Verschlüsseln in PHP und entschlüsseln in Delphi?

[gpl]

Ich habe jetzt gefühlt 100 verschiedene Ansätze ausprobiert und viele davon waren schon älter und konnten wohl daher nicht mit UTF-8 umgehen.

Auf der PHP-Seite habe ich zum Testen ein kleines Script aus den gefundenen Ansätzen erstellt, dass einen Text verschlüsselt und sofort wieder entschlüsselt.
Wie man sieht, funktioniert das innerhalb PHP problemlos.

Code:

<?php

function MyEncrypt ($data, $key, $iv)
  {
    //Remove the base64 encoding from our key
    $encryption_key = $key;
    //Encrypt the data using AES 256 encryption in CBC mode using our encryption key and initialization vector.
    $encrypted = openssl_encrypt($data, 'AES-256-CBC', $encryption_key, 0, $iv);
    //The $iv is just as important as the key for decrypting, so save it with our encrypted data using a unique separator (::)
    return base64_encode($encrypted);
  }
  
function MyDecrypt ($data, $key, $iv)
  {
   $encryption_key = $key;
   $indata = base64_decode($data);  // Base64-Dekodieren
   $unencrypted = openssl_decrypt($indata, 'AES-256-CBC', $encryption_key, 0, $iv);
   return $unencrypted;
  }  

$key = "ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEF"; 
$plaintext = 'zu verschlüsselnde Nachricht äöüÄÖÜß';
$iv = "1234567890123456";
echo 'Plaintext     : '.$plaintext.'<BR>';
echo 'Key           : '.$key.' ('.strlen($key).')<BR>';
echo 'IV            : '.$iv.' ('.strlen($iv).')<BR>';
$enc = MyEncrypt($plaintext, $key, $iv);
echo 'Verschlüsselt : '.$enc.'<BR>';
echo '<br>';
echo 'Entschlüsselt : '.MyDecrypt($enc, $key, $iv);
 
?>

Ergebnis:

Code:

Plaintext : zu verschlüsselnde Nachricht äöüÄÖÜß
Key : ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEF (32)
IV : 1234567890123456 (16)
Verschlüsselt : akMrallnS09ZVmlvOER5Y2w3WCtsVDJ3UEpYbTY4Yy9QQWg2N0xjaFYrdHNpL29pUEdOVVdvUHZNT2ZiQVMwWQ==

Entschlüsselt : zu verschlüsselnde Nachricht äöüÄÖÜß

[himitsu]

für AES mit CBC
siehe GetIt:

LockBox
Delphi Encryption Compendium
usw.

oder im Indy sollte sich auch was für OpenSSL finden, wenn man dessen AES-Code nutzen mächte
sowie andere OpenSSL-Libs für Delphi

[Kas Ob.]

@gpl ,

Please look at the answer for this question on SO :
https://stackoverflow.com/questions/...ncrypt-decrypt

Then adjust the PHP code to something similar then after that we talk about Delphi, encrypting data and send it over the wire (Internet) should be authenticated, it looks like trivial and not needed but when things go south the damage will be huge.

By just encrypting some data with fixed IV (!) and send it to different machine with authentication (for verification of integrity of the data) is like loading a gun with live bullet and aim it at your feet and wait, then wait for someone cough loudly around you !

I saw a damage similar to this implementation, the server was using different (random) IV per encryption as it should, yet there wasn't any authentication, the thing is with AES or any other symmetric encryption is that it will produce data no matter for any key (and IV), and there is no way to know if it is corrupted or not, anyway the server was sending the data and in that software after an update they request extra fields for the address (extra phone number) and someone forgot few lines that handle the password(s) from internally debugging the development build, after putting that server online some clients updated by adding the fields not looking that the other fields is garbage (or mostly empty because it was structured as list of strings) then clicked apply, data sent to the server and saved now it is all the fields are lost except the last one, which also unreadable because the list (data structure) was violated too.

This could have been prevented by adding an authentication, hence the decryption with wrong key(IV or password ...) could either raise an exception or simply not get the corrupt data allowing overwriting and losing valuable information.

So and sorry for long writing, either take some advices from that SO question or search for better solution, change the PHP side after, only after that you will not need a lot to write the same with Delphi as long you are not using some PHP library with unknown default parameters.

Also my suggestion is something like this answer to be exact:
https://stackoverflow.com/questions/...72528#46872528
it does Encrypt-then-MAC, but if you are going to use fixed IV (highly not recommended and simply wrong) then you should switch to MAC-then-Encrypt by calculating the HMAC for "$plaintext . iv" instead of "$ciphertext . iv" then test for data integrity (unlike that example) after the decryption not before.

Also you didn't mention what is the encryption library in Delphi you will use or prefer to.

ps: as said above the problem is from string encoding.
ps2 : DON'T REUSE IV, IV should be unique for each encryption, also should be sent over with the encrypted data, reusing it will defeat the whole point of the encryption.

[TurboMagic]

Zitat von himitsu:

für AES mit CBC
siehe GetIt:

LockBox
Delphi Encryption Compendium
usw.

oder im Indy sollte sich auch was für OpenSSL finden, wenn man dessen AES-Code nutzen mächte
sowie andere OpenSSL-Libs für Delphi

Öhm, sorry wenn ich dich schon wieder korrigieren muss. Aber die Delphi Encryption Compendium Fassung
im GetIt ist dafür unbrauchbar, da diese keine Verschlüsselungen enthält. Du findest diese aber auf
GitHub:

https://github.com/MHumm/DelphiEncryptionCompendium

Grüße
TurboMagic

[himitsu]

Maaaaaa, dieses blöde AmiExportverbot vergessen,
aber zumindest das Produkt war schonmal richtig.

Zitat:

unicode

OK, UTF-16 (früher UCS2).