I am trying to decrypt an encrypted string, but I am stuck in Ciper.doFinal()
where the decryption throws a BadPaddingException
.
The string in question is 3qBogw/PIqpErH/DyEHLTQ==. One thing I know is that the string when decrypted contains a number (It is used in Integer.valueOf()
)
First, the following method is called;
public static String getRandom() {
String str1 = UUID.randomUUID().toString();
String str2 = dCpw^jDyaip^Hfy]XgdRbp_imwbheJCFxTF^ligkteDEdrbtsu\yIV[;
StringBuilder localStringBuilder = new StringBuilder();
localStringBuilder.append(str1);
localStringBuilder.append(str2);
return StringUtils.replaceEachRepeatedly(localStringBuilder.toString(), new String[] { "dCp" }, new String[] { "gPs" });
}
Nothing too fancy here just creates a UUID and concats it with a constant string and also uses Apache StringUtils to replace all occurances of dCp to gPs - (not sure why that is required)
public static String decrypt(String str) {
try {
String random = getRandom();
byte[] decode = Base64.decode(str, 0);
byte[] array = convertToArray(random);
return new String(ciperDecrypt(decode, array, array), "UTF-8");
} catch (Exception e) {
e.printStackTrace();
return "";
}
}
Here in the decrypt method, the generated random value is passed to a method in order to convert it to a byte array. Following is that method,
private static byte[] convertToArray(String str) throws UnsupportedEncodingException {
byte[] obj = new byte[16];
byte[] bytes = str.getBytes("UTF-8");
int length = str.length();
System.arraycopy(bytes, 0, obj, 0, Math.min(bytes.length, obj.length));
return obj;
}
There is nothing fancy here too, just returns a byte array obtained from String.getBytes()
methods. But what is interesting is that only first 16 bytes are used. This is what worries me, if you look at this carefully, in the getRandom()
method they concat a UUID
string and another constant string. But once the same string is passed to this method, the rest of the string is ignored.
And then finally ciperDecrypt method uses a Ciper
to decrypt the string.
public static byte[] ciperDecrypt(byte[] paramArrayOfByte1, byte[] paramArrayOfByte2, byte[] paramArrayOfByte3) {
try {
Cipher localCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
SecretKeySpec secret = new SecretKeySpec(paramArrayOfByte2, "AES");
IvParameterSpec param = new IvParameterSpec(paramArrayOfByte3);
localCipher.init(2, secret, param);
return localCipher.doFinal(paramArrayOfByte1);
} catch (Exception e) {
e.printStackTrace();
}
return null;
}
This procedure looks fine, but when I try to execute it, I get a BadPaddingException
when the doFinal()
line is executed. What I suspect is in the creation of the byte[]
where there is some data loss.
It would be really helpful if anyone can identify where I have gone wrong. I would really appreciate it, Thanks!