CCCrypt decryption results in -4304

Question

When I encrypt a string then immediately decrypt, the CCCryptorStatus is -4304 and the resultant decoded string is not the proper length. Can anyone see what I might be doing wrong?

//Encrypt

NSString *plainText = @"e22ae25e-0b20-433a-8aa5-a5678714f590";
NSData *rawData = [plainText dataUsingEncoding:NSUTF8StringEncoding];
size_t outLength;
NSMutableData *cipherData = [NSMutableData dataWithLength:rawData.length + kCCBlockSizeAES128];
CCCryptorStatus cryptStatus = CCCrypt(kCCEncrypt, kCCAlgorithmAES128, kCCOptionPKCS7Padding, [AESKey bytes], [AESKey length],  NULL, [rawData bytes], [rawData length], [cipherData mutableBytes], [cipherData length], &outLength);

//[plainText length] = 36
//[rawData length] = 36
//[cipherData length] = 52
//outLength = 48

//Decrypt

NSMutableData *decodedData = [NSMutableData dataWithLength:cipherData.length + kCCBlockSizeAES128];

//[decodedData length] = 68

CCCryptorStatus cryptStatus2 = CCCrypt(kCCDecrypt, kCCAlgorithmAES128, kCCOptionPKCS7Padding, [AESKey bytes], [AESKey length], NULL, [cipherData bytes], [cipherData length], [decodedData mutableBytes], [decodedData length], &outLength);
NSString *decodedString = [[NSString alloc] initWithData:decodedData encoding:NSUTF8StringEncoding];

//[decodedData length] = 68
//[decodedString length] = 68

/*
    At this point, cryptStatus2 is -4304 and 
    decodedString = "e22ae25e-0b20-433a-8aa5-a5678714f590\f\f\f\f\f\f\f\f\f\f\f\f";

*/

Look up the constants for CCCryptorStatus and see what it means. — Hot Licks, Jul 11 '12 at 17:39
kCCDecodeError Input data did not decode or decrypt properly — skajake, Jul 11 '12 at 20:11

score 1 · Accepted Answer · answered Jul 11 '12 at 17:45

1

That's a kCCAlignmentError according to the header file. Try to use outlength instead of [cipherData length].

answered Jul 11 '12 at 17:45

Maarten Bodewes

90,524
13
150
263

By the way, your output buffer never has to be larger than the cipher text (in the first value of outlength). For PKCS7Padding, it would be outlength - 1, but I would keep to outlength in case you change (padding) mode. – Maarten Bodewes Jul 11 '12 at 17:48
Owl, I tried changing the decrypt line to be `CCCryptorStatus cryptStatus2 = CCCrypt(kCCDecrypt, kCCAlgorithmAES128, kCCOptionPKCS7Padding, [AESKey bytes], [AESKey length], NULL, [cipherData bytes], outLength, [decodedData mutableBytes], [decodedData length], &outLength);` This resulted in error code 4304 `kCCDecodeError Input data did not decode or decrypt properly.` – skajake Jul 11 '12 at 17:56
Strangely enough, it seems that your own try did work, except for the padding. This is because the padding bytes were not "removed" but the outLength should give the size of the plain text. Could you print out the sizes of the input/output, especially the outLength values after the call? Don't you need to initialize those vars? – Maarten Bodewes Jul 11 '12 at 18:27
Owlstead, thanks for your help on this. I have updated my question above with comments to indicate length values during execution. – skajake Jul 11 '12 at 18:45
Could you try again but with a different outLength variable for the result of the decryption? – Maarten Bodewes Jul 11 '12 at 19:00
Hmm, I don't know if the advice above does matter. I do know that outLength certainly contains the correct length after the call to encrypt, so it *should* be used as length of the ciphertext (your input is about 36 bytes, the next multiple of 16 is 48 for sure). – Maarten Bodewes Jul 11 '12 at 19:17
Ive been tinkiring alot with the buffer size and I think what is happening is not a problem with the buffer. If i make the buffer at least 48 bytes it will contain the result including the erroneous padding. – skajake Jul 11 '12 at 20:09
The padding you see is not erroneous. The issue is that you take too much information from the buffers, hence the hint for the `outLength`. The padding you see is perfectly normal PKCS#7 padding, 12 bytes valued 12 decimal, 0x0C hexadecimal or formfeed (\h) in ASCII. If you print outLength after the last call, I'll bet it's valued 36, which is the correct size of the plain text. Maybe you can shrink or copy the buffers to the right size somehow? – Maarten Bodewes Jul 11 '12 at 20:36
Owl, the value of outLength after the decode call is 0 and the CCCryptorStatus is 4304 = kCCDecodeError. Thanks again for bearing with me. – skajake Jul 11 '12 at 20:44
Coming out of the original encryption call, outLength is 48. Coming out of the decryption call, it fails to get set due to the error. One other note is that if i set the decryption out buffer to any size less than 48 it fails with kCCBufferTooSmall. – skajake Jul 11 '12 at 20:52
Try to create a buffer that holds the cipher text up to outLength bytes from the encryption buffer. Then create another buffer with the same length for the decryption. Finally, after decryption, create another one with the size of outLength after decryption and copy in the result (?). I'm not an Apple dev :(. – Maarten Bodewes Jul 11 '12 at 21:00
You don't have to award answers if the problem is not solved, I've marked this [tag:objective-c], maybe somebody can have a looksy, because this has defininately something to do with the buffer handling or the way outLength has been created/used. – Maarten Bodewes Jul 11 '12 at 21:54
No, actually it is solved! I had edited your comment to put the final answer but I guess it never got approved. Your solution was correct, but I had not implemented it correctly. The final decryption line looked like this `CCCryptorStatus cryptStatus2 = CCCrypt(kCCDecrypt, kCCAlgorithmAES128, kCCOptionPKCS7Padding, [AESKey bytes], [AESKey length], NULL, [cipherData bytes], outLength, [decodedData mutableBytes], [decodedData length], &outLength);` – skajake Jul 12 '12 at 01:18
Glad you got it solved user1518541. That was quite a lot of debugging, I hope encryption and buffer use is a bit more clear now. – Maarten Bodewes Jul 12 '12 at 18:08

CCCrypt decryption results in -4304

1 Answers1