title: AES-RIJNDAEL-256 in PHP slight difference
body: <p>I was to able to have a function in php which encrypts via CBC method in AES-RIJNDAEL-256 encryption , but when I tested the code I got a slight difference only in one letter which I can not understand where exactly came from , here is the php code and the image shows what is the different character</p>
  
  <pre><code>&lt;?php
  
  $string_0 = "msDoss";
  $string_1 = "sALtValue";
  $string_3 = "~1B2c3D4e5F6g7H8";
  
  function PBKDF1($pass, $salt, $count, $cb)
  {
    // This is very approximately the way that the Microsoft version of 
    // PasswordDeriveBytes works.
  
    ///
    /// !!!WARNING!!!
    ///
    // This is a BAD function!
    // Irrespective of the fact that the use of PBKDF1 is not recommended anyway.
    //
    // This really should be put into a class with a constructor taking the 
    // $pass, $salt and $count.
    // Then there should be a Reset() method to start from scratch each time a new pwd/salt is used.
    // And there should be a GetBytes(int) method to get the required info.
    // But for the sake of simplicity we are assuming the same pwd and salt for each call to 
    // this function. This will not stand up to any scrutiny!
  
    static $base;
    static $extra;
    static $extracount= 0;
    static $hashno;
    static $state = 0;
  
    if ($state == 0)
    {
      $hashno = 0;
      $state = 1;
  
      $key = $pass . $salt;
      $base = sha1($key, true);
      for($i = 2; $i &lt; $count; $i++)
      {
        $base = sha1($base, true);
      }
    }
  
    $result = "";
  
    // Check if we have any bytes left over from a previous iteration.
    // This is the way MS appears to do it. To me it looks very badly wrong
    // in the line: "$result = substr($extra, $rlen, $rlen);"
    // I'm sure it should be more like "$result = substr($extra, $extracount, $rlen);"
    // Mono have provided what looks like a fixed version at
    // https://github.com/mono/mono/blob/master/mcs/class/corlib/System.Security.Cryptography/PasswordDeriveBytes.cs
    // But I'm no cryptographer so I might be wrong.
    // But this seems to work for low values of $hashno and seems to work
    // with C# implementations.
  
    if ($extracount &gt; 0)
    {
      $rlen = strlen($extra) - $extracount;
      if ($rlen &gt;= $cb)
      {
        $result = substr($extra, $extracount, $cb);
        if ($rlen &gt; $cb)
        {
          $extracount += $cb;
        }
        else
        {
          $extra = null;
          $extracount = 0;
        }
        return $result;
      }
      $result = substr($extra, $rlen, $rlen);
    }
  
    $current = "";
    $clen = 0;
    $remain = $cb - strlen($result);
    while ($remain &gt; $clen)
    {
      if ($hashno == 0)
      {
        $current = sha1($base, true);
      }
      else if ($hashno &lt; 1000)
      {
        $n = sprintf("%d", $hashno);
        $tmp = $n . $base;
        $current .= sha1($tmp, true);
      }
      $hashno++;
      $clen = strlen($current);     
    }
  
    // $current now holds at least as many bytes as we need
    $result .= substr($current, 0, $remain);
  
    // Save any left over bytes for any future requests
    if ($clen &gt; $remain)
    {
      $extra = $current;
      $extracount = $remain;
    }
  
    return $result; 
  }
  $encryption_key= PBKDF1($string_0, $string_1, 7, 32);
  ?&gt;
  </code></pre>
  
  <p>C# Code :</p>
  
  <pre><code>    byte[] bytes = Encoding.ASCII.GetBytes(Class27.string_3);
      byte[] bytes2 = Encoding.ASCII.GetBytes(Class27.string_1);
      byte[] array = Convert.FromBase64String(string_4);
      byte[] bytes3 = new PasswordDeriveBytes(Class27.string_0, bytes2, Class27.string_2, 7).GetBytes(32);
      ICryptoTransform transform = new RijndaelManaged
      {
          Mode = CipherMode.CBC
      }.CreateDecryptor(bytes3, bytes);
  </code></pre>
  
  <p><img src="https://i.stack.imgur.com/GM7tO.jpg" alt="Difference"></p>