C++ AES Decrypt and Nodejs AES Decrypt producing different outputs

Question

I've reimplemented this AES c++ decryption in nodejs.

The "buffer" contains the encrypted content. The "decryptKey" contains the key to decrypt the "buffer". The "expectedOutput" contains the expected output.

In order to bypass the bad decrypt exception thrown by node I had to disable the autoPadding in my crypt object.

To simplify I added the c++ code and I added tests to three different algorithms (AES-128-ECB, AES-192-ECB, AES-256-ECB). None of the decrypt results match the C++ output.

What am I missing?

var crypto = require('crypto');

var buffer = new Buffer([
    0x5e,0x51,0xa3,0x53,0x9d,0xe7,0xe5,0xd3,
    0xee,0x30,0xbb,0xf8,0x0c,0x72,0x9f,0x80
]);


var decryptKey = new Buffer([
    0x36, 0x46, 0xb4, 0xf6, 
    0x8e, 0x6d, 0xdc, 0xf4, 
    0xb0, 0x31, 0x7e, 0x81, 
    0x6b, 0x5d, 0x96, 0x55
])

/*
After looking to my C++ code I noticed that despite of providing a 32 length key the 128 argument ensures that only the first 16 bytes are used
var decryptKey = new Buffer([
    0x36, 0x46, 0xb4, 0xf6, 
    0x8e, 0x6d, 0xdc, 0xf4, 
    0xb0, 0x31, 0x7e, 0x81, 
    0x6b, 0x5d, 0x96, 0x55, // 16
    0x15, 0x9c, 0x78, 0x54, 
    0x8c, 0xca, 0x3e, 0x39, 
    0x2d, 0x49, 0x75, 0x5d, 
    0xa1, 0x1a, 0xc3, 0xe3  // 32
])*/

var expectedOutput = new Buffer([
    0xc8,0x6c,0x8f,0x2b,0xe8,0x21,0xc4,0x2e,
    0xfb,0x4a,0x8e,0x8b,0xc3,0x94,0x19,0xc2
]);

// aes_context aes_ctx;
function decrypt(data, password, algorithm, padding){
  if (padding === void 0) padding = true;
  algorithm = algorithm || 'aes-128-ecb';

  //aes_setkey_dec( &aes_ctx, digest, 128 );
  var crypt = crypto.createDecipher(algorithm,password);
  crypt.setAutoPadding(padding);
  // aes_crypt_ecb( &aes_ctx, AES_DECRYPT, buffer, buffer );
  var res = crypt.update(data, null, 'hex')
  res += crypt.final('hex');

  return new Buffer(res,'hex');
}

// aes_setkey_dec( &aes_ctx, digest, 128 );
var algoList = [
    'aes-128-ecb',
    'aes-192-ecb',
    'aes-256-ecb'
];

for (var i = 0; i<= 1; i++){
    console.log('\n ******* AUTO PADDING: ' + (padding ? 'ON': 'OFF') + ' ********* ');
    var padding = i === 0;
    for (let algo of algoList){
        try {
            var output = decrypt(buffer, decryptKey, algo, padding);
            console.log(algo + ' => ' + output.toString('hex') + ' < ' + (Buffer.compare(expectedOutput, output) === 0 ? 'ok' : 'ko'))
        } catch (err){
            console.log('Failed to perform ' + algo + ' with autopadding ' + (padding ? ' on ': ' off ') + ' due to ' + err.message);
        }
    }
}

/*
 ******* AUTO PADDING: OFF *********
Failed to perform aes-128-ecb with autopadding  on  due to error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
Failed to perform aes-192-ecb with autopadding  on  due to error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
Failed to perform aes-256-ecb with autopadding  on  due to error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt

 ******* AUTO PADDING: ON *********
aes-128-ecb => d9817f142f9bca262b67f6a6be570345 < ko
aes-192-ecb => 9181784373bb6060c04c9ba75de26322 < ko
aes-256-ecb => c5945203368de477e5f0dbeedeb2189f < ko
*/

Heres the c++ code

#include "aes.h"
#include "sha2.h"

int main(int argc, char *argv[]) {


    unsigned char data[16] = { 
        0x5e,0x51,0xa3,0x53,0x9d,0xe7,0xe5,0xd3,0xee,0x30,0xbb,0xf8,0x0c,0x72,0x9f,0x80 
    };

    unsigned char key[32] = {
        0x36, 0x46, 0xb4, 0xf6,
        0x8e, 0x6d, 0xdc, 0xf4,
        0xb0, 0x31, 0x7e, 0x81,
        0x6b, 0x5d, 0x96, 0x55, // 16
        0x15, 0x9c, 0x78, 0x54,
        0x8c, 0xca, 0x3e, 0x39,
        0x2d, 0x49, 0x75, 0x5d,
        0xa1, 0x1a, 0xc3, 0xe3  // 32
    };

    aes_context aes_ctx;
    aes_setkey_dec(&aes_ctx, key, 128);
    aes_crypt_ecb(&aes_ctx, AES_DECRYPT, data, data);

    for (int i = 0; i< sizeof(data); ++i)
        std::cout << std::hex << (int)data[i];

    /* Output => c86c8f2be821c42efb4a8e8bc39419c2*/
}

references:

https://tls.mbed.org/discussions/generic/question-about-using-aes
http://aes.online-domain-tools.com/link/133660agcLyPgFri4s/ - Example of decryption online

The solution based in answer below

var crypto = require('crypto')
var buffer = new Buffer([
    0x5e,0x51,0xa3,0x53,0x9d,0xe7,0xe5,0xd3,
    0xee,0x30,0xbb,0xf8,0x0c,0x72,0x9f,0x80
]);


var decryptKey = new Buffer([
    0x36, 0x46, 0xb4, 0xf6, 
    0x8e, 0x6d, 0xdc, 0xf4, 
    0xb0, 0x31, 0x7e, 0x81, 
    0x6b, 0x5d, 0x96, 0x55
])

var expectedOutput = new Buffer([
    0xc8,0x6c,0x8f,0x2b,0xe8,0x21,0xc4,0x2e,
    0xfb,0x4a,0x8e,0x8b,0xc3,0x94,0x19,0xc2
]);

// aes_context aes_ctx;
function decrypt(data, password, algorithm, padding){
  if (padding === void 0) padding = true;
  algorithm = algorithm || 'aes-128-ecb';

  //aes_setkey_dec( &aes_ctx, digest, 128 );
  var crypt = crypto.createDecipheriv(algorithm,password, new Buffer([]));//new Buffer(32).fill(0).byteLength
  crypt.setAutoPadding(padding);
  // aes_crypt_ecb( &aes_ctx, AES_DECRYPT, buffer, buffer );
  var res = crypt.update(data, null,'hex')
  + crypt.final('hex');

  return new Buffer(res,'hex');
}

// aes_setkey_dec( &aes_ctx, digest, 128 );
var output = decrypt(buffer, decryptKey, 'aes-128-ecb', false);
console.log(Buffer.compare(expectedOutput, output) === 0 ? 'ok' : 'ko');

aes_crypt_ecb - At this point huge warning klaxons should be going off! Do NOT use ECB ... unless you are using ECB for this test program and another mode will just add additional complication that is not relevant to your problem (in which case - kudos). — Martin Bonner supports Monica

rustyx rustyx · Accepted Answer · 2018-07-04T16:03:47

The deprecated crypto.createDecypher() derives the key from the password argument:

The implementation of crypto.createDecipher() derives keys using the OpenSSL function EVP_BytesToKey with the digest algorithm set to MD5, one iteration, and no salt.

What you want instead is to use a raw key. For that you should use crypto.createDecipheriv() instead:

  var crypt = crypto.createDecipheriv(algorithm,password,new Buffer([]));

(In ECB mode the IV can be empty)

Of course, the key length must then match the requested algorithm (128, 192 or 256 bits). You key is 128 bits, so only aes-128-ecb will work.

C++ AES Decrypt and Nodejs AES Decrypt producing different outputs

2 Answers