2

Created a class for encrypting and decrypting values. It's throwing an error about the 'pad block corrupted' being incomplete.

This works for me:

Blob ckey = EncodingUtil.base64Decode(Encryption_Key__c.getOrgDefaults().key__c);
Blob encryptedUserName = Crypto.encryptWithManagedIV('AES256', ckey, 
blob.valueOf('adamnila@justcheckingstuff.com'));

String decryptedUserName = Crypto.decryptWIthManagedIV('AES256',ckey, encryptedUserName).toString();
system.debug(decryptedUsername);

Running that in execute anonymous outputs the original string value I encrypted.

However if I run this it fails with the given error:

secretDecoderRing sdr = secretDecoderRing.getInstance();                            
Blob ckey = EncodingUtil.base64Decode(Encryption_Key__c.getOrgDefaults().key__c);
Blob encryptedUserName = Crypto.encryptWithManagedIV('AES256', ckey, blob.valueOf('adamnila@justcheckingstuff.com'));

String decryptedUserName = sdr.decryptValue(EncodingUtil.base64Encode(encryptedUserName));

Here's my secret decoder ring code:

public class secretDecoderRing {


private final Encryption_Key__c myKey = Encryption_Key__c.getOrgDefaults();
public final Blob key;
private static secretDecoderRing instance = null;

private secretDecoderRing(){
    key = EncodingUtil.base64Decode(myKey.key__c);
}
public static secretDecoderRing getInstance(){
    if(instance == null) instance = new secretDecoderRing();
    return instance;
}

public String encryptValue(String cleanData){

    encryptionWrapper ew = new encryptionWrapper(Blob.valueOf(cleanData), key);
    return ew.encryptedValue.toString();
}

public String decryptValue(String encryptedData){
    decryptionWrapper dw = new decryptionWrapper(EncodingUtil.base64Decode(encryptedData), key);
    return dw.decryptedValue;
}

private class encryptionWrapper{
    Blob encryptedValue{get; private set;}
    public encryptionWrapper(Blob cleanData, Blob key){
        this.encryptedValue = Crypto.encryptWithManagedIV('AES256',key, cleanData);
    }
}

private class decryptionWrapper{
    String decryptedValue{get;private set;}
    private decryptionWrapper(Blob encryptedData, Blob key){
        this.decryptedValue = Crypto.decryptWithManagedIV('AES256',key, encryptedData).toString();
    }
}

}

What does "pad block corrupted" even mean, and is there something I need to adjust with my decoder ring class or is what I'm trying to do here just not possible?

  • 2
    Your code works fine for me. I don't get "pad block corrupted" with your secret decoder ring block, and I do get back the right string. – David Reed Nov 21 '18 at 22:20
  • @DavidReed are you in lex or classic? I feel like that shouldn't matter in this situation, but never hurts to check... – SFDC Noob Nov 21 '18 at 22:27
  • Lightning/Classic should not affect this functionality. I'm in Lightning, but using Developer Console, which doesn't really differ. – David Reed Nov 21 '18 at 22:28
  • If you wipe and refresh your Custom Setting, can you reproduce? What is the length of the field key__c? – David Reed Nov 21 '18 at 22:30
  • Field length is 44 characters. I'll try refreshing the custom settings. Hopefully that will resolve it because I'm also getting a 'last block incomplete in decryption' error when I try to call this class from an aura enabled method... – SFDC Noob Nov 21 '18 at 22:34
2

While I cannot reproduce your issue given the code in your post, I have been able to reproduce it. It appears to me that your base64 ciphertext is being truncated at some point during your process. Here's an example:

secretDecoderRing sdr = secretDecoderRing.getInstance();                            
Blob ckey = EncodingUtil.base64Decode(Encryption_Key__c.getOrgDefaults().key__c);
Blob encryptedUserName = Crypto.encryptWithManagedIV('AES256', ckey, blob.valueOf('adamnila@justcheckingstuff.com'));
String ciphertext = EncodingUtil.base64Encode(encryptedUserName);
String decryptedUserName = sdr.decryptValue(ciphertext.substring(0, ciphertext.length() - 1));
System.debug(decryptedUserName);

Note that here I chop off the last character of the base64 ciphertext before attempting decoding/decipherment. This yields:

System.SecurityException: last block incomplete in decryption

If instead, I corrupt the base64 text like so:

secretDecoderRing sdr = secretDecoderRing.getInstance();                            
Blob ckey = EncodingUtil.base64Decode(Encryption_Key__c.getOrgDefaults().key__c);
Blob encryptedUserName = Crypto.encryptWithManagedIV('AES256', ckey, blob.valueOf('adamnila@justcheckingstuff.com'));
String ciphertext = EncodingUtil.base64Encode(encryptedUserName);
ciphertext = ciphertext.substring(0, ciphertext.length() - 1) + 'q';

String decryptedUserName = sdr.decryptValue(ciphertext);
System.debug(decryptedUserName);

we get

System.SecurityException: pad block corrupted

So it's not clear exactly how, but one way or another your ciphertext is being mutated or truncated to produce this error.

  • You are spot on. If I add 'system.debug(encryptedUsername) in the console it outputs blob[48]. However in the decryptValue method when I do 'system.debug(blob.valueof(encryptedData))' it outputs Blob[64]. The problem seems to be that I was using base64Encode to create the string but then using Blob.valueOf to convert it back. When I updated the code to use encoding instead of valueOf the issue resolved. Any idea why this would be causing me an error but did not for you? I would think it would be a universal issue – SFDC Noob Nov 21 '18 at 23:09
  • I'm not sure why it worked correctly for me but not for you. Were you using exactly the same code as in your post? Encrypting something other than the example email address? Regardless, I'm glad it's solved! – David Reed Nov 21 '18 at 23:12
  • It was a bit of both. Apparently the secret decoder ring in the sandbox was different from what I provided(pulled code snippets from my repo) and on top of that, the encrypted password I stored was too long and got truncated when I input the custom setting because I didn't make the field length long enough. Thanks for all your help. – SFDC Noob Nov 21 '18 at 23:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.