openssl decrypt function not working properly after php upgrade

Question

I have a PHP application that is using openssl_encrypt and openssl_decrypt, it has been working fine for the past four years.
Recently, the app is showing false when it calls openssl_decrypt function.

This is the encryption part:

<?php
$password = "iR0nM@N2017!?KOreVoNick";
$method = "aes128";
$iv = "69kjg23423L@cEv7";

$montant = htmlentities($_POST['montant'])-$mutation;
$numeroCheque = openssl_encrypt(htmlentities($_POST['numeroCheque']), $method, $password, 0, $iv);
$designationSociete = openssl_encrypt(htmlentities($_POST['designationSociete']), $method, $password, 0, $iv);
$designationPersonne = openssl_encrypt(htmlentities($_POST['designationPersonne']), $method, $password, 0, $iv);
$dateCheque = htmlentities($_POST['dateCheque']);
$idProjet = htmlentities($_POST['idProjet']);
$createdBy = $login;
$created = date('d/m/Y h:m');
$statut = htmlentities($_POST['statut']);
$compteBancaire = openssl_encrypt(htmlentities($_POST['compteBancaire']), $method, $password, 0, $iv);
$url = "";
$cheque = new Cheque(array('numero' => $numeroCheque , 'montant' => $montant,
    'designationSociete' => $designationSociete, 'designationPersonne' => $designationPersonne, 
    'dateCheque' => $dateCheque, 'idProjet' =>$idProjet, 'idSociete' => $idSociete, 'compteBancaire' => $compteBancaire, 'createdBy' => $createdBy, 'created' => $created,
    'statut' => $statut, 'url' => $url));
    $chequeManager = new ChequeManager($pdo);
    $chequeManager->add($cheque);

And for decryption it's easy as this:

    openssl_decrypt($cheque->numero(), $method, $password, 0, $iv);

And this is the error I get when I use openssl_error_string()

'error:0607A082:digital envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length'

Any suggestions?

Answer 1

I have tried the following:

<?php

$cleartext = "The quick brown fox jumps over the lazy dog";
$password = "iR0nM@N2017!?KOreVoNick";
$method = "aes128";
$iv = "69kjg23423L@cEv7";

$enctext = openssl_encrypt($cleartext, $method, $password, 0, $iv);

$dectext = openssl_decrypt($enctext, $method, $password, 0, $iv);
header("content-type:text/plain");

echo "decrypted: $dectext\n\n";
echo "encrypted: $enctext\n\n";
echo "orig: $cleartext\n";

Result

decrypted: The quick brown fox jumps over the lazy dog

encrypted: fyYcGEVOpH9cEZuBIN4S1GRDp/kU+Kzv1UJUp2UBGpPv/R+BxxbBDArKa+ugvOOr

orig: The quick brown fox jumps over the lazy dog

Therefore my conclusion is that you have some issue with the length or padding of what you are decrypting.

PHP version:

Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.4.3