Hi all,

We have a JNI wrapper around OpenSSL that we are using to successfully 
do des_ede_ecb encryption/decryption of some text data.  However, if I 
try to take data encrypted with JCE ("DESEDE/ECB/PKCS5Padding"), and 
decrypt it with the SSL layer, or tak data encrypted with the SSL layer 
and decrypt it with JCE, it does not work.  The former results in an 
exception like:

javax.crypto.BadPaddingException: Given final block not properly padded
   at com.sun.crypto.provider.SunJCE_h.b(DashoA6275)
   at com.sun.crypto.provider.DESedeCipher.engineDoFinal(DashoA6275)
   at javax.crypto.Cipher.doFinal(DashoA6275)
   at bevocal.util.Encrypt.decrypt(Encrypt.java:299)
   at TestEncrypt.main(TestEncrypt.java:39)

While the latter results in no error, but garbage for the decrypted data.

Any suggestions on whether this should work or not, and assuming so, how 
to go about further troubleshooting the problem?

Thanks,
Michael

Michael Migdol wrote:
> We have a JNI wrapper around OpenSSL that we are using to successfully 
> do des_ede_ecb encryption/decryption of some text data.  However, if I 
> try to take data encrypted with JCE ("DESEDE/ECB/PKCS5Padding"), and 
> decrypt it with the SSL layer, or tak data encrypted with the SSL layer 
> and decrypt it with JCE, it does not work.  The former results in an 
> exception like:
> 
> javax.crypto.BadPaddingException: Given final block not properly padded
>   at com.sun.crypto.provider.SunJCE_h.b(DashoA6275)
>   at com.sun.crypto.provider.DESedeCipher.engineDoFinal(DashoA6275)
>   at javax.crypto.Cipher.doFinal(DashoA6275)
>   at bevocal.util.Encrypt.decrypt(Encrypt.java:299)
>   at TestEncrypt.main(TestEncrypt.java:39)
> 
> While the latter results in no error, but garbage for the decrypted data.
> 
> Any suggestions on whether this should work or not, and assuming so, how 
> to go about further troubleshooting the problem?

   These are the kinds of things I would look into.
   Is it just the padding? I.e. if you dump out the ciphertext from 
both, do the initial whole blocks encrypt to the same ciphertext?
   You've got JCE doing PKCS5 padding. What kind of padding do you have 
your OpenSSL doing?
   Does the padding exception always occur, or only for some values of 
plaintext length modulo 8?

   I assume you're using ECB just for testing, not in production.

--Mike Amling