System.Security.Cryptography.CryptographicException：'输入数据不是一个完整的块。'

Question

I am new to decryption, and trying to decrypt like ColdFusion was in the previous version. I am getting this error, and not sure what it means.

string cipherText = "text";
//this is from coldfusion
String key = "key";
//var AES_algorithm = "AES";
//var AES_encoding = "hex";
//<cfset Result = #Decrypt(val, AES_Private_Key, AES_algorithm, AES_encoding)#>

if (cipherText == null || cipherText.Length <= 0)
    throw new ArgumentNullException("plainText");

//not sure what this is?
String iv = "1020304050607080";

if (key == null || key.Length <= 0)
    throw new ArgumentNullException("Key");

if (iv == null || iv.Length <= 0)
    throw new ArgumentNullException("IV");

byte[] bytearraytodecrypt = Convert.FromBase64String(cipherText);

AesCryptoServiceProvider keydecrypt = new AesCryptoServiceProvider();
keydecrypt.BlockSize = 128;
keydecrypt.KeySize = 128;
keydecrypt.Key = System.Text.Encoding.UTF8.GetBytes(key);
keydecrypt.IV = System.Text.Encoding.UTF8.GetBytes(iv);
keydecrypt.Padding = PaddingMode.PKCS7;
keydecrypt.Mode = CipherMode.CBC;

ICryptoTransform crypto1 = keydecrypt.CreateDecryptor(keydecrypt.Key, keydecrypt.IV);

byte[] returnbytearray = crypto1.TransformFinalBlock(bytearraytodecrypt, 0, bytearraytodecrypt.Length);
crypto1.Dispose();
return System.Text.Encoding.UTF8.GetString(returnbytearray);

Answer 1

It means what it says. In CBC mode the plaintext is first padded to a full number of blocks. This always happens for PKCS#7 padding. Then each block of plaintext is encrypted sequentially, using the previously encrypted block as vector; this block is XOR'ed with the plaintext.

The initial vector (IV) needs to be provided, and for CBC mode it needs to be fully unpredictable to an attacker. That generally means that it should consist of randomized bytes. A constant, encoded string doesn't meet this requirement.

Of course, the result consists of ciphertext blocks. Now if the decryption routine encounters a number of bytes that is not a multiple of the block size, you'll get the error. That means that either the message has additional data, or it hasn't been encoded correctly. It may also mean that a different mode than CBC was used, or even CBC with ciphertext stealing.