TripleDES Encryption between C#/.NET and PHP

Question

I have to implement some TripleDES encryption in my PHP application to communicate with a C#/.NET application, but I get different results compared to the server-side C#/.NET application. I already tried to use different encodings and flags, without much success.

I am already able to decrypt the string from C#/.NET and get the desired result in PHP (based on examples on StackOverflow and other sites).

The server-side C#/.NET code can be found and executed here:

https://dotnetfiddle.net/OrwaOl

using System;
using System.Security.Cryptography;
using System.Text;
using System.IO;

public class Program
{
    public static void Main()
    {
        Console.WriteLine(Encrypt("SourceString123", "fsgerh", "Dataehaeh"));
        Console.WriteLine(Decrypt("Vql0pOr7ouxfUScI3H8exeFbfmcfE5uM3TBtAZXAq0zwkJmqEe13EA==", "fsgerh", "Dataehaeh"));
    }

    public static string Encrypt(string value, string password, string salt)
    {
        DeriveBytes rgb = new Rfc2898DeriveBytes(password, Encoding.Unicode.GetBytes(salt));
        SymmetricAlgorithm algorithm = new TripleDESCryptoServiceProvider();
        byte[] rgbKey = rgb.GetBytes(algorithm.KeySize >> 3);
        byte[] rgbIV = rgb.GetBytes(algorithm.BlockSize >> 3);
        ICryptoTransform transform = algorithm.CreateEncryptor(rgbKey, rgbIV);
        using (MemoryStream buffer = new MemoryStream())
        {
            using (CryptoStream stream = new CryptoStream(buffer, transform, CryptoStreamMode.Write))
            {
                using (StreamWriter writer = new StreamWriter(stream, Encoding.Unicode))
                {
                    writer.Write(value);
                }
            }
            return Convert.ToBase64String(buffer.ToArray());
        }
    }

    public static string Decrypt(string text, string password, string salt)
    {
        DeriveBytes rgb = new Rfc2898DeriveBytes(password, Encoding.Unicode.GetBytes(salt));
        SymmetricAlgorithm algorithm = new TripleDESCryptoServiceProvider();
        byte[] rgbKey = rgb.GetBytes(algorithm.KeySize >> 3);
        byte[] rgbIV = rgb.GetBytes(algorithm.BlockSize >> 3);
        ICryptoTransform transform = algorithm.CreateDecryptor(rgbKey, rgbIV);
        using (MemoryStream buffer = new MemoryStream(Convert.FromBase64String(text)))
        {
            using (CryptoStream stream = new CryptoStream(buffer, transform, CryptoStreamMode.Read))
            {
                using (StreamReader reader = new StreamReader(stream, Encoding.Unicode))
                {
                    return reader.ReadToEnd();
                }
            }
        }
    }

}

The "cient"-side PHP code can be found and executed here:

http://phpfiddle.org/lite/code/hkgu-n1fe

<?php

$decrypted = 'SourceString123';
$encrypted = 'Vql0pOr7ouxfUScI3H8exeFbfmcfE5uM3TBtAZXAq0zwkJmqEe13EA==';

$password = 'fsgerh';
$salt = 'Dataehaeh';

$hash = hash_pbkdf2("sha1", $password, mb_convert_encoding($salt, 'UTF-16LE'), 1000, 32, true); 

$key = substr($hash, 0, 24);
$iv = substr($hash, 24, 8);

echo base64_encode($key) . "<br />";
echo base64_encode($iv) . "<br /><br />";

$result = mb_convert_encoding(openssl_decrypt($encrypted, 'des-ede3-cbc', $key, 0, $iv), 'UTF-8', 'UTF-16');
echo $result;
echo "<br /><br />";

$result = openssl_encrypt(mb_convert_encoding($decrypted, 'UTF-8'), 'des-ede3-cbc', $key, 0, $iv);
echo $result;
echo "<br /><br />";

$result = openssl_encrypt(mb_convert_encoding($decrypted, 'UTF-16'), 'des-ede3-cbc', $key, 0, $iv);
echo $result;
echo "<br /><br />";

?>

I spent hours to figure out the problem, but haven't been able yet.

I would really appreciate if anybody can spot the problem or point me into the right direction.

Please put some code for us to be able to help you – A.Rashad Oct 13 '17 at 13:00 — A.Rashad, Oct 13 '17 at 13:00

score 2 · Answer 1 · answered Oct 13 '17 at 13:01

2

The PHP code uses the hash_pbkdf2 with the sha1 algo.

TripleDES is symmetric encryption, which is very different from sha1 which is a hashing function.

you can refer to Using Triple DES(3DES) with PHP 7.1 for TripleDES in PHP

answered Oct 13 '17 at 13:01

Gilles Gouaillardet

8,193
11
24
30

I have to use the hash function to retrieve the necessary IV and key. The same method is used in the .NET example (see below). `$hash = hash_pbkdf2("sha1", $password, mb_convert_encoding($salt, 'UTF-16LE'), 1000, 32, true);` DeriveBytes rgb = new Rfc2898DeriveBytes(password, Encoding.Unicode.GetBytes(salt)); I tried several examples, but wasn't able to get the same result. I am able to encrypt and decrypt in PHP, but the base64-encoded string is different. – visotom Oct 13 '17 at 15:56

score 0 · Accepted Answer · answered Oct 18 '17 at 17:47

I solved the problem by using iconv() instead of mb_convert_encoding() and now I get the expected result in PHP as well as in .NET/C#. The following code shows my result for reference.

<?php

$decrypted = 'SourceString123';
$encrypted = 'Vql0pOr7ouxfUScI3H8exeFbfmcfE5uM3TBtAZXAq0zwkJmqEe13EA==';

$password = 'fsgerh';
$salt = 'Dataehaeh';

$hash = hash_pbkdf2("sha1", $password, mb_convert_encoding($salt, 'UTF-16LE'), 1000, 32, true); 

$key = substr($hash, 0, 24);
$iv = substr($hash, 24, 8);

echo base64_encode($key) . "<br />";
echo base64_encode($iv) . "<br /><br />";

$result = iconv('UTF-16', 'UTF-8', openssl_decrypt($encrypted, 'des-ede3-cbc', $key, 0, $iv));
echo $result;
echo "<br /><br />";

$result = openssl_encrypt(iconv('UTF-8', 'UTF-16', $decrypted), 'des-ede3-cbc', $key, 0, $iv);
echo $result;
echo "<br />";

?>

TripleDES Encryption between C#/.NET and PHP

2 Answers2