mcrypt decoding errors

Question

Hi,

I have a few issues with the following php functions (part of a bigger class).

    //encode
    public function acc_pw_enc($text, $key) {
    $text_num = str_split($text, 8);
    $text_num = 8 - strlen($text_num[count($text_num)-1]);

    for ($i=0; $i < $text_num; $i++) {
        $text = $text . chr($text_num);
    }

    $cipher = mcrypt_module_open(MCRYPT_TRIPLEDES, '', 'cbc', '');
    mcrypt_generic_init($cipher, $key, 'fYfhHeDm');
    $decrypted = mcrypt_generic($cipher, $text);
    mcrypt_generic_deinit($cipher);
    return base64_encode($decrypted);
}

    //decode
public function acc_pw_dec($encrypted_text, $key) {
    $cipher = mcrypt_module_open(MCRYPT_TRIPLEDES, '', 'cbc', '');
    mcrypt_generic_init($cipher, $key, 'fYfhHeDm');
    $decrypted = mdecrypt_generic($cipher, base64_decode($encrypted_text));
    mcrypt_generic_deinit($cipher);
    $last_char = substr($decrypted, -1);

    for($i=0; $i < 8-1; $i++) {
        if(chr($i) == $last_char) {      
            $decrypted = substr($decrypted, 0, strlen($decrypted)-$i);
            break;
        }
    }
    return rtrim($decrypted); //str_replace("?", "", $decrypted);
}

So for exampe if i encrypt the string 'liloMIA01' with the salt/key 'yBevuZoMy' i will get '7A30ZkEjYbDcAXLgGE/6nQ=='.

I get liloMIA01 as the decrypted value, i tried using rtrim but it didn't work.

Answer 1

A big problem with mcrypt is it doesn't support any padding algorithm when used with block ciphers like 3DES. So you will get garbage at the end if the data is not multiple of block size (8 bytes in this case).

You need to pad the data properly using pkcs#5 or add a length field.