Error with Decrypt for "Could not perform unpadding: invalid pad byte.."

Question

Using CF8 and MySQL 5.1, I am trying to encrypt() a password upon creation and then decrypt() at login. I can get the decrypt() to work fine on a test page but when I put it in a cfincluded page with cflogin I get the error "An error occurred while trying to encrypt or decrypt your input string: com.rsa.jsafe.crypto.dr: Could not perform unpadding: invalid pad byte.. ". It is the same code and DB from my test page to my app.

application.cfc:

<cfif NOT IsDefined("Request.PasswordKey")>
<cfset request.PasswordKey = generateSecretKey("AES")>
<cfset request.algorithm = "AES">
<cfset request.encoding = "hex">
</cfif>

test page which works fine:

FORM DATA:  <br/>
form password:<cfoutput>#form.passwd#</cfoutput><br/>
<cfset encrypted = Encrypt(form.passwd,Request.PasswordKey,Request.algorithm,Request.encoding)>
Encrypted: <cfoutput>#encrypted#</cfoutput><br/>
Decrypted: <cfoutput>#Decrypt(variables.encrypted,Request.PasswordKey,Request.algorithm,Request.encoding)#</cfoutput><br/>
<br/>
QUERY DATA<br/>
<cfinvoke component="components.userQ" method="login" returnvariable="qLogin">
<cfinvokeargument name="formData" value="#form#">
</cfinvoke>
<cfoutput>qLogin password: #qlogin.encPasswd#</cfoutput><br/>
<cfoutput>Decrypted encPasswd from qLogin: #Decrypt(qlogin.encPasswd,Request.PasswordKey,Request.algorithm,Request.encoding)#</cfoutput>

Decrypt() in app page that is erroring:

<cfset unEnPasswd = #Decrypt(qlogin.encPasswd,Request.PasswordKey,Request.algorithm,Request.encoding)#>

I can get the default CFMX_COMPAT encrypt() and decrypt() to work fine in my app with the same code, just changing the key, algorithm, and encoding variables.
BTW, I am also storing the encrypted strings as varchar() in the DB so it doesn't mess up the padding (so I read). I tried BLOB but get a bytearray error.

Any help or thoughts are greatly appreciated.

Answer 1

Not sure why the decrypting isnt working but You should really be one way hashing your passwords - otherwise you may as well be storing them in plaintext...

Answer 2

You're creating a new secret key on every request,

Really your code should be more like:

<cffunction name="onApplicationStart" returnType="boolean" output="false">
  <cfset application.PasswordKey = generateSecretKey("AES")>
</cffunction>

<cffunction name="onRequestStart" returnType="boolean" output="false">
  <cfset request.PasswordKey = application.PasswordKey />
  <cfset request.algorithm = "AES" />
  <cfset request.encoding = "hex" />
</cffunction>

Though really you want to have the password key hardcoded in a config file otherwise if you restart your server you won't be able to access any of your passwords ever again...

Answer 3

Disable jsafe. Add -Dcoldfusion.disablejsafe=true to your jvm config.