0

I have been encrypting messages with a nodejs module like so:

 var crypto = require('crypto'),
    algorithm = 'aes-256-ctr',
    password = 'd6F3Efeq';

function encrypt(text){
  var cipher = crypto.createCipher(algorithm,password)
  var crypted = cipher.update(text,'utf8','hex')
  crypted += cipher.final('hex');
  return crypted;
}

(from here:https://lollyrock.com/articles/nodejs-encryption/)

However, using the same secret, same algorithm and same mode I cannot decrypt this using cryptography in Python.

Here's one of the things I've tried:

crypto = AES.new(password, AES.MODE_CTR)
print(crypto.decrypt(message.decode("hex")))

Returns binary data. Encoding it in UTF-8 fails, and most interestingly: it seems AWS.new generates a random iv each time, and the result of the decryption is different for each run!

.. Now, the nodeJS library does not return a Nonce, so I don't know what else to bring with me from the NodeJS function apart from the ciphertext and the password (secret) - any ideas?

Alex
  • 4,744
  • 2
  • 17
  • 21
  • which python crypto module are you using? – President James K. Polk Nov 09 '18 at 19:12
  • 3
    From the crypto documentation: `Users should not use ciphers with counter mode (e.g. CTR, GCM, or CCM) in crypto.createCipher()` this is why you have no nonce. Use `crypto.createCipheriv() t` instead and provide a large random nonce (IV=Nonce). – Robert Nov 09 '18 at 19:21
  • 1
    Yep, your node code is invoking undefined behavior. Using that in production would be a very poor idea. See the code examples in [this repository](https://github.com/luke-park/SecureCompatibleEncryptionExamples). – Luke Joshua Park Nov 09 '18 at 19:48
  • [This](https://stackoverflow.com/questions/45426334/decrypt-aes-256-ctr-payloads-in-python-when-encrypted-from-nodejs) might help you – kelalaka Nov 09 '18 at 20:22

0 Answers0