John Davidson

Message:

Hi there StackOverflow community,

After researching for countless of hours, I'm unable to find an explanation as to why my ouputs differ between javascript and my laravel application.

I could use input type hidden to make a post from my web browser, but that would defeat the purpose of having a secure client side processing and I fear that if I don't find the reason as to why this is happening, then decryption (which I plan to do through php) would not work either.

my php code is as follows:

    $payload = "this is my plaintext";

    $binary_signature = "";

    $private_key = openssl_pkey_get_private(file_get_contents(storage_path('privatekey.pem')), 'enc123456789');

    openssl_sign($payload, $binary_signature, $private_key, OPENSSL_ALGO_SHA256);

    $signature = base64_encode($binary_signature);

    $new_payload = $payload."&sign=".$signature; // where my actual plaintext is also used in my javascript code

    $key = "thisismykey";

    $iv = "\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0";

    $encryption = openssl_encrypt($new_payload, 'AES-256-CBC', $key,OPENSSL_RAW_DATA, $iv);

    dd(base64_encode($encyrption));

which outputs the following:

AEyHK+4DQWYjw8GeVV3mfzUJtk7ylxZINeryAdFptEbDyKOVbmNg8z32J2JgxGpFsQKpXxWaqDLf0IPNIq1jof0rKWhhDpaWzvTd0Tq/zgze7oGtZzEIqtdRDqax3ZvPkzNfuO/O14iW/YTwFkm9FLy9kGIirZDUTuAcOIjXGCgxhrhZHLn+V6SZpW5dYnH8u5rPDCeez2/HkUPI71YjD6hZ0DRjIkiXCyjPYH4fjNykz4yXo8hD+489Zxm8QPq1O1dyjR9JXSdrlYMWdixt6w0vz8EtPC8gZ+bDP/N/UEK07M52VB693zYb5uD1u7WuUUtsOjkr5ocF6QbEW7sjzI4q9yAxqvxRW/bkKqodcVqtglW6YsdJjrTR0EfA/Or/QF3e3QWVM5/2g4rT3ccE17OP6Rp/46yTpW9lOgS6Qiz2hY95GoaxbLfHB/Vb0Es+UppwDu8bd/u2Qax5erBi5ObZu3AjKNpTem45paspsKH3/vc2Jc810XrVQPjnDdZ8VrXvCgPiulywn5Mj28O7uUQ5bay3Zxy3bmHb7ESDEVMKiSEoru3LzDJ7wwPlidJzPcfWtuiMEMsPOv1Y6LaxtlizWM5/zYJFX/RA4d+KBl+Rn6BoPZDcX/6eh3oUoNhy

My JS Code (the plaintext is received through an ajax call which has the same sign method as you see from the php code, the encryption plaintext is of the same value from my php code)

            function encrypt(plaintext, secretkey) {

  

            var randomSeed = "";

            randomSeed = secretkey;

            var key = CryptoJS.enc.Utf8.parse(randomSeed.toUpperCase());

            var iv = CryptoJS.enc.Utf8.parse("0000000000000000");

            var encrypt = {};

            encrypt = CryptoJS.AES.encrypt(plaintext, key, {

                mode : CryptoJS.mode.CBC,

                iv : iv

            });

            console.log("encryption is "+encrypt.toString());

            return encrypt.toString(encrypt.toString());

        }

Returns the correct value which is:

jLmAUr+JyCjbpctU4z6+dlF61jbHRphwTS0iAk3IRiy3jkfCtaCSWdiIO0awuX6G1jAlZroTiAuMl9OW0zj0q4HitndfGFtFUoMMCqZTzvMr6cy1TyG9EFz20T6ByrBnOvGuoVjv3Flufuk2Ghz5in2W2A3T+wF+SPXX/bIAnHtE3uW0bPl2q5tn6KyUI1uoQaYcMZKRPyzAQS7WSSwSOmAcVrRuDANgZQuO+3mh86QAdeFaYqFdZUnxD4c2kkbkGy17SUFfSK8Qjv+8tkTcYXV9QRRdWjGZiQQeyAr3PDKA4SDVzrcMNwJjTaLJiZv0Iau66HGpbf2yvRDLtIOoXQmnhs6NKTZpcSwZ07hHqVvBZmNRq+jqZOGw1s8GRH+Bz4yxSRycTS0DEddhyMoxhZcUc5wt42vDOYIEH2nuw/uu4gjrwpx0rVO1ssoZYRxvBaA6zSC4N04Wdn4JE2/LtXertDLEdLBtmk3c3n4QDU0tK5v31HMY7P7+fdQXU62niVxCNPSt9dpYa82IUrQuigNXgrbphQvZNmmcONi/4pnxJjKcKYpCn/1KhkBVUAhYm6UKJJvMNAo0M+cfsvReImrJx6IzPRdzTTFAQF5kW2NFkV4EIb0DtCF679RtdAhg5ShaP7QhqYL6EgFCs9WnJTACC26TmV20DAqUiuIYULLtjDW4qFOWi/y8D1JOWTar

I don't understand why my PHP encryption is giving the wrong output while my JavaScript encryption is giving the correct output

I'm hoping someone could give me an insight as to what I'm doing wrong from my PHP side. Wha I'm hoping to achieve is that my PHP encryption will output the same result as my JavaScript encryption.

Thank you in advance :)

---

My Answer:
It looks like the issue might be with the way you are handling the key and IV in your PHP code. In your JavaScript code, you are converting the key and IV to Utf8 before using them in the encryption process. However, in your PHP code, you are not converting the key and IV to the correct format before using them in the encryption process.

You can try converting the key and IV to the correct format in your PHP code before using them in the encryption process. Here is an example of how you can do this:

php
$key = "thisismykey";
$iv = "\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0";

$key = utf8_encode($key);
$iv = utf8_encode($iv);

$encryption = openssl_encrypt($new_payload, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
dd(base64_encode($encryption));


By converting the key and IV to Utf8 before using them in the encryption process, you should be able to get the same result as your JavaScript encryption.