Invalid Padding error

[burt0010]

I'm using the following code which works great to encrypt/decrypt strings, but I get an "Invalid Padding" runtime error when I try to decrypt using a different password. I'm trying to harden the code for production. What types of exceptions should I be looking for?

Thanks,

--jason

----------------------------------------------------------------------------------


Option Explicit
Const SALT = "1234567890123456789012345678901234567890"

Public Function Encrypt(Message As String, Password As String)
   Dim Alg As SymmetricAlgorithm
   Set Alg = GetCryptoProvider(Password)
   
   Encrypt = Convert.ToBase64String(EncryptData(Message, Alg))
   
   Set Alg = Nothing

End Function

Public Function Decrypt(Message As String, Password As String)
   Dim Alg As SymmetricAlgorithm
   Set Alg = GetCryptoProvider(Password)
   
   Decrypt = DecryptData(Convert.FromBase64String(Message), Alg)
   
   Set Alg = Nothing
   
End Function


Private Function GetCryptoProvider(ByVal Password As String) As SymmetricAlgorithm
   Dim SecureKey As Rfc2898DeriveBytes
   Dim Alg As New RijndaelManaged
   Dim Bytes() As Byte
   
   Bytes = StrConv(SALT, vbFromUnicode)
   
   Set SecureKey = Cor.NewRfc2898DeriveBytes(Password, Bytes)
   
   Alg.KeySize = 256
   Alg.BlockSize = 128
       
   Alg.Key = SecureKey.GetBytes(32)
   Alg.IV = SecureKey.GetBytes(16)
   
   Alg.Padding = PKCS7
   
   Set GetCryptoProvider = Alg
   
   Set SecureKey = Nothing
   
End Function

' Encrypt the string.
Private Function EncryptData(ByVal PlainText As String, ByVal Alg As SymmetricAlgorithm) As Byte()
   Dim Buffer() As Byte
   Buffer = StrConv(PlainText, vbFromUnicode)

   Dim Encryptor As ICryptoTransform
   Set Encryptor = Alg.CreateEncryptor
   EncryptData = Encryptor.TransformFinalBlock(Buffer, 0, cArray.GetLength(Buffer))
   Set Encryptor = Nothing
   
End Function


' Decrypt the byte array.
Public Function DecryptData(ByRef CypherText() As Byte, ByVal Alg As SymmetricAlgorithm) As String
   Dim Decryptor As ICryptoTransform
   Set Decryptor = Alg.CreateDecryptor
   
   Dim Buffer() As Byte
   Buffer = Decryptor.TransformFinalBlock(CypherText, 0, cArray.GetLength(CypherText))
   DecryptData = StrConv(Buffer, vbUnicode)
   Set Decryptor = Nothing
   
End Function




[Kelly Ethridge]

I see. Since I don't know how to check if the cipher decrypted with the correct password, it simply continues on like normal assuming the correct password was used. Once it attempts to deal with the padding, it's simply decrypted incorrectly to the expected padding style.

Does that make sense?

Kelly

[burt0010]

Sorry. You lost me. I don't get why the wrong password would generate the Invalid Padding error. Is there any way to trap that error?

Thanks,

--jason

[burt0010]

I changed the PaddingMode to Zeros and now it doesn't generate a runtime error when you use an incorrect password. That should do the trick for now.

Thanks,

--jason

[Kelly Ethridge]

Hello again,

Well, each padding mode is a specific way to fill the remaining final block of data. The pattern used to fill the remaining block is defined by standards. The padding gets encrypted along with the plain text. When the cipher text is decrypted, I check the pattern and compare it to what should be there based on the pattern mode defined in the cipher algorithm used to decrypt. The bytes to fill the pattern can be determined by the last byte for the most part, though some modes (such as zero) have no set pattern, other than using zeros.

On a side note, the problem you may run into with using the zero pattern is that you will have those zeros returned as part of your plain text. I cannot remove zero padding since I cannot tell if it is padding your actual zeros at the end of your data.

You can see how each of the padding modes affect the text being ciphered here www.kellyethridge.com/vbcorlib/doc/SymmetricAlgorithm.PaddingMode.html

As far as errors, the invalid padding is the only one I know of that would be generated as far as using the wrong password. Another error would be not passing in a block length that was specified for the algorithm.

Kelly