Nodejs how to implement OpenSSL AES-CBC encryption (from PHP)?

I am currently working on translating an encryption algorithm from PHP to Typescript, to use in a very specific API that requires the posted data to be encrypted with the API key and Secret. Here is the provided example of how to correctly encrypt data in PHP for use with the API (the way of implementing the key and IV can't be changed):


$iv = substr(hash("SHA256", $this->ApiKey, true), 0, 16);
$key = md5($this->ApiSecret);

$output = openssl_encrypt($Data, "AES-256-CBC", $key, OPENSSL_RAW_DATA, $iv);
$completedEncryption = $this->base64Url_Encode($output);

return $completedEncryption;

In the above code, the only thing the base64Url_Encode function does is convert the binary data to a valid Base64URL string.

And now the code as I have implemented it inside Typescript:

import { createHash, createCipheriv } from 'node:crypto'

const secretIV = createHash('sha256').update(this.ApiKey).digest().subarray(0, 16)

// Generate key
/* 
  Because the OpenSSL function in PHP automatically pads the string with /null chars,
  do the same inside NodeJS, so that CreateCipherIV can accept it as a 32-byte key, 
  instead of a 16-byte one.
*/
const md5 = createHash('md5').update(this.ApiSecret).digest()
const key = Buffer.alloc(32)
key.set(md5, 0)

// Create Cipher 
const cipher = createCipheriv('aes-256-cbc', key, secretIV)
    
let encrypted = cipher.update(data, 'utf8', 'binary');
encrypted += cipher.final('binary');

// Return base64URL string
return Buffer.from(encrypted).toString('base64url');

The above Typescript code only does NOT give the same output as the PHP code given earlier. I have looked into the original OpenSSL code, made sure that the padding algorithms are matching (pcks5 and pcks7) and checked if every input Buffer had the same byte length as the input inside PHP. I am currently thinking if it is some kind of binary malform that is causing the data to change inside Javascript?

I hope some expert can help me out with this question. Maybe I have overlooked something. Thanks in advance.

Solution

The problem lies in the md5 function in PHP, which defaults to hexadecimal output instead of binary output:

md5(string $string, bool $binary = false): string

This is also why the code doesn't complain about the key (constructed from the MD5 hash) is being too small, it is fed 32 bytes after ASCII or UTF8 encoding, instead of the 16 bytes - the output size of MD5 - you'd use for AES-128.

Apparently it is using lowercase encoding, although not even that has been specified. You can indicate the encoding for NodeJS as well, see the documentation of the digest method. It also seems to be using lowercase, although I cannot directly find the exact specification of the encoding either.

Once you have completed your assignment, please try and remove the code ASAP, as you should never calculate the IV from the key; they key and IV combination should be unique, so the above code is not IND-CPA secure if the key is reused.

Here's why the PHP API is badly defined for MD5:

The output of MD5 has been specified in standards, and is binary.
It is impossible from the function to see what it is doing, you have to lookup the definition of the function (it doesn't help that PHP is weakly typed here, if it explicitly returned a string it would be more clear to the user).
It may also work very badly if you're doing a compare of hash values; even if you are comparing strings then it is easy to use upper instead of lowercase (and both are equally valid, uppercase hex is actually easier to read for humans as we focus on the top part of letters more for some reason or other).

Although you should not use MD5 in the first place to derive keys, it should be noted that the code in the question has the same problem: uppercase keys would not perform the same encryption / decryption.

Basically the MD5 function in PHP takes the principle of least surprise and tosses it out of the window. The hexadecimal or base 64 encoding of the output could be made optional instead, the NodeJS implementation does this correctly.