# Ruby cipher-decrypt pad block corrupted

**URL:** <https://discuss.elastic.co/t/ruby-cipher-decrypt-pad-block-corrupted/159521>\
**Category:** Logstash\
**Created:** [December 5, 2018, 11:51am UTC](https://discuss.elastic.co/t/ruby-cipher-decrypt-pad-block-corrupted/159521 "2018-12-05T11:51:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmkim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jmkim/32/37997_2.png) [@jmkim](https://discuss.elastic.co/u/jmkim)\
**Post date:** [December 5, 2018, 11:51am UTC](https://discuss.elastic.co/t/ruby-cipher-decrypt-pad-block-corrupted/159521/1 "2018-12-05T11:51:31Z")

</div>

hi!

Is there a solution?  
I would like to decrypt the encrypted code in another script through logstash's ruby ​​filter.  
By the way, an error has been issued.

> "Could not process event: pad block corrupted"

`Could not process event: pad block corrupted {:script_path=>"/home/apps/logstash/config/cipher.rb", :class=>"OpenSSL::Cipher::CipherError", :backtrace=>["org/jruby/ext/openssl/Cipher.java:1201:in `final'", "/home/apps/logstash/config/cipher.rb:18:in `filter'", "/home/apps/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby/script/context.rb:55:in `execute\_filter'", "/home/apps/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby/script.rb:30:in `execute'", "/home/apps/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:98:in `file\_script'", "/home/apps/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:84:in `filter'", "/home/apps/logstash/logstash-core/lib/logstash/filters/base.rb:143:in `do\_filter'", "/home/apps/logstash/logstash-core/lib/logstash/filters/base.rb:162:in `block in multi_filter'", "org/jruby/RubyArray.java:1734:in `each'", "/home/apps/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `multi_filter'", "/home/apps/logstash/logstash-core/lib/logstash/filter_delegator.rb:44:in `multi\_filter'", "(eval):96:in `block in filter_func'", "/home/apps/logstash/logstash-core/lib/logstash/pipeline.rb:341:in `filter\_batch'", "/home/apps/logstash/logstash-core/lib/logstash/pipeline.rb:320:in `worker_loop'", "/home/apps/logstash/logstash-core/lib/logstash/pipeline.rb:286:in `block in start\_workers'"]}`

# cipher.rb

```
KEY = " *************"
IV = " *************"

def register(params)
end

def filter(event)
  ip_binary = Array(event.get("encrypt_ip")).pack("H*")

  cipher = OpenSSL::Cipher::AES.new(128, :CBC)
  cipher.decrypt
  cipher.iv = KEY
  cipher.key = IV
  ip_decrypt = cipher.update(ip_binary) + cipher.final
  
  #return [event]
end

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2019, 11:51am UTC](https://discuss.elastic.co/t/ruby-cipher-decrypt-pad-block-corrupted/159521/2 "2019-01-02T11:51:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.