gZu/lsARvPhpMau50KUkMAie4j8MYfb12HMWhkLqZreTk8RPbtRB7RDG3QFw7Y0FXJsCq/EBEAz//XoeSZmqZXoyq2Cx8ZV+/Rw=" decodedText, _ := base64.StdEncoding.DecodeString(ciphertext) decodedIv, _ := base64.StdEnc

CryptoJS encryption Go decryption

Ivaylo Ivanov: I have the following Go code ciphertext := "Zff9c+F3gZu/lsARvPhpMau50KUkMAie4j8MYfb12HMWhkLqZreTk8RPbtRB7RDG3QFw7Y0FXJsCq/EBEAz//XoeSZmqZXoyq2Cx8ZV+/Rw=" decodedText, _ := base64.StdEncoding.DecodeString(ciphertext) decodedIv, _ := base64.StdEnc

CryptoJS encryption Go decryption

Ivaylo Ivanov: I have the following Go code ciphertext := "Zff9c+F3gZu/lsARvPhpMau50KUkMAie4j8MYfb12HMWhkLqZreTk8RPbtRB7RDG3QFw7Y0FXJsCq/EBEAz//XoeSZmqZXoyq2Cx8ZV+/Rw=" decodedText, _ := base64.StdEncoding.DecodeString(ciphertext) decodedIv, _ := base64.StdEnc

CryptoJS encryption Go decryption

Ivaylo Ivanov: I have the following Go code ciphertext := "Zff9c+F3gZu/lsARvPhpMau50KUkMAie4j8MYfb12HMWhkLqZreTk8RPbtRB7RDG3QFw7Y0FXJsCq/EBEAz//XoeSZmqZXoyq2Cx8ZV+/Rw=" decodedText, _ := base64.StdEncoding.DecodeString(ciphertext) decodedIv, _ := base64.StdEnc

CryptoJS encryption Go decryption

Ivaylo Ivanov: I have the following Go code ciphertext := "Zff9c+F3gZu/lsARvPhpMau50KUkMAie4j8MYfb12HMWhkLqZreTk8RPbtRB7RDG3QFw7Y0FXJsCq/EBEAz//XoeSZmqZXoyq2Cx8ZV+/Rw=" decodedText, _ := base64.StdEncoding.DecodeString(ciphertext) decodedIv, _ := base64.StdEnc

AES encryption using CryptoJS

Sergio David Romero I need to implement AES encryption using JavaScript. Use AES/CBC/NoPadding mode, and created a way to do it in 16-length blocks. I have solved it using Java. look like: public static String encrypt(byte[] key, byte[] initVector, String valu

AES encryption with CryptoJS and PHP

Shasha I want to implement AES encryption using JavaScript. AES CBC mode to use. I have managed to do this in PHP. look like: public function encrypt($value) { if (empty($value)) { return $value; } $value = Unicode::convertTo

AES encryption with CryptoSwift and CryptoJS

Christopher Robert I want to try to encrypt text using CryptoSwift for an ios app and CryptoJS for a web app, which must be decrypted in the Java platform. I can successfully encrypt in javascript using the following code. var message = "Hello" var password =

AES encryption using CryptoJS

Sergio David Romero I need to implement AES encryption using JavaScript. Use AES/CBC/NoPadding mode, and created a way to do it in 16-length blocks. I have solved it using Java. looks like: public static String encrypt(byte[] key, byte[] initVector, String val

AES encryption with CryptoJS and PHP

Shasha I want to implement AES encryption using JavaScript. AES CBC mode to use. I have managed to do this in PHP. looks like: public function encrypt($value) { if (empty($value)) { return $value; } $value = Unicode::convertT