Convert PHP openssl_encrypt with md5 to NodeJS using Crypto

Question

I have this code in PHP (can't modify)

<?php $myPlain = "123456789012345678900000"; $myKey = md5($myPlain, true); $myKey .= substr($myKey, 0,8); $encrypted = openssl_encrypt($myPlain, 'des-ede3', $myKey, OPENSSL_RAW_DATA); print(base64_encode($encrypted));

This code returns

FTYDrZTZMjVBv5Fk/xcfFxJASaizzrmoPts7fGDvWjc=

When I try to replicate this in NodeJS

function testEde3(myKey, myPlain) { try { let md5Key = crypto.createHash('md5').update(myKey, 'utf-8').digest("base64").substr(0, 24); console.log(md5Key); //outputs 4o1aJrSWN3bSfjuIX6VXgA== console.log(md5Key.length); //outputs 24 const cipher = crypto.createCipheriv('des-ede3', md5Key, null); let encrypted = cipher.update(myPlain, 'utf8', 'base64'); encrypted += cipher.final('base64'); return encrypted; } catch ( ex ) { return ex; } } const myKey = "123456789012345678900000"; const myPlain = "123456789012345678900000"; const hash = testEd3(myKey, myPlain); console.log(`Hash is: ${hash}`);

The output is

Hash is: lDQX9OGsopKOt6P9WQwekGsKDQGFpfGW50zbs3HrOfQ=

I'm thinking the problem is on MD5. If I try to encrypt without md5, the results are the same.

Thanks

Topaco · Accepted Answer · 2021-06-01 11:33:05Z

The key in Php code consists of the 16 bytes of the MD5 hash, to which the first 8 bytes of the MD5 hash are appended, resulting in a 24 bytes key (as required for 3DES). This is currently not implemented in the NodeJS code, but can be achieved e.g. by:

let md5Key = crypto.createHash('md5').update(myKey, 'utf-8').digest(); md5Key = Buffer.concat([md5Key, md5Key.slice(0, 8)]);

With this change, the NodeJS code generates the ciphertext of the PHP code with the same input data.

des-ede3 means 3DES in ECB mode. Note that 3DES is outdated and slow and should be replaced by AES. ECB mode is generally insecure. Encrypting the key also makes little sense (but may only be for testing purposes).

You are right! Thank you very much I know the ECB is insecure, but the client are using this cipher and I can't do very much about this besides talk and talk to him.

Collectives™ on Stack Overflow

Convert PHP openssl_encrypt with md5 to NodeJS using Crypto

1 Answer 1

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Related