Forum Discussion
ARS_70214
Nimbostratus
Nimbostratusproblem to decrypt AES
Hello,
I have currently some problems with to decrypt AES encrypted string in f5 irules.
In fact It works well when I encrypt and decrypt a string in the same irule, but if I want to decrypt an already encrypted string then the AES::decrypt function return an empty string. Of course the key used to decrypt the encrypted string is the key I used to encrypt this one.
when HTTP_REQUEST {
/* Below is the part working */
set ::key be474444865c70f3e13624aec61eb292cef6cf5c4ce1725dd4fa49a93bf997c8
log local0. "key: $::key"
set ::toencrypt "test"
log local0. " $::toencrypt"
set ::encrypted [b64encode [AES::encrypt $::key $::toencrypt]]
log local0. "encrypted: $::encrypted"
set ::decrypted [AES::decrypt $::key [b64decode $::encrypted]]
log local0. "decrypted: $::decrypted"
/* the following example doesn't work */
set ::alreadyencrypted "if5fcuQNslSrend46PiyfBV/Bu60+lfXLAN76wSFxtmk13EnzNi0Zfu/"
log local0. "alreadyencrypted: $::alreadyencrypted"
set ::decrypted2 [AES::decrypt $::key [b64decode $::alreadyencrypted]]
log local0. "alreadydecrypted: $::decrypted2"
}
I'm asking if there is not something else to do to declare the encrypted string (bold line).
Do you know what to do to fix this problem?
Many thanks
2 Replies
- When specifying a key to AES::encrypt or AES::decrypt it can either be a key object as generated by AES::key (a string with the correct format) or a passphrase.
The AES::key command generates object represented as a list with 3 elements or a string in the format "AES (128 | 192 | 256) <32, 48, 64 HEX digits respectively>". If you are using a string to set the key, it must be in this format.
A string that does not match the above format will be interpreted as a passphrase and will be used (along with random salt) to generate a key. This is where AES::decrypt is affected by ID224113.
You need to change
set ::key be474444865c70f3e13624aec61eb292cef6cf5c4ce1725dd4fa49a93bf997c8
to
set ::key "AES 256 be474444865c70f3e13624aec61eb292cef6cf5c4ce1725dd4fa49a93bf997c8"
Now, using global variables and CMP is a whole other discussion. :)
http://devcentral.f5.com/wiki/default.aspx/iRules/CMPCompatibility.html
Jason 
hoolioCirrostratus
Now, using global variables and CMP is a whole other discussion. :)
For 10.x you can use the static:: namespace
http://devcentral.f5.com/wiki/default.aspx/iRules/static
Aaron
