Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.

I have an application in C# that encrypt my files with AES algorithm with this method:

// strKey = "sample-16chr-key"
private static void encryptFile(string inputFile, string outputFile, string strKey)
{
  try
  {
    using (RijndaelManaged aes = new RijndaelManaged())
    {
      byte[] key = Encoding.UTF8.GetBytes(strKey);
      byte[] IV = Encoding.UTF8.GetBytes(strKey);

      using (FileStream fsCrypt = new FileStream(outputFile, FileMode.Create))
      {
        using (ICryptoTransform encryptor = aes.CreateEncryptor(key, IV))
        {
          using (CryptoStream cs = new CryptoStream(fsCrypt, encryptor, CryptoStreamMode.Write))
          {
            using (FileStream fsIn = new FileStream(inputFile, FileMode.Open))
            {
              int data;
              while ((data = fsIn.ReadByte()) != -1)
              {
                cs.WriteByte((byte)data);
              }
            }
          }
        }
      }
    }
  }
  catch (Exception ex)
  {
    Debug.WriteLine(ex.Message);
  }
}

The file is encrypted without an issue.

Then I want to decrypt the encrypted file with my Android (2.2) application. So I do this:

// myDoc is my Document object;
byte[] docBytes = serialize(myDoc);
byte[] key = ("sample-16chr-key").getBytes("UTF-8");
IvParameterSpec iv = new IvParameterSpec(key);

Cipher c = Cipher.getInstance("AES");
SecretKeySpec k = new SecretKeySpec(key, "AES");
c.init(Cipher.DECRYPT_MODE, k, iv);

// IllegalBlockSizeException Occurred
byte[] decryptedDocBytes = c.doFinal(docBytes);

Document decryptedDoc = (Document)deserialize(decryptedDocBytes);

And my serialize/deserialize methods:

private static byte[] serialize(Document obj) throws IOException {
    ByteArrayOutputStream out = new ByteArrayOutputStream();
    ObjectOutputStream os = new ObjectOutputStream(out);
    os.writeObject(obj);
    return out.toByteArray();
}

private static Object deserialize(byte[] data) throws IOException, ClassNotFoundException {
    ByteArrayInputStream in = new ByteArrayInputStream(data);
    ObjectInputStream is = new ObjectInputStream(in);
    return is.readObject();
}

What is the problem here? Both encodings are UTF-8 and the key bytes are the same.
Am I missing something?

If this is not the solution for my application, what am I supposed to do?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The javadoc for IllegalBlockSizeException is pretty clear:

This exception is thrown when the length of data provided to a block cipher is incorrect, i.e., does not match the block size of the cipher.

The problem is that the C# code uses AES in CBC mode with PKCS#7 padding while the Java code uses AES in CBC mode with no padding. You should always spell out your intentions explicitly as opposed to relying on implementation dependent defaults to avoid confusion.

As the Java code uses no padding, the cipher expects a ciphertext with a length that is a multiple of the block size.

The fix would be to change the relevant line to

Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding");

And similarly for the C# code for clarity.

Note that using a static IV defeats several important security aspects of CBC mode. The IV should be unpredictable and unique, preferably from a secure random number generator, and it should be different every time the encryption method is called.

There's also no reason to limit the key to ASCII characters. Doing so makes brute forcing a lot easier.

share|improve this answer
    
Thank you for the answer. Now I get 'streamcorruptedexception' when I want to deserialize the Object. Any idea? –  Natasha Jul 12 '13 at 9:47
    
I'm pretty sure it's because your Java code snippet makes no sense. If I'm reading it correctly, it decrypts something that is not encrypted, which results in garbage, and attempts to deserialize that. –  ntoskrnl Jul 12 '13 at 9:51
    
But 'myDoc' object is the file that was encrypted by C#. If the file is not encrypted, is the Cipher decrypt it without an error? (Thanks for your follow...) –  Natasha Jul 12 '13 at 9:56
    
How do you initialize myDoc? You need to post more code. –  ntoskrnl Jul 12 '13 at 11:36
    
I think the problem is about Block Size, Key Size and Padding that are not the same in encryption and decryption. First I have to take care of them. Thank you. –  Natasha Jul 12 '13 at 11:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.