I have 2 servers: NAS and outer one (let's call him mail server). NAS should generate information for employees and customers, crypt message, then send to mail server where message should be decrypted and send by PHP mail() function. My problem is that the same message is every time differentially decrypted:
Original: This is very important data
Decrypted:
How to fix it?
my code:
part of user file:
$td = mcrypt_module_open('twofish', '', 'cbc', '');
$iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td));
$key = substr(md5('mylittlepony').sha1('flutershyismylove'), 0, 31);
mcrypt_generic_init($td, $key, $iv);
$encrypted = mcrypt_generic($td, 'This is very important data');
echo message('my@mail.com', 'test', base64_encode($encrypted).'||'.base64_encode($iv));
File on mail server:
$a = explode('||', $_POST[message]);
$message = base64_decode($a[0]);
$td = mcrypt_module_open('twofish', '', 'cbc', '');
$iv = base64_decode($a[1]);
$key = substr(md5('mylittlepony').sha1('flutershyismylove'), 0, 31);
mcrypt_generic_init($td, $key, $iv);
$decrypted = mdecrypt_generic($td, $message);
mcrypt_generic_deinit($td);
mcrypt_module_close($td);
$decrypted = trim($decrypted);
mail($to, $_POST[subject], $decrypted, $_POST[headers]);
message() is function which sends info by cURL to mail server.
I'm not able to reproduce this issue. https://3v4l.org/kihc4
Could it be because you're not urlencode()ing the value in your POST parameters and it's corrupting the IV and/or ciphertext?
I also notice that you're not authenticating your ciphertext. Have you considered using defuse/php-encryption instead of rolling your own cryptography? (I professionally recommend it.)
$key = substr(md5('mylittlepony').sha1('flutershyismylove'), 0, 31);
I think hash_pbkdf2() would be more useful here?