mcrypt_generic losing hair help please!

[ocallagh]

I have a JSON string. I encrypt it and decrypt it using mcrypt_generic and a secret key. It works 999 times out of 1000, but now and again it breaks down. It took me 6 hours to reproduce, 2 hours to find out the problem and for the past 4 hours I haven't been able to solve the problem.

 

Basically, depending on the combo of what I am encrypting and the key used - the actual data becomes corrupt.

 

See below for example code.

 

<?php
$CLIENT_SECRET_KEY="bd47f20107f3509c17a707982f1c79de0c3c0c6d";
//String 1 - corrupt
echo _mdecrypt(_mencrypt('{"fg_class_name":"Match","fg_client_api":"d26ec6a426b128c7001a7292a2ad1c0929cd64d7","fg_client_id":1,"fg_direction":"desc","fg_extras":{"GameWeekId":"1"},"fg_method_name":"getMatches","fg_page":1,"fg_request_time":"0.25800200 1235003390","fg_sort":2,"fg_hash":"4e5746e21919d087c69642898b5e46452ce643f3"}', $CLIENT_SECRET_KEY),$CLIENT_SECRET_KEY);

//String 2 - works fine
echo _mdecrypt(_mencrypt('{"fg_class_name":"Match","fg_client_api":"d26ec6a426b128c7001a7292a2ad1c0929cd64d7","fg_client_id":1,"fg_direction":"desc","fg_extras":{"GameWeekId":"1"},"fg_method_name":"getMatches","fg_page":1,"fg_request_time":"0.25800200 1235003390","fg_sort":2,"fg_hash":"4e5746e21919d087c69642898b5e46452ce743f3"}', $CLIENT_SECRET_KEY),$CLIENT_SECRET_KEY);


function _mencrypt($input,$key){
        $input = str_replace("\n","",$input);
        $input = str_replace("\t","",$input);
        $input = str_replace("\r","",$input);
        $key = substr(md5($key),0,24);
	$td = mcrypt_module_open ('tripledes', '', 'ecb', '');
	$iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td), MCRYPT_RAND);
	mcrypt_generic_init ($td, $key, $iv);
	$encrypted_data = mcrypt_generic ($td, $input);
	mcrypt_generic_deinit ($td);
	mcrypt_module_close ($td);
	return trim(chop(base64_encode($encrypted_data)));
}

function _mdecrypt($input,$key){
        $input = str_replace("\n","",$input);
        $input = str_replace("\t","",$input);
        $input = str_replace("\r","",$input);
        $input = trim(chop(base64_decode($input)));
	$td = mcrypt_module_open ('tripledes', '', 'ecb', '');
	$key = substr(md5($key),0,24);
	$iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td), MCRYPT_RAND);
	mcrypt_generic_init ($td, $key, $iv);
	$decrypted_data = mdecrypt_generic ($td, $input);
	mcrypt_generic_deinit ($td);
	mcrypt_module_close ($td);
	return trim(chop($decrypted_data));
        }
        



?>

 

This is a working file and if you have the modles installed I hope you can recreate it. I am stumped. I attempt to encrypt and decrypt two JSON encoded strings. The first one works fine, the second one fails. You will notice there is only ONE character difference between the two strings. The first one ends with ..... ,"fg_hash":"4e5746e21919d087c69642898b5e46452ce643f3"} and the second one ends with ..... ,"fg_hash":"4e5746e21919d087c69642898b5e46452ce743f3"} - I changed the 6 to a 7 and it works. WTF?

 

Note: By changing CLIENT_SECRET_KEY it also (temporarily) fixes the problem.

 

I am using PHP 5.2.7 on a Windows Vista machine.

 

Can anyone see anything glaringly obvious with this? I know I could use other methods to do the same job, but this is a working prototype now and would be a shame to switch it all around now.

 

 

ps: the reslts when I echo String 1, and String 2 above are as follows:

 

 

//String 1

{"fg_class_name":"Match","fg_client_api":"d26ec6a426b128c7001a7292a2ad1c0929cd64d7","fg_client_id":1,"fg_direction":"desc","fg_extras":{"GameWeekId":"1"},"fg_method_name":"getMatches","fg_page":1,"fg_request_time":"0.25800200 1235003390","fg_sort":2,"fg_hash":"4e5746e21919d087c69642898b5e46452ceÂ."P¯-

//String 2

{"fg_class_name":"Match","fg_client_api":"d26ec6a426b128c7001a7292a2ad1c0929cd64d7","fg_client_id":1,"fg_direction":"desc","fg_extras":{"GameWeekId":"1"},"fg_method_name":"getMatches","fg_page":1,"fg_request_time":"0.25800200 1235003390","fg_sort":2,"fg_hash":"4e5746e21919d087c69642898b5e46452ce743f3"}

 

 

Notice String 1 ends with the characters Â."P¯-