0

I'm doing some work querying an API using that has been provided by another (large, multinational) company. One of the parameters needs to be encrypted using DES (I know, it's not considered secure, but a. the API has already been developed and b. the data encrypted is fairly easily available to the public anyway). I've got to the point where 2 of the 5 queries I've been asked to run are working, but the other 3 are not.

This is where things start to confuse me. The 2 that work fine are obviously encrypting the number correctly. However, the company in question has advised that the encrypted outputs do not match theirs for the 3 that are failing. I don't really understand how this can be, but they've shown me that, for example, one expected encrypted output should have been "9B2653BF0C348D8BA8643266BEBF329FDD643D2E4F432062" but my output was "9B2653BF0C348D8B710BCAF2B3DBFCBFDD643D2E4F432062" - it seems that 16 characters in the middle in each instance are not matching their output.

My code to encrypt the data is this:

public string GetEncryptedValue(string baseValue)
{
    using (var desProvider = new DESCryptoServiceProvider
          {
            Mode = CipherMode.ECB,
            Padding = PaddingMode.PKCS7,
            Key = Encoding.UTF8.GetBytes(Key)
          })
    using (var memoryStream = new MemoryStream())
    using (var cryptoStream = new CryptoStream(memoryStream, 
            desProvider.CreateEncryptor(), CryptoStreamMode.Write))
    {
       var data = Encoding.UTF8.GetBytes(baseValue);
       cryptoStream.Write(data, 0, data.Length);
       cryptoStream.FlushFinalBlock();

       return ByteArrayToString(memoryStream.ToArray());
    }
}

private static string ByteArrayToString(ICollection<byte> byteArray)
{
    var hex = new StringBuilder(byteArray.Count * 2);
    foreach (var singleByte in byteArray)
    hex.AppendFormat("{0:x2}", singleByte);
    return hex.ToString().ToUpper();
}

Can anyone make suggestions as to what the cause might be? I've tried different encoding types. I know the padding mode is PKCS#5, but as per this SO answer the algorithms are the same. The company in question are large and it often takes several days for questions to go between several countries to get an answer which is often irrelevant.

Thanks.

3
  • You probably have different implementations of ByteArrayToString.
    – Jodrell
    Mar 26, 2014 at 9:55
  • 1
    The encrypted output is 3*8=24 bytes, meaning that the initial value is 16-23 bytes long. The DES has block-size of 8 bytes, meaning that 8 input bytes correspond to 8 output bytes, and ECB mode means that 8-byte blocks are independent. This and the fact that the outputs differ by only the second 8-byte block leads to conclusion that inputs differ by at least one byte in positions 8-16. Can you check whether the input to the encryption is the same in yours problematic cases? Mar 26, 2014 at 10:14
  • You're probably right Oleg, but any other Encoding type I use to get bytes results in ALL outputs being different from the expected outputs. It's definitely the same method use to encrypt based on the string field.
    – MrShoes
    Mar 26, 2014 at 11:44

1 Answer 1

0

It turns out the problem was at the other company's end, and backs up exactly Oleg Estekhin's comment: "The encrypted output is 3*8=24 bytes, meaning that the initial value is 16-23 bytes long. The DES has block-size of 8 bytes, meaning that 8 input bytes correspond to 8 output bytes, and ECB mode means that 8-byte blocks are independent. This and the fact that the outputs differ by only the second 8-byte block leads to conclusion that inputs differ by at least one byte in positions 8-16."

The values added to their system (which were VIN numbers) were added with the letter O in them where the number 0 should have been used; interestingly, the letter "O" is an illegal character in VINs, which one would assume a company that manufactures cars would know!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.