Text encrypted with the "Basic" encryption method, when decrypted, does not equal itself. I think something is wrong with the character encoding, though I don't know enough about ASCII to debug.

CommentFileSizeAuthor
#1 encryption.png554.6 KBtheunraveler

Comments

theunraveler’s picture

theunraveler commented
StatusFileSize
new encryption.png554.6 KB

Some debugging messages when trying to encrypt and decrypt the string "Jake". It seems to me like drupal_strlen is incorrectly determining the length of the encrypted string, perhaps because it's encoded weirdly.

theunraveler’s picture

theunraveler commented

Any thought on this, @zzolo?

zzolo’s picture

zzolo commented

I am not sure. I copied the encryption algorithm from a random site.

I have not tested the D7 version of this module yet. I am pretty sure this was working in D6. If that is the case then maybe drupal_strlen() changed in some? Or if there are other Drupal API's used there.

theunraveler’s picture

theunraveler commented

@zzolo: how would you feel about just getting rid of the basic encryption method? Between mCrypt, OpenSSL, etc., surely users will have a secure alternative to a one-off mathematical encryption method.

Just some thoughts.

zzolo’s picture

zzolo commented

Hi @theunraveler. Well, my main goal with the basic encryption method was to provide a way for encryption if no related PHP extensions were installed. Mcrypt is not included by default, last time I checked. I also think supporting the upgrade path for it would be nice, as people will lose data if they have encrypted through this method and then upgrade and cannot decrypt.

But, I don't have much time for it, so if you do want to take it in a certain direction, I am alright with that.

theunraveler’s picture

theunraveler commented
Status: Active » Postponed

Alright, so it looks like it's some kind of bug with character encoding in drupal_strlen() and drupal_substr(). I'm not sure what the exact cause is, but I changed those two functions to their vanilla PHP equivalents and things work fine. Just as a note: 6.x uses the PHP functions as well, not the Drupal wrappers.

I'm marking as postponed for now, because I'd like to find out the real reason.

For now, this has been committed to 7.x-1.x and 7.x-1.0-rc1.

theunraveler’s picture

theunraveler commented
Status: Postponed » Postponed (maintainer needs more info)
Dave Sandilands’s picture

Dave Sandilands commented

subscribe

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

I agree it makes sense to keep some simple-ish methods in place as long as they work :)

I did some tests on the 7.x-2.x branch and it seems to work. From comment #6 it seems like this is fixed for 7.x-1.x and above, but maybe not for 6.x. Should this be moved back to 6.x and marked as patch (to be ported)?

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Postponed (maintainer needs more info) » Fixed

Pardon me, I read comment #6 wrong. It appears that this issue is actually fixed as long as we don't use the drupal_substr and drupal_strlen commands which none of the branches are currently doing, so fixed.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.