openssl_encrypt with a IV of 0xFFFFFFFFFFFFFFFF with encryption mode bf-cbc

Viewed 258

I'm using a third party software, that creates key in blowfish in encryption mode CBC and an IV of 0xFFFFFFFFFFFFFFFF. How can I pass an IV like this to openssl_encrypt? The encoding of the source string is windows 1252.

Im using PHP 7.3 with UTF-8.

This are my current attempts:

$data = utf8_decode('12345678');

// if(strlen($data) % 8)
//   $data = str_pad($data, strlen($data) + 8 - strlen($data) % 8, "\0");

$opts = OPENSSL_ZERO_PADDING;

if(defined('OPENSSL_DONT_ZERO_PAD_KEY'))
  $opts = $opts | OPENSSL_DONT_ZERO_PAD_KEY;

echo openssl_encrypt($data, 'bf-cbc', utf8_decode('my-secret-key'), $opts, hex2bin('FFFFFFFFFFFFFFFF')) . '<br />';

$opts = OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING;

echo base64_encode(utf8_decode(openssl_encrypt($data, 'bf-cbc', utf8_decode('my-secret-key'), $opts, hex2bin('FFFFFFFFFFFFFFFF')))) . '<br />';

The result always differ. The other end is using "Delphi Encryption Compendium Part I-III". I cannot change the way the other software creates the encrypted data. The sourcecode of the version the Delphi software uses can be found here: https://github.com/winkelsdorf/DelphiEncryptionCompendium/releases/tag/1

The Delphi function looks like:

function BlowfishEncryptStr(const InStr, Password: string;
  var OutStr: string; Format: Integer = -1): Boolean;
var
  Cipher: TCipher_Blowfish;

begin
  Cipher := TCipher_Blowfish.Create(Password, nil);

  try
    try
      Cipher.Mode := cmCBC;
      OutStr := Cipher.CodeString(InStr, paEncode, Format);
      Result := True;
    except
      Result := False;
    end;
  finally
    FreeAndNil(Cipher);
  end;
end;

The function is called with this parameters:

BlowfishEncryptStr('12345678', 'my-secret-key');

I tried the IV of 0xFFFFFFFFFFFFFFFF because it seems so, that this is the default of the Delphi Encryption Compendium in this case. I've tried to pass 0x0000000000000000 also.

1 Answers

The initialization vector is just binary data - no need to use integers. So the answer is simply: $sIv= "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF";.

The rest is pretty unclear: what does "result always differ" mean? Make sure the Delphi program always produces the same output (otherwise it uses initializations you're yet not aware of or does more than your script does). Your PHP script should always produce the same output per execution, even though the second output makes no sense at all (UTF decoding on binary data - you even forgot the "8").

Related