Finding a way to encrypt messages in C# and decrypting them in PHP or vice versa seems to be a "challenge" for many users. I wrote this tutorial to provide some help with this: below, you can find how to encrypt / decrypt messages in C# / PHP using AES256 with CBC mode.

 

1.Basic Information

AES 256 with CBC mode requires 3 values: the message, a key (32 bytes long) and an initialization vector (IV). Note that you must use the same IV when encrypting / decrypting a message: otherwise the message is lost. Sending the IV with the message is perfectly safe but it always has to be a random value. Since it has a fixed size, I always place the IV at the end of the encrypted text.

The encrypted messages should be encoded using base64 before being sent.



Encryption steps:

• encrypt the text
• add the IV at the end
• encode everything (base64)

Decryption steps:

• decode the message
• get & remove the IV
• proceed to decypt

Ok, enough talking, let's see some code...

2.PHP Encryption/Decryption Code

PHP accepts keys that are not 32 bytes long and simply extends them to the correct length. Well...C# doesn't, so you'll have to use a key that is 32 bytes long.

Encryption

1. function encrypt($text, $pkey)
2. {
3. $key = $pkey;
4. $IV = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC), MCRYPT_RAND);
6. return base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_CBC, $IV)."-[--IV-[-".$IV);
7. }

Decryption

1. function decrypt($text, $pkey)
2. {
3. $key = $pkey;
4. $text = base64_decode($text);
5. $IV = substr($text, strrpos($text, "-[--IV-[-") + 9);
6. $text = str_replace("-[--IV-[-".$IV, "", $text);
8. return rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_CBC, $IV), "\0");
9. }

3.C# Encryption/Decryption Code

As I said before, C# doesn't accept keys that aren't 32 bytes long - it will throw an error. Also, many people get tricked here because of the encoding (most of the times you have to use Encoding.Default).

Encryption

1. public static string EncryptMessage(byte[] text, string key)
2. {
3. RijndaelManaged aes = new RijndaelManaged();
4. aes.KeySize = 256;
5. aes.BlockSize = 256;
6. aes.Padding = PaddingMode.Zeros;
7. aes.Mode = CipherMode.CBC;
9. aes.Key = Encoding.Default.GetBytes(key);
10. aes.GenerateIV();
12. string IV = ("-[--IV-[-" + Encoding.Default.GetString(aes.IV));
14. ICryptoTransform AESEncrypt = aes.CreateEncryptor(aes.Key, aes.IV);
15. byte[] buffer = text;
17. return
18. Convert.ToBase64String(Encoding.Default.GetBytes(Encoding.Default.GetString(AESEncrypt.TransformFinalBlock(buffer, 0, buffer.Length)) + IV));
20. }

 

Decryption

1. public static string DecryptMessage(string text, string key)
2. {
3. RijndaelManaged aes = new RijndaelManaged();
4. aes.KeySize = 256;
5. aes.BlockSize = 256;
6. aes.Padding = PaddingMode.Zeros;
7. aes.Mode = CipherMode.CBC;
9. aes.Key = Encoding.Default.GetBytes(key);
11. text = Encoding.Default.GetString(Convert.FromBase64String(text));
13. string IV = text;
14. IV = IV.Substring(IV.IndexOf("-[--IV-[-") + 9);
15. text = text.Replace("-[--IV-[-" + IV, "");
17. text = Convert.ToBase64String(Encoding.Default.GetBytes(text));
18. aes.IV = Encoding.Default.GetBytes(IV);
20. ICryptoTransform AESDecrypt = aes.CreateDecryptor(aes.Key, aes.IV);
21. byte[] buffer = Convert.FromBase64String(text);
23. return Encoding.Default.GetString(AESDecrypt.TransformFinalBlock(buffer, 0, buffer.Length));
24. }