Encrypt In ColdFusion and Decrypt in PHP

A while ago, I had to integrate vBulletin into a CMS application. The CMS was done in ColdFusion and had to pass info encrypted data over to vBulletin which is PHP. It would be naive to think that one could just pick an encryption scheme (which are standards like Blowfish, AES, SHA, etc.) and look up in the reference manual for both languages … and that would be it? Ha! While testing these, I realized that each language has its own options (or quirks; however you want to look at it). In addition, you have to consider Base64 encoding and cipher blocks.

Here’s what I used for ColdFusion to do encryption. I’m listing two methods from two different sources

Method 1: Encryption uses blowfish with base64 encoding, using the block cipher mode ECB and Java objects.

 
<cffunction name="EncryptBlowfish1" returntype="string" hint="Encrypts string using Blowfish Algorithm"
  description="Encryption uses blowfish with base64 encoding, using the block cipher mode ECB.">
 
  <!--- This function serves as a wrapper for enhanced Blowfish encryption. Based on discussion --->
  <!--- from http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/Cold_Fusion_Markup_Language/Q_24753297.html --->
 
  <cfargument name="Data" required="true" type="string" hint="Text to encrypt" />  
  <cfargument name="Key" required="true" type="string" hint="16-char key to be used for encryption." />
 
	<!--- get a cipher instance --->
	<cfset Cipher = createObject("java", "javax.crypto.Cipher")>
	<cfset encryptor = Cipher.getInstance("Blowfish/ECB/PKCS5Padding")>
 
	<!--- must convert the key string into a KeySpec object first --->
	<cfset keySpec = createObject("java", "javax.crypto.spec.SecretKeySpec").init(Arguments.Key.getBytes(), "Blowfish")>
 
	<!--- initialize the cipher for encrypting --->
	<cfset encryptor.init(Cipher.ENCRYPT_MODE, keySpec) />
 
	<!--- do the encrypt --->
	<cfset encryptedTextFromJava = encryptor.doFinal(Arguments.Data.getBytes()) />
 
	<!--- finally convert it to base64 and return --->	
  <cfreturn BinaryEncode(encryptedTextFromJava, "Base64") />
 
</cffunction>

Method 2: Much faster.

<!--- THIS IS MUCH FASTER THAN EncryptBlowfish1 --->
<cffunction name="EncryptBlowfish2" returntype="string" hint="Encrypts string using Blowfish Algorithm"
  description="Encryption uses blowfish with base64 encoding, using the block cipher mode ECB.">
 
  <!--- This function serves as a wrapper for enhanced Blowfish encryption. Based on discussion --->
  <!--- from http://www.petefreitag.com/item/222.cfm --->
 
  <cfargument name="Data" required="true" type="string" hint="Text to encrypt" />  
  <cfargument name="Key" required="true" type="string" hint="16-char key to be used for encryption." />
 
  <cfreturn Encrypt( Arguments.Data, ToBase64( Arguments.Key ), "BLOWFISH", "Base64" ) />  
 
</cffunction>

Now let’s test it!

<!--- YOU'LL NEED THIS TO DECRYPT! --->
<cfset myKey = "dan is too uber!" />
 
<cfoutput>
#EncryptBlowfish1( "This is so friggin cool that it works!", myKey )#
<hr />
#EncryptBlowfish2( "This is so friggin cool that it works!", myKey )#
</cfoutput>

This is how you would decrypt it in PHP:

$__key__ = "dan is too uber!";
 
function DecryptBlowfish( $data, $key )
{
  // Encryption uses blowfish with base64 encoding, using the block cipher mode ECB 
  // to decrypt the $data string.
  //    $data = the text to be decrypted.
  //    $key  = the key used to be used, not base64 encoded.  
 
  return mcrypt_decrypt( MCRYPT_BLOWFISH, $key, base64_decode( $data ), MCRYPT_MODE_ECB );
}