cipher:final() returns nil

[anbu1506]

local cipher = require("resty.openssl.cipher")


local key = "12345678901234567890123456789012" -- 32 bytes
local iv = "1234567890123456" -- 16 bytes

local function init_encryption()
    local aes = cipher.new('aes256')
    aes:init(key, iv, {
        is_encrypt = true,
        no_padding = true
    })
    return aes
end

local function encrypt_chunk(aes, chunk)
    return aes:update(chunk)
end

local function complete_encryption(aes)
    return aes:final()
end

local function init_decryption()
    local aes = cipher.new('aes256')
    aes:init(key, iv, {
        is_encrypt = false,
        no_padding = true
    })
    return aes
end

local function decrypt_chunk(aes, chunk)
    return aes:update(chunk)
end

local function complete_decryption(aes)
    return aes:final()
end

return {
    init_encryption = init_encryption,
    encrypt_chunk = encrypt_chunk,
    complete_encryption = complete_encryption,
    init_decryption = init_decryption,
    decrypt_chunk = decrypt_chunk,
    complete_decryption = complete_decryption
}

[anbu1506]

im using these functions in body filter in openresty .
the upstream server encrypted data in body filter.
the actual proxy decrypts it in its body filter

but its working fine . but i need to know why final() returns nil

[fffonion]

This is how block cipher works, it output data in a unit of a block at a time. If there's no remaining data
when you call final then you will not receive output. Different padding will affect this behaviour.
You can read more from https://docs.openssl.org/3.1/man3/EVP_EncryptInit/#description.

[anbu1506]

actual data = [-92, -9, -44, 80, 21, 24, -27, 42, 76, 5, 108, -34, -86, -26, -66, 85, 42, 55, -50, 59, 9, -110, 28, 124, 46, 91, 34, 103, 75, 94, 51, -107]

encrypted data with iv in first 16 bytes = [-50, -122, 88, -86, -57, 32, -127, 31, -88, 109, 57, -14, -78, -97, -63, -54, 29, 23, -123, -31, 80, 26, 20, -67, 98, 117, 42, 113, 57, 20, 49, 105, -63, 109, 38, -91, 118, 101, 48, -6, 19, -112, 47, -61, 5, 77, -106, 3]

encryption key = [30, 50, -120, -96, 108, 65, 4, -33, -82, 94, 61, 27, -81, 76, 19, 70, -22, 92, -60, 44, 99, -22, 62, -57, 107, -106, 60, -116, 42, -25, -121, 35]

these are data encrypted from java.crypto AES/CBC/NoPadding

i noticed that in lua we cant pass tables to cipher . how can i decrypt it .

this is the java code

`

                private static byte[] encrypt(byte[] data, SecretKey key) throws NimbusEncryptionException {
                        try {
                            // Generate a random IV
                            byte[] iv = new byte[16]; // AES block size is 16 bytes
                            SecureRandom secureRandom = new SecureRandom();
                            secureRandom.nextBytes(iv);
                
                            // Initialize the cipher with the key and IV
                            Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding"); // Use CBC mode with padding
                            IvParameterSpec ivParams = new IvParameterSpec(iv);
                            cipher.init(Cipher.ENCRYPT_MODE, key, ivParams);
      
                                      // Encrypt the data
                                      byte[] ciphertext = cipher.doFinal(data);
                          
                                      // Prepend the IV to the ciphertext for later decryption
                                      byte[] combined = new byte[iv.length + ciphertext.length];
                                      System.arraycopy(iv, 0, combined, 0, iv.length);
                                      System.arraycopy(ciphertext, 0, combined, iv.length, ciphertext.length);
                          
                                      return combined;
                         
                                  }
                                  catch (NoSuchPaddingException | IllegalBlockSizeException | NoSuchAlgorithmException | BadPaddingException | InvalidKeyException |
                                         InvalidAlgorithmParameterException e) {
                                      LOGGER.error("Failed to encrypt  data encryption key", e); //No I18N
                                      throw new NimbusEncryptionException("Failed to encrypt data encryption key",e); //No I18N
                                  }
                              }

`

[fffonion]

I asked AI to transform the code:

local evp_cipher = require "resty.openssl.cipher"
local random = require "resty.openssl.rand"
local str = require "resty.string"

-- Custom encryption exception
local NimbusEncryptionException = {}
NimbusEncryptionException.__index = NimbusEncryptionException

function NimbusEncryptionException.new(message, cause)
    return setmetatable({
        message = message,
        cause = cause
    }, NimbusEncryptionException)
end

-- Convert array of numbers to binary string
local function arrayToString(arr)
    local result = {}
    for i, v in ipairs(arr) do
        -- Convert to unsigned byte (0-255)
        local byte = v < 0 and (v + 256) or v
        result[i] = string.char(byte)
    end
    return table.concat(result)
end

-- Convert binary string to array of numbers
local function stringToArray(str)
    local result = {}
    for i = 1, #str do
        local byte = string.byte(str, i)
        -- Convert to signed byte (-128 to 127)
        result[i] = byte > 127 and (byte - 256) or byte
    end
    return result
end

-- Main encryption function
-- @param data: byte array or string of data to encrypt
-- @param key: string or byte array representing the secret key
-- @return combined IV + ciphertext as a string, or nil + error message
local function encrypt(data, key)
    local ok, err
    
    -- Convert input to strings if they're arrays
    if type(data) == "table" then
        data = arrayToString(data)
    end
    if type(key) == "table" then
        key = arrayToString(key)
    end
    
    -- Generate random IV (16 bytes for AES)
    local iv, err = random.bytes(16)
    if not iv then
        ngx.log(ngx.ERR, "Failed to generate IV: ", err)
        return nil, NimbusEncryptionException.new("Failed to generate IV", err)
    end
    
    -- Create cipher object
    local cipher, err = evp_cipher.new("AES-256-CBC")
    if not cipher then
        ngx.log(ngx.ERR, "Failed to create cipher: ", err)
        return nil, NimbusEncryptionException.new("Failed to create cipher", err)
    end
    
    -- Encrypt the data
    local ciphertext, err = cipher:encrypt(key, iv, data)
    if not ciphertext then
        ngx.log(ngx.ERR, "Failed to encrypt data: ", err)
        return nil, NimbusEncryptionException.new("Failed to encrypt data", err)
    end
    
    -- Combine IV and ciphertext
    local combined = iv .. ciphertext
    
    return combined
end

-- Helper function to test the encryption
local function test_encryption()
    -- Test data
    local test_data = string.rep("test", 4)  -- 16 bytes of data
    local test_key = string.rep("\x01", 32)  -- 32 byte key
    
    -- Try encryption
    local encrypted, err = encrypt(test_data, test_key)
    if err then
        print("Encryption failed:", err.message)
        return
    end
    
    -- Print results
    print("Encrypted data length:", #encrypted)
    print("First 16 bytes (IV):", str.to_hex(string.sub(encrypted, 1, 16)))
    print("Remaining (ciphertext):", str.to_hex(string.sub(encrypted, 17)))
    
    return encrypted
end

-- Export functions
return {
    encrypt = encrypt,
    NimbusEncryptionException = NimbusEncryptionException,
    test_encryption = test_encryption,
    arrayToString = arrayToString,
    stringToArray = stringToArray
}

For reference only. I haven't really tested it.

[fffonion]

Closing for inactivity, please re-open if problem still exists.