AES encryption with AES/CBC/PKCS7

Question

We need to encrypt data using AES/CBC/PKCS7. However the CF encrypt method only accepts AES/CBC/PKCS5Padding. Any idea how to achieve this? We are using CF 2016.

BKBK · Accepted Answer

Example using "AES/CBC/PKCS5Padding" in ColdFusion 2016: https://trycf.com/gist/a731623422b8967baa1f363958329686/acf2016?theme=monokai // Plaintext plaintext = "Secret message that needs AES encryption."; // Use raw binary // AES requires a 16, 24, or 32 byte key (128, 192, 256 bits). // Here we'll use a 32-byte (256-bit) key for AES-256. keyBin = BinaryDecode("00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF", "hex"); // Convert to Base64 strings for use with encrypt() key = ToBase64(keyBin); // AES CBC requires a 16-byte IV ivBin = BinaryDecode("0102030405060708090A0B0C0D0E0F10", "hex"); // Encrypt: PKCS5Padding == PKCS7 padding here encrypted = encrypt(plaintext, key, "AES/CBC/PKCS5Padding", "hex", ivBin); // Decrypt decrypted = decrypt(encrypted, key, "AES/CBC/PKCS5Padding", "hex", ivBin); writeOutput("Plaintext: " & plaintext & "
"); writeOutput("Encrypted (Hex): " & encrypted & "
"); writeOutput("Decrypted: " & decrypted & "
");

BKBK · Answer

In Java, as well as in ColdFusion (which runs on Java), "AES/CBC/PKCS5Padding" is the only padding available for block ciphers like AES. Nevertheless, as @Brian__ has mentioned, it is functionally identical to PKCS7 padding.
So, you don't need to encrypt data using "AES/CBC/PKCS7".

Under the bonnet, "PKCS5Padding" is implemented to work with AES, using a 16-byte block size, as required by AES. That results, in practice, to the PKCS#7 scheme. So if you specify

encrypt(data, key, "AES/CBC/PKCS5Padding", "Hex")

in ColdFusion, you will in fact get AES in CBC mode with PKCS7 padding (although it is named "PKCS5Padding" in Java’s API).

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.