8
$\begingroup$

I'm using PHP to encrypt a string and Java to decrypt it on a remote server. To perform the encryption, I'm using the strategy that can be found here.

My problem is that the strings I encrypt are pretty small and very similar each other. Nevertheless, I'd like a high degree of randomness in the encrypted values.

Just to be clear, at current this is what happens:

$$encrypt(foo1) \rightarrow barA$$ $$encrypt(foo2) \rightarrow barB$$

While I'd like something like:

$$encrypt(foo1) \rightarrow b3SA$$ $$encrypt(foo2) \rightarrow 4FrB$$

How can I enhance the randomness of the encrypted values, by keeping the algorithm I'm already using?

$\endgroup$
  • 2
    $\begingroup$ I see that you're using an initialization vector. If that's sufficiently random, I believe you should be good. Padding to a specific size multiple may also be advisable. Change your IV for every message, of course. $\endgroup$ – Jeff Ferland Sep 28 '11 at 16:59
11
$\begingroup$

If you are doing things right, then you will get the level of randomness you are after. Translation: you are not doing things right. You use AES with CFB8 mode, which requires a random initial value. The initial value is a 16-byte string which should be generated randomly and uniformly, and a new IV shall be generated for every single encrypted message. Since you need it for decryption, the IV for an encrypted message shall be stored/transmitted along with the said message.

Failure to use a new IV for each message results in a wide range of weaknesses, including what you are witnessing right now (if two strings begin with the same characters, the resulting encrypted strings will also begin with the same bytes).

$\endgroup$
  • 1
    $\begingroup$ At first, I didn't realize I could have passed the IV along with the message without losing in security. Thanks for clarifying this, it works perfectly now. $\endgroup$ – Roberto Aloi Sep 28 '11 at 18:47

protected by user46 May 9 '12 at 8:52

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.