Extra null characters when decrypting AES-CBC-PKCS7 with BouncyCastle

Question

I need to implement AES encryption in 2 different projects, but one must use the .NET standard crypto libraries and the other must use BouncyCastle. Both are C# code. Relevant methods are as follows:

.NET:

internal class NETAesCryptor : IAesCryptor
{
    public Tuple<byte[], byte[]> Encrypt(string plaintext, byte[] key)
    {
        byte[] ciphertext, iv;
        using (var aes_provider = new AesCryptoServiceProvider())
        {
            aes_provider.Padding = PaddingMode.PKCS7;
            aes_provider.GenerateIV();
            iv = aes_provider.IV;
            var encryptor = aes_provider.CreateEncryptor(key, iv);
            using (var ms = new MemoryStream())
            {
                using (var cs = new CryptoStream(ms, encryptor, CryptoStreamMode.Write))
                {
                    using (var sw = new StreamWriter(cs))
                    {
                        sw.Write(plaintext);
                    }
                    ciphertext = ms.ToArray();
                }
            }
        }
        var result = new Tuple<byte[], byte[](ciphertext, iv);
        return result;
    }

    public string Decrypt(byte[] ciphertext, byte[] iv, byte[] key)
    {
        string plaintext;
        using (var aes_provider = new AesCryptoServiceProvider())
        {
            aes_provider.Padding = PaddingMode.PKCS7;
            aes_provider.IV = iv;
            var decryptor = aes_provider.CreateDecryptor(key, iv);
            using (var ms = new MemoryStream(ciphertext))
            {
                using (var cs = new CryptoStream(ms, decryptor, CryptoStreamMode.Read))
                {
                    using (var sr = new StreamReader(cs))
                    {
                        plaintext = sr.ReadToEnd();
                    }
                }
            }
        }
        return plaintext;
    }
}

Bouncycastle:

internal class BCAesCryptor : IAesCryptor
{
    private SecureRandom _r;

    public BCAesCryptor()
    {
        _r = new SecureRandom();
    }

    public Tuple<byte[], byte[]> Encrypt(string plaintext, byte[] key)
    {
        var plaintext_bytes = Encoding.UTF8.GetBytes(plaintext);
        var iv = GenerateRandomBytes(16);

        var engine = new AesEngine();
        var cbc_cipher = new CbcBlockCipher(engine);
        var cipher = new PaddedBufferedBlockCipher(cbc_cipher, new Pkcs7Padding());
        var key_param = new KeyParameter(key);
        var key_param_with_iv = new ParametersWithIV(key_param, iv);

        cipher.Init(true, key_param_with_iv);
        var ciphertext = new byte[cipher.GetOutputSize(plaintext_bytes.Length)];
        var length = cipher.ProcessBytes(plaintext_bytes, ciphertext, 0);
        cipher.DoFinal(ciphertext, length);

        var result = new Tuple<byte[], byte[]>(ciphertext, iv);
        return result;
    }

    public string Decrypt(byte[] ciphertext, byte[] iv, byte[] key)
    {
        var engine = new AesEngine();
        var cbc_cipher = new CbcBlockCipher(engine);
        var cipher = new PaddedBufferedBlockCipher(cbc_cipher, new Pkcs7Padding());
        var key_param = new KeyParameter(key);
        var key_param_with_iv = new ParametersWithIV(key_param, iv);

        cipher.Init(false, key_param_with_iv);
        var plaintext = new byte[cipher.GetOutputSize(ciphertext.Length)];
        var length = cipher.ProcessBytes(ciphertext, plaintext, 0);
        cipher.DoFinal(plaintext, length);

        var result = Encoding.UTF8.GetString(plaintext);
        return result;
    }

    private byte[] GenerateRandomBytes(int length = 16)
    {
        var result = new byte[length];
        _r.NextBytes(result);
        return result;
    }
}

Encryption/decryption between .NET methods works OK, and Bouncycastle encryption/.NET decryption also works OK. But for some reason, Bouncycastle decryption adds a variable number of \0 characters at the end of the plaintext, and I don't know why is this happening.

Test code I'm using:

[TestClass]
public class AesCryptorTests
{
    private byte[] _key;
    private string _plaintext;

    public AesCryptorTests()
    {
        _key = GenerateRandomBytes();
        _plaintext = "Lorem ipsum dolor sit amet";
    }

    [TestMethod]
    public void TestMethod2()
    {
        var bc = new BCAesCryptor();
        var net = new NETAesCryptor();
        var result = net.Encrypt(_plaintext, _key);
        var new_plaintext = bc.Decrypt(result.Ciphertext, result.IV, _key);
        Assert.AreEqual(_plaintext, new_plaintext);
    }

    private byte[] GenerateRandomBytes(int cantidad = 16)
    {
        var result = new byte[cantidad];
        using (var r = new RNGCryptoServiceProvider())
        {
            r.GetBytes(result);
        }
        return result;
    }
}

In the previous test, the decryption returns Lorem ipsum dolor sit amet\0\0\0\0\0\0 instead of the plaintext.

Any advice/comment would be greatly appreciated.

Answer 1

The Bouncy Castle can only guess the output size of the plaintext message in advance during the call to GetOutputSize. It cannot know how many padding bytes are used, because those are only available after decryption. So they would have to partially decrypt the ciphertext to know the amount of padding, and that's taking it a step too far. Therefore you get just an estimate on the high side so that the maximum number of bytes can still fit in your newly created buffer.

You'll need the return value of the ProcessBytes and DoFinal to see the actual number of bytes that are decrypted from the ciphertext (in the input buffer and internal buffer) when the methods are called. DoFinal decrypts the last block(s) and then removes the padding from the final block, so only at that time is the size of the (remaining) plaintext known.

What you're currently seeing as zero valued bytes are just the unused bytes of the buffer, as the plaintext size is smaller than the value returned by GetOutputSize.

---

Of course, this is all hidden in the streaming code of the .NET sample, where ReadToEnd is required to doing some advanced buffering (probably using a MemoryStream internally itself).