-1

I have the following shell script which uses openssl to encrypt string:

API_KEY="qrBprgc/3dTjrrD@4t!9FcNjwT3_Ra"
DATE="Mon, 19 Mar 2018 12:45:05 EET"

aesivkey=$(echo -n "$DATE" | openssl dgst -sha256 -hmac "$API_KEY" -r)
aes128cbciv=${aesivkey:0:32}
aes128cbckey=${aesivkey:32:32}

private_key="test"
encrypted_private_key=`echo -e $private_key | openssl aes-128-cbc -base64 -nosalt -K $aes128cbckey -iv $aes128cbciv`

I am trying to make the same function in javascript(to use it in postman). At the moment I have the following code:

var dateString = "Mon, 19 Mar 2018 12:45:05 EET";
var api_key="qrBprgc/3dTjrrD@4t!9FcNjwT3_Ra"

//aesivkey=$(echo -n "$DATE" | openssl dgst -sha256 -hmac "$API_KEY" -r)
var aesivkey = (CryptoJS.HmacSHA256(dateString, api_key)).toString();
//aes128cbciv=${aesivkey:0:32}
var aes128cbciv = aesivkey.substring(0, 32);
//aes128cbckey=${aesivkey:32:32}
var aes128cbckey = aesivkey.substring(aesivkey.length - 32);

var private_key="test"

//encrypted_private_key=`echo -e $private_key | openssl aes-128-cbc -base64 -nosalt -K $aes128cbckey -iv $aes128cbciv`
var encrypted_private_key = CryptoJS.AES.encrypt(private_key, aes128cbckey,
{
    keySize: 128 / 8,
    iv: aes128cbciv,
    mode: CryptoJS.mode.CBC,
    padding: CryptoJS.pad.Pkcs7
});

Could someone please explain what I am doing wrong?

Result in shell script: HSMD8RaXNbRrN4c1NzFXvQ==

Result in javascript: U2FsdGVkX1+uapLKV00iSOtj8eVpjfY4onoqQmoPPF4=

5
  • And, what happens? Error? Wrong result? Puppies? Do aesivkey, aes128cbciv, aes128cbckey resemble their counterpart?
    – tevemadar
    Mar 19, 2018 at 13:13
  • @tevemadar I receive different results, shell script returns "HSMD8RaXNbRrN4c1NzFXvQ==" and javascript returns "U2FsdGVkX1+uapLKV00iSOtj8eVpjfY4onoqQmoPPF4=" Mar 19, 2018 at 13:41
  • Is the calculated key at least correct? Maybe the IV gets prefixed in the case of CryptoJS. Furthermore, you're using aesivkey intead of aescbckey in your call to encrypt. Mar 19, 2018 at 14:03
  • 1
    @MaartenBodewes Regarding "aesivkey" it was just a typo. Calculated key and iv are the same in shell/js. Mar 19, 2018 at 14:07
  • You should really look into better ways of generating your keys and IV values. Note that you should not use above to create a secure transport mode, because you will fail horrendously. Mar 19, 2018 at 14:40

1 Answer 1

1

Currently the result is Salted__ (see the ASCII contents of the base 64 encoding, the first 8 bytes spell this word), i.e. it uses password encryption. This is probably because your key and IV need to be decoded from hexadecimals to a WordArray before use. If the key is a string instead of a WordArray it will be interpreted as being a password, and the key will be derived.

For instance:

CryptoJS.enc.Hex.parse(aes128cbckey)

and

iv: CryptoJS.enc.Hex.parse(aes128cbciv)

Notes:

  • Specifying the keySize in the configuration parameters is nice if you provide a password, but if you specify the key directly you should probably not use it.

  • The developer that created CryptoJS should really really really not have overloaded the encrypt function.

3
  • I tried to decode my key and IV, then I still receive wrong result: "61KqddprvgB2Xq/YLO5Dmw==" Mar 19, 2018 at 14:46
  • Hmm, possibly that echo -e adds a newline? The output seems otherwise OK wrt size. Try -e -n! Mar 19, 2018 at 15:13
  • Oh, really the issue was in -e, now it works fine, thank you so mush for your assistance! Mar 19, 2018 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.