"Error while finalizing cipher" when decrypting a file

Question

I get "error while finalizing cipher" whenever I want to decrypt a file I encrypted before.

For testing purposes, I've just copypasted Pero's code from here.

All I've changed is removed the salt and replaced it with my md5 function. Before that I've tried it with the salt and it gave me the same error :(

In that other question, the problem seems to be solved somehow, but he didn't further elaborate on that, it was just something with the salt that I didn't even use.

public static void encrypt(String path, String password) throws IOException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException {
    FileInputStream fis = new FileInputStream(path);
    FileOutputStream fos = new FileOutputStream(path.concat(".scrypt"));
    byte[] key = md5(password).getBytes("UTF-8");
    MessageDigest sha = MessageDigest.getInstance("SHA-1");
    key = sha.digest(key);
    key = Arrays.copyOf(key,16);
    SecretKeySpec sks = new SecretKeySpec(key, "AES");
    Cipher cipher = Cipher.getInstance("AES");
    cipher.init(Cipher.ENCRYPT_MODE, sks);
    CipherOutputStream cos = new CipherOutputStream(fos, cipher);
    int b;
    byte[] d = new byte[8];
    while((b = fis.read(d)) != -1) {
        cos.write(d, 0, b);
    }
    cos.flush();
    cos.close();
    fis.close();
}

public static void decrypt(String path, String password) throws IOException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException {
    FileInputStream fis = new FileInputStream(path);
    FileOutputStream fos = new FileOutputStream(path.replace(".scrypt", ""));
    byte[] key = md5(password).getBytes("UTF-8");
    MessageDigest sha = MessageDigest.getInstance("SHA-1");
    key = sha.digest(key);
    key = Arrays.copyOf(key,16);
    SecretKeySpec sks = new SecretKeySpec(key, "AES");
    Cipher cipher = Cipher.getInstance("AES");
    cipher.init(Cipher.DECRYPT_MODE, sks);
    CipherInputStream cis = new CipherInputStream(fis, cipher);
    int b;
    byte[] d = new byte[8];
    while((b = cis.read(d)) != -1) {
        fos.write(d, 0, b);
    }
    fos.flush();
    fos.close();
    cis.close();
}

md5() is equivalent to php's md5()

Would be awesome if someone could help me, I searched for a solution for hours :(

Answer 1

The difference is this in encrypt:

byte[] key = md5(password).getBytes("UTF-8");

and decrypt:

byte[] key = (salt + password).getBytes("UTF-8");

Needless to say, this leads to different keys which makes proper decryption impossible.

---

This type of key derivation from a password is not remotely secure. Passwords have low entropy, but keys have high entropy. If you want to convert a password to a key then you need to utilize a computationally intensive operation so that attackers can't just try all easy passwords. This can be done with PBKDF2, bcrypt, scrypt or Argon2. Use a many iterations or a high cost factor, and always use a randomly generated salt. The salt doesn't have to be secret, but it must be send to the receiver along with the ciphertext. You can write it in front of the ciphertext and read it back during decryption.

Always use a fully qualified cipher string, because different JVM's may have different defaults. This would make interoperability a nightmare. Your current string probably defaults to Cipher.getInstance("AES/ECB/PKCS5Padding");

Never use ECB mode. It's deterministic and therefore not semantically secure. You should at the very least use a randomized mode like CBC or CTR. It is better to authenticate your ciphertexts so that attacks like a padding oracle attack are not possible. This can be done with authenticated modes like GCM or EAX, or with an encrypt-then-MAC scheme.

---

Have a look at RNCryptor (Java, PHP), which has everything for secure encryption and interoperability.