javascript - Compatibility issues with pidcrypt and openssl_encrypt -

i designing application allows end users take quizzes browsers. part of requirement when quiz start time around, question should displayed every participant @ once. makes serving questions end users server less reasonable because lead sudden burst of request intend serve questions them connect , less 2 hours quiz start time. problem since competition, questions should not seen before start time hence there need encrypt it.

i have decided encrypt in 2 stages, first stage of encryption using asymmetric rsa encryption exchange of keys have done. key used encrypt other data that sent between server , client.

the problem symmetric encryption part. trying use openssl_encrypt method encrypt on server side , trying decrypt pidcrypt (a javascript encryption/decryption library) on clientside. turns out pidcrypt requires iv (initialization vector) 8 bytes long openssl_encrypt using aes-256-cbc mode doesn't allow 8 bytes instead insisting on 16 bytes. have done lot of permutations , experimentation no luck. stated in documentation of pidcrypt openssl compatible question - doing wrong? below code encrypts on server side using php

        $iv_len = openssl_cipher_iv_length("aes-256-cbc");             $key='my secret key.......';     $iv = openssl_random_pseudo_bytes($iv_len);     $enc = openssl_encrypt('hello', "aes-256-cbc", $key, 0, $iv);     $encryptedmessage = base64_encode("salted__".bin2hex($iv).$enc);     echo json_encode(array('key'=>$key, 'encrypt'=>$encryptedmessage,)); 

please there way make $iv_len 8bytes long rather 16 bytes code return , approaching whole setup in right way. thanks

pidcrypt not use 8 byte iv, uses 8 byte salt. iv's , salts different concepts, though share many similarities.

in pidcrypt randomized salt used password , md5 generate key , iv. salt pre-pended ciphertext (as openssl does). server should use same method generate key , iv, using pre-pended salt value , shared password. trying directly key , iv, not correct.

whatever library, iv used decrypt cbc mode should identical block size of underlying cipher. underlying block cipher here aes, means iv 16 bytes.

you should read through user comments on undocumented openssl_encrypt method, , either find openssl compatible library in php, or find/implement the openssl key derivation method (evp_bytestokey).

note following output produced openssl command line utility:

00000000  53 61 6c 74 65 64 5f 5f  44 a2 2f ee ac ee 94 fd  |salted__d./.....| 00000010  6f 93 17 24 44 12 88 66  e7 fe 5c d5 7d 81 fe d9  |o..$d..f..\.}...| 00000020 

so that's ascii string containing salted__ followed 8 byte random salt (not iv) 16 bytes of ciphertext (one full block).