0

I have a problem in encrypting a header signature in php. I have to create a signature header to comunicate with some API. they provide me the solution trought postman pre-request script with CryptoJS. here is the code:

const url = request.url.split('?')[0]
const subUrl = url.substring(url.indexOf('/'))

const plainSignature = subUrl + '##' + request.method + '#' + pm.collectionVariables.get('api_key')

const encrypted = CryptoJS.AES.encrypt(plainSignature, CryptoJS.enc.Hex.parse(pm.collectionVariables.get('api_key')), {
    iv: CryptoJS.enc.Hex.parse('00000000000000000000000000000000'),
    mode: CryptoJS.mode.CBC,
    padding: CryptoJS.pad.Pkcs7
})

pm.collectionVariables.set('signature', CryptoJS.enc.Hex.stringify(CryptoJS.enc.Base64.parse(encrypted.toString())))

I have to convert it into php code and here is my php code.

public static function encrypt($secretKey, $plainText) {
        try {
            // Check secret length
            if (!static::isKeyLengthValid($secretKey)) {
                throw new \InvalidArgumentException("Secret key's length must be 128, 192 or 256 bits");
            }
            // Get random initialization vector
            // $initVector = bin2hex(openssl_random_pseudo_bytes(static::INIT_VECTOR_LENGTH / 2));
            $initVector = bin2hex('00000000000000000000000000000000');
            $secretKey = hex2bin($secretKey);

            // Encrypt input text
            $raw = openssl_encrypt(
                $plainText,
                static::CIPHER,
                $secretKey,
                OPENSSL_RAW_DATA,
                $initVector
            );

            // Return base64-encoded string: initVector + encrypted result
            $result = base64_encode($initVector . $raw);
            if ($result === false) {
                // Operation failed
                return new static($initVector, null, openssl_error_string());
            }
            // Return successful encoded object
            return new static($initVector, $result);
        } catch (\Exception $e) {
            // Operation failed
            return new static(isset($initVector), null, $e->getMessage());
        }
    }

and this is the cipher method i've used.

const CIPHER = 'AES-128-CBC';

I provide the plaintext to method, but i get error and the output is not same from crypto js and php. Do you have any advice for me? Thank you.

4
  • In the CryptoJS code the ciphertext is hex encoded, in the PHP code IV and ciphertext are concatenated and then Base64 encoded. Also, in the beginning of the PHP code, the IV must be hex decoded and not hex encoded (analogous to the key). It would be helpful if you could post sample data. Btw, a static IV is insecure.
    – Topaco
    Sep 16, 2021 at 15:19
  • @Topaco i think my php code is wrong. but the provided script for postman is ok and working when i try to send request, i just wondering how to convert it from js to php. sample data for plaintext='/payment/purchase##POST#12efb12cc78441756bfad60a1b8be0a0c89b352c77f839285e6474fc6664a775' Sep 16, 2021 at 16:30
  • @Topaco this is the code i wrote just now based on the crypto js. where im doing wrong? onecompiler.com/php/3xbp83sgm Sep 16, 2021 at 16:40
  • 1
    Since you use a 32 bytes key you have to apply AES-256-CBC as algorithm.
    – Topaco
    Sep 16, 2021 at 16:51

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.