Search code examples
phpbase64session-variablespearblowfish

Blowfish decode from a string


Using the blowfish cbc mode, I want to create an encrypted token. When I create the token and immediately decrypt it, it works correctly. However, if I place the encrypted token in SESSION and try to decrypt it during a subsequent request, the decryption produces garbage.

This is my code. I am using SESSION for testing; eventually, I'll be storing these strings in a database instead.

session_start();
define("key","v8nga4r76qlipm111jnioool");
define("iv",substr(md5(uniqid(rand(),1)),0,8));
require_once("Crypt/Blowfish.php");

$str = "Blowfish_test";
// encode start!!
$blowfish = Crypt_Blowfish::factory("cbc", key, iv);
$encrypt = $blowfish->encrypt($str);
$encrypt64 = base64_encode($encrypt);
$_SESSION["test"] = $encrypt64;

So far, everything is correct. If, on the same request, I immediately decode it (from SESSION), the results are as expected:

// decode start!!
$blowfish = Crypt_Blowfish::factory("cbc", key, iv);
$decrypt64 = base64_decode($_SESSION["test"]);
$decrypt = $blowfish->decrypt($decrypt64);
$trim_decrypt = rtrim($decrypt, "\0");
echo "Before encryption : " . $str ."<br>";
echo "Encrypted string &nbsp&nbsp: " .$encrypt64. "<br>";
echo "decrypted string &nbsp&nbsp: " .$trim_decrypt. "<br>";

If I place only the second block of code on a different page (so a previously generated string is being decrypted), the decrypted string is garbage.

Encryption -> session["test"] -> Decryption --- no problem

session["test"] -> Decryption --- problem

What's happening here?


Solution

  • I'm sorry for this super delay. I solved this problem by the comment at that time, so I close this question using community wiki.

    --- add ---
    problem is solved

    // encode
    // At the same time save the initialization vector
    $_SESSION["test"] = $encrypt64;
    $_SESSION["iv"]   = iv;
    
    --- other file ---
    // decode
    $blowfish = Crypt_Blowfish::factory("cbc", key, $_SESSION["iv"]);