Home » Encryption » Crypt_Blowfish » Bug #6932

[2006-02-25 02:24 UTC] cryogen at mac dot com

Description:
------------
I am using crypt_blowfish to encrypt a database name
and two integer indexes. I then pass these values in
the URL to a PHP script which then decrypts the values
in order to update a user's record.

When I send the query to MySQL, I get a syntax error.
If I output the query and submit it directly to MySQL it
works just fine. If I typecast the decyrpted integer
values they work. But I cannot get this to work with
the string variable???

Test script:
---------------
$bf = new Crypt_Blowfish(K_BLOWFISH);
$db_name = $bf->encrypt("db1");
$company_id = $bf->encrypt("10");
$usernumber = $bf->encrypt("24");

$bf = new Crypt_Blowfish(K_BLOWFISH);
$db_name = $bf->decrypt($db_name);
$company_id = $bf->decrypt($company_id);
$usernumber = $bf->decrypt($usernumber);

$query = "UPDATE ".$db_name.".user ".
"SET opt_out = 1 ".
"WHERE company_id = ".$co_id.
" AND usernumber = ".$usernumber;

Expected result:
----------------
This produces the query:

UPDATE db1.user SET opt_out = 1 WHERE company_id = 10
AND usernumber = 24

When I submit this to MySQL using the PHP function
mysql_query, I get a syntax error #1064 from MySQL. But
if I submit this manually (or just hardcode the values
in the $query variable) to MySQL it works fine.

In order to get this to work at all I have to hardcode
the database name in the query and typecast the
company_id and usernumber values like this:

$company_id = (int)$bf->decrypt($company_id);
$usernumber = (int)$bf->decrypt($usernumber);

This only partially solves my problem, I do not
understand what is happening to the $db_name value
"db1"? It display's as db1 but MySQL won't recognize
it. If I manually assign the variable ($db_name =
"db1") the query works. Something is happening in the
encrypt/decrypt process that changes the state or value
in some way?

[2006-04-26 16:04 UTC] ben at wieck dot com

I am having the same issues with decrypted data not being the same as the original data. A little test had some interesting results. Why the heck is the decrypted data being reported as having a length of 16?

I am not playing with encodings, and I'm assiming Crypt_Blowfish is not either. More food for thought.

<?php

require('Crypt/Blowfish.php');

$bf = new Crypt_Blowfish('monkey');

$data = "Hello Ben";

$dec = $bf->decrypt($bf->encrypt($data));

print "Original Data: [".$data."]\n"
."MD5: ".md5($data)."\n"
."Length: ".strlen($data)."\n";

print "Decrypted Data: [".$dec."]\n"
."MD5: ".md5($dec)."\n"
."Length: ".strlen($dec)."\n";

?>

#php Crypt_Blowfish_test.php
Original Data: [Hello Ben]
MD5: 9391321c6d6922a8ef1f2a213eb540af
Length: 9
Decrypted Data: [Hello Ben]
MD5: 6330c212fbb24b18fdb3d5ab843cafe2
Length: 16

#php -v
PHP 5.0.5 (cli) (built: Jan 3 2006 13:18:41)
Copyright (c) 1997-2004 The PHP Group
Zend Engine v2.0.5, Copyright (c) 1998-2004 Zend Technologies

[2006-04-26 16:18 UTC] ben at wieck dot com

This should help the original poster. I was thumbing around and saw that mcrypt stuff tends to add null padding on decrypted information. This means a simple trim() should clear things up! Indeed it does!

-- snippet --
$dec = trim($dec);
print "Decrypted Data: [".$dec."]\n"
."MD5: ".md5($dec)."\n"
."Length: ".strlen($dec)."\n";
-- snippet --

#php Crypt_Blowfish_test.php
Original Data: [Hello Ben]
MD5: 9391321c6d6922a8ef1f2a213eb540af
Length: 9
Decrypted Data: [Hello Ben]
MD5: 9391321c6d6922a8ef1f2a213eb540af
Length: 9

Success!

[2006-04-26 16:31 UTC] cryogen at mac dot com

Thanks for the tip Ben. It seems silly to have to perform
"trim()" and typecast results to get consistent results from
the Blowfish encryption class. I would suggest the author
implement some of the basic checks and conversions to make
the routines much more user friendly.

At the very least these facts should be documented in the
Blowfish documentation so that it is plainly stated that
null padding occurrs with strings and that numeric values
will have to be typecast or trimmed as well to make them
useful.