Why does encrypt, then decrypt give me a different output? - php

Question

In my code I encrypt some data two times. First in jQuery:
var text = '' + CryptoJS.Rabbit.encrypt("12345", "PassPhrase");
then this is posted with ajax to php and encrypted again:
function mc_encrypt($encrypt, $key){
$encrypt = serialize($encrypt);
$iv = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC), MCRYPT_DEV_URANDOM);
$key = pack('H*', $key);
$mac = hash_hmac('sha256', $encrypt, substr(bin2hex($key), -32));
$passcrypt = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $encrypt.$mac, MCRYPT_MODE_CBC, $iv);
$encoded = base64_encode($passcrypt).'|'.base64_encode($iv);
return $encoded;
}
Afterwards, this is stored in a database. If a user wants to access the value again, I retrieve it from the database and then decrypt it:
function mc_decrypt($decrypt, $key){
$decrypt = explode('|', $decrypt);
$decoded = base64_decode($decrypt[0]);
$iv = base64_decode($decrypt[1]);
$key = pack('H*', $key);
$decrypted = trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $decoded, MCRYPT_MODE_CBC, $iv));
$mac = substr($decrypted, -64);
$decrypted = substr($decrypted, 0, -64);
$calcmac = hash_hmac('sha256', $decrypted, substr(bin2hex($key), -32));
if($calcmac!==$mac){ return false; }
$decrypted = unserialize($decrypted);
return $decrypted;
}
This is then posted back to the jQuery and decrypted again:
var text = CryptoJS.Rabbit.decrypt(text, "PassPhrase");
text = text.toString();
console.log(text);
However, the value logged in the console is quite different from the value ('12345') at the beginning. I don't know why this is happening and I've been looking at this problem for the last two days, yet I can't seem to figure out the problem...

Answer 1

CryptoJS.Rabbit.decrypt is returning a word array, and you are calling toString on it. For "12345" I would guess that the result you are seeing is "3132333435".
Use CryptoJS stringify, e.g. CryptoJS.enc.Utf16.stringify(text) or CryptoJS.enc.Utf8.stringify(text), depending on the original encoding.
You can choose the encoding on the way in by modifying your code like this, for example:
p = CryptoJS.enc.Utf8.parse("12345");
text = '' + CryptoJS.Rabbit.encrypt(p, "PassPhrase");
Then on the return trip:
var text = CryptoJS.Rabbit.decrypt(text, "PassPhrase");
text = CryptoJS.enc.Utf8.stringify(text); // use same encoding as original input
console.log(text);