CODEWITHSUNDEEP
encryptioncryptographyaescryptojs
Antony Ng
Antony Ng

Reputation: 797

How to encrypt in AES using CryptoJS with key size of 128?

I have searched and found examples of AES with the default 256 key size and find it worked already. But when I want to use 128 key size, there is little information.

I have extracted code from the aes test from CryptoJS:

        var C = CryptoJS;

        var plainText = '00112233445566778899aabbccddeeff';
        var key = '000102030405060708090a0b0c0d0e0f';

        var encryptedText = C.AES.encrypt(C.enc.Hex.parse(plainText), C.enc.Hex.parse(key), { mode: C.mode.ECB, padding: C.pad.NoPadding }).ciphertext.toString();

        console.log(encryptedText);

        var decryptedText = C.AES.decrypt(C.lib.CipherParams.create({ ciphertext: C.enc.Hex.parse(encryptedText) }), C.enc.Hex.parse(key), { mode: C.mode.ECB, padding: C.pad.NoPadding }).toString();

        console.log(decryptedText);

This worked, but if I want to use a different plain text like 'Hello World' then it failed. Also what if I want to use a password like 'my-key-001'? As I have read that CryptoJS expect to use 256 key size if I pass a password.

Your help is much appreciated.

Upvotes: 1

Views: 4680

Answers (1)

kelalaka
kelalaka

Reputation: 5636

This worked, but if I want to use a different plain text like 'Hello World' then it failed.

You have used the noPadding and that is the issue. The example is multiple of 16-byte that causes no problem, however your next plaintext is not. You can use noPadding if

  1. your message is an exact multiple of the block size, though still not recommended.
  2. you want to pad the message yourself, probably that is you want to test a new padding scheme that we don't see in your code.

You should you padding like

padding: CryptoJS.pad.Pkcs7

As I have read that CryptoJS expect to use 256 key size if I pass a password.

CryptoJS supports AES-128, AES-192, and AES-256. According to your key size it will select the key variants. If you use a password it will generate a 256-bit size. That is %40 times slower than AES-128 since it requires 14 rounds. However use a good password, see below.

Also what if I want to use a password like 'my-key-001'?

A password with high entropy is important otherwise the attackers can be successful by testing passwords. The key generation cannot increase entropy. Therefore you need a good way to generate high entropy passwords like using diceware.

How to encrypt in AES using CryptoJS with key size of 128?

Just provide a 128-bit key.

Does AES-128 has 128-bit security

Any block cipher, not only AES, has vulnerable to multi-target attacks. In that case it is not providing 128-bit security. Therefore you should use 192 or 256-bit keys. For a more detailed see this question Has AES-128 been fully broken?

mode: C.mode.ECB

The ECB mode of operations is not advised, it is insecure and it leaks pattern. You should use modern encryption modes like AES-GCM which provides you not confidentiality but also, integrity and authentication.

While using GCM mode, make sure that you never use the same IV/nonce again under the same key. AES-GCM uses CTR mode for encryption and under the same key if the IV/nonce repeated then crig-dragging is possible. Also, it can leak the authentication key.

Upvotes: 3

Related Questions