AES encrypt in Node.js Decrypt in PHP. Fail.

Question

In node.js, I use the build in function to encrypt data like that:

var text = \"Yes\";
var password = \"123456\";
var encrypt = crypto.createCipher(\'aes-256         


        

Answer 1

Node.js is doing some magic with your input password to derive a key and iv. It's hard to see how that would work in PHP unless PHP does exactly the same key and iv derivation magic.

Why don't you use createCipheriv instead. Use a password-based key derivation function to create a key from the password. For example:

http://en.wikipedia.org/wiki/PBKDF2

Such a function is available in later versions of Node.js

http://nodejs.org/docs/latest/api/crypto.html#crypto_crypto_pbkdf2_password_salt_iterations_keylen_callback

Provide a good iv as well; you can create one using crypto.randomBytes. If you control the key and iv parameters then you will have a much easier time determining if you can round-trip your data to PHP.

You can't just hash the password to generate an iv. The iv is supposed to be different for every encrypted message, otherwise it is useless.

Also, you are telling Node.js that your input string "Yes" is Base64 encoded, but I think it's really ASCII or UTF-8.