[SalesForce] Crypto Class Error: “pad block corrupted”

Created a class for encrypting and decrypting values. It's throwing an error about the 'pad block corrupted' being incomplete.

This works for me: 

Blob ckey = EncodingUtil.base64Decode(Encryption_Key__c.getOrgDefaults().key__c);
Blob encryptedUserName = Crypto.encryptWithManagedIV('AES256', ckey, 
blob.valueOf('adamnila@justcheckingstuff.com'));

String decryptedUserName = Crypto.decryptWIthManagedIV('AES256',ckey, encryptedUserName).toString();
system.debug(decryptedUsername);

Running that in execute anonymous outputs the original string value I encrypted.

However if I run this it fails with the given error:

secretDecoderRing sdr = secretDecoderRing.getInstance();                            
Blob ckey = EncodingUtil.base64Decode(Encryption_Key__c.getOrgDefaults().key__c);
Blob encryptedUserName = Crypto.encryptWithManagedIV('AES256', ckey, blob.valueOf('adamnila@justcheckingstuff.com'));

String decryptedUserName = sdr.decryptValue(EncodingUtil.base64Encode(encryptedUserName));

Here's my secret decoder ring code:

public class secretDecoderRing {


private final Encryption_Key__c myKey = Encryption_Key__c.getOrgDefaults();
public final Blob key;
private static secretDecoderRing instance = null;

private secretDecoderRing(){
    key = EncodingUtil.base64Decode(myKey.key__c);
}
public static secretDecoderRing getInstance(){
    if(instance == null) instance = new secretDecoderRing();
    return instance;
}

public String encryptValue(String cleanData){

    encryptionWrapper ew = new encryptionWrapper(Blob.valueOf(cleanData), key);
    return ew.encryptedValue.toString();
}

public String decryptValue(String encryptedData){
    decryptionWrapper dw = new decryptionWrapper(EncodingUtil.base64Decode(encryptedData), key);
    return dw.decryptedValue;
}

private class encryptionWrapper{
    Blob encryptedValue{get; private set;}
    public encryptionWrapper(Blob cleanData, Blob key){
        this.encryptedValue = Crypto.encryptWithManagedIV('AES256',key, cleanData);
    }
}

private class decryptionWrapper{
    String decryptedValue{get;private set;}
    private decryptionWrapper(Blob encryptedData, Blob key){
        this.decryptedValue = Crypto.decryptWithManagedIV('AES256',key, encryptedData).toString();
    }
}

}

What does "pad block corrupted" even mean, and is there something I need to adjust with my decoder ring class or is what I'm trying to do here just not possible?

Best Answer

While I cannot reproduce your issue given the code in your post, I have been able to reproduce it. It appears to me that your base64 ciphertext is being truncated at some point during your process. Here's an example:

secretDecoderRing sdr = secretDecoderRing.getInstance();                            
Blob ckey = EncodingUtil.base64Decode(Encryption_Key__c.getOrgDefaults().key__c);
Blob encryptedUserName = Crypto.encryptWithManagedIV('AES256', ckey, blob.valueOf('adamnila@justcheckingstuff.com'));
String ciphertext = EncodingUtil.base64Encode(encryptedUserName);
String decryptedUserName = sdr.decryptValue(ciphertext.substring(0, ciphertext.length() - 1));
System.debug(decryptedUserName);

Note that here I chop off the last character of the base64 ciphertext before attempting decoding/decipherment. This yields:

System.SecurityException: last block incomplete in decryption

If instead, I corrupt the base64 text like so:

secretDecoderRing sdr = secretDecoderRing.getInstance();                            
Blob ckey = EncodingUtil.base64Decode(Encryption_Key__c.getOrgDefaults().key__c);
Blob encryptedUserName = Crypto.encryptWithManagedIV('AES256', ckey, blob.valueOf('adamnila@justcheckingstuff.com'));
String ciphertext = EncodingUtil.base64Encode(encryptedUserName);
ciphertext = ciphertext.substring(0, ciphertext.length() - 1) + 'q';

String decryptedUserName = sdr.decryptValue(ciphertext);
System.debug(decryptedUserName);

we get

System.SecurityException: pad block corrupted

So it's not clear exactly how, but one way or another your ciphertext is being mutated or truncated to produce this error.

Related Topic