2

Good day, guys. I am having a trouble while developing AES encryption using CryptoJS in javascript. Let's see my source code first.

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<title></title>
<script src="jquery-3.5.1.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/core.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/enc-base64.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/md5.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/evpkdf.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/cipher-core.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/aes.min.js"></script>
<!--<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/pad-nopadding.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/lib-typedarrays.min.js"></script>-->
<script type="text/javascript">
    $(document).ready(function() {
        var encrypted = "TEST";
        var key = CryptoJS.enc.Hex.parse("bf161fba8b12433f176bc9088e14bd49499ee34fcb4694082345639957e778852bdc904206c4ecd2d3e2f4bc");
        var iv  = CryptoJS.enc.Hex.parse("18a69482e9d401052c4307dcb8124409");
        var decrypted = CryptoJS.AES.encrypt(encrypted, key, { iv: iv });
        var dec         = CryptoJS.AES.decrypt(decrypted, key, { iv: iv });

        var _cipher     = decrypted.toString();
        var _plain      = dec.toString();
    });
</script>

Here, you can see my key size is 44 bytes which is 352 bits. But CryptoJS perfectly encrypts and decrypts with IV 16 bytes length. I totally don't understand how this happen. With my understanding, AES standard uses 128, 192 and 256 bits key size. https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

My problem is that I have to write some codes on C# to encrypt that same data with same key and iv. But C# does not allow to use 44 bytes key length for AES. I am using RijndaelManaged.

Is there anyone who can explain how this happens in CryptoJS? So that I can write my own C# codes. Thanks in advance.

codeklepter x
  • 21
  • 3
  • 2
    *...you can see my key size is 44 bytes...* Why do you have a 44 byte key for AES? – President James K. Polk Jul 09 '20 at 13:29
  • 2
    CryptoJS doesn't check the key size, resulting in numbers of rounds not defined for AES (e.g. 17 rounds for 44 bytes; AES defines 10, 12 and 14 rounds depending on the key size), see [here](https://github.com/brix/crypto-js/issues/293) and [here](https://github.com/brix/crypto-js/blob/develop/src/aes.js), line 92 ff. – Topaco Jul 09 '20 at 14:59
  • 1
    @PresidentJamesK.Polk That's what I am asking. I didn't create that javascript sample sour code. It's from a web site. What I have to do is to re-produce in C# with the same key used in javascript. – codeklepter x Jul 10 '20 at 08:53
  • 2
    Since the processing of a key (unequal 16, 24, 32 bytes) is in the end a CryptoJS bug that leads to an encryption _beyond_ the AES standard, you will not be able to reproduce this, neither in C# nor with any other language, i.e. decryption is only possible with CryptoJS. – Topaco Jul 10 '20 at 10:25
  • 3
    @Topaco: That really is terrible. – President James K. Polk Jul 10 '20 at 15:22
  • 3
    @PresidentJamesK.Polk - Yes, it's surprising that they haven't noticed this in their tests or don't see the need to fix it. Particularly because CryptoJS has been around in its current design since May 2012 (v3.0) and already that version contains this bug. – Topaco Jul 11 '20 at 10:29

0 Answers0