PHP MCRYPT encrypt/decrypt returns invisible strange characters?

Question

mcrypt_decrypt is giving me additional invisible characters which are NOT VISIBLE by just echoing out on the page. Can ONLY BE SEEN by writing it to the text file. Means, just displaying on the page is OK and hard to be noticed.

Here is the code sample by Googling. Please guide me what is the correct usage is there's something wrong:

function encrypt ($pure_string, $key) {
    $iv_size = mcrypt_get_iv_size(MCRYPT_BLOWFISH, MCRYPT_MODE_ECB);
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    $encrypted_string = mcrypt_encrypt(MCRYPT_BLOWFISH, $encryption_key, $pure_string, MCRYPT_MODE_ECB, $iv);
    return $encrypted_string;
}

function decrypt ($encrypted_string, $key) {
    $iv_size = mcrypt_get_iv_size(MCRYPT_BLOWFISH, MCRYPT_MODE_ECB);
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    $decrypted_string = mcrypt_decrypt(MCRYPT_BLOWFISH, $encryption_key, $encrypted_string, MCRYPT_MODE_ECB, $iv);
    return $decrypted_string;
}

but when i try it:

$encrypted_string = encrypt("This is the original string.", "ABC123");
echo decrypt($encrypted_string, "ABC123");

.. i am getting something like:

This is the original string.�������

This strange characters �� are actually not visible when you/ i just echo it. Can only be seen by writing into the text file.

So what am i missing please?
Is there any perfect way to achieve this encrypt/decrypt?

Thank you.

possible duplicate of [PHP decryption fails on some strings with trim()'s](http://stackoverflow.com/questions/16518795/php-decryption-fails-on-some-strings-with-trims) — Baba, Jun 03 '13 at 11:31
@Baba NO this is not a duplicate. Totally different problem. This is also not the `trim` issue. — 夏期劇場, Jun 03 '13 at 11:33
Added it has duplicate because .. there so many issues with your encryption `MCRYPT_RAND ` , `MCRYPT_MODE_ECB` lack of `PKCS7 padding` , `padding oracle attacks` .. you can lean a lot of the example class with having to duplicate the answer here — Baba, Jun 03 '13 at 11:35

score 2 · Answer 1 · answered Jun 03 '13 at 11:28

2

You can use trim($string, "\0\4") to cut out these characters.

answered Jun 03 '13 at 11:28

Logarytm Całkowy

368
2
11

This works actually, even i'm not sure it is the good solution or not. At least the `��` characters goes away. – 夏期劇場 Jun 03 '13 at 11:36
You would have so many problems in future .. you proper padding .. its not difficult – Baba Jun 03 '13 at 11:38

Nickolay Olshevsky · Answer 2 · 2013-06-03T11:47:04.977

2

This is padding. ECB mode requires input to be multiple of cipher block size, so additional bytes are added (most likely it is PKCS#5 padding).

To remove PKCS#5 padding you can use following code:

$dec_s = strlen($decrypted);
$padding = ord($decrypted[$dec_s-1]);
$decrypted = substr($decrypted, 0, -$padding);

edited Jun 03 '13 at 11:47

answered Jun 03 '13 at 11:28

Nickolay Olshevsky

13,706
1
34
48

So what is the correct usage please, since i really don't know. – 夏期劇場 Jun 03 '13 at 11:29
o_O sorry but it is returning blank string `""`. Lets say `$decrypted = "This is the original string.��"` . Also, is it about to put in the Decryption (after Decrypting the String) right? – 夏期劇場 Jun 04 '13 at 03:15
Hm, what actually characters are at the end? Can you show the ord($decrypted[strlen($decrypted)-1]) ? – Nickolay Olshevsky Jun 04 '13 at 08:48

score 2 · Answer 3 · answered Oct 10 '13 at 13:23

2

rtrim() will remove the padding that mcrypt added...

answered Oct 10 '13 at 13:23

matt

21
2

score -2 · Answer 4 · answered Nov 18 '15 at 02:59

-2

function encrypt ($pure_string, $key) {

=> $key

$encrypted_string = mcrypt_encrypt(MCRYPT_BLOWFISH, $encryption_key, $pure_string, MCRYPT_MODE_ECB, $iv);

=> $encryption_key

not equal

answered Nov 18 '15 at 02:59

mistykr

1

2

If its code example, please wrap it in appropriate way for highlighting and make sure syntax is correct. Also, little explanation is usually useful. – Tom Nov 18 '15 at 03:08

PHP MCRYPT encrypt/decrypt returns invisible strange characters?

4 Answers4

Linked