encrypt in jquery and decrypt in php

1function encrypt_decrypt($string, $action = 'encrypt')
2{
3    $encrypt_method = "AES-256-CBC";
4    $secret_key = 'AA74CDCC2BBRT935136HH7B63C27'; // user define private key
5    $secret_iv = '5fgf5HJ5g27'; // user define secret key
6    $key = hash('sha256', $secret_key);
7    $iv = substr(hash('sha256', $secret_iv), 0, 16); // sha256 is hash_hmac_algo
8    if ($action == 'encrypt') {
9        $output = openssl_encrypt($string, $encrypt_method, $key, 0, $iv);
10        $output = base64_encode($output);
11    } else if ($action == 'decrypt') {
12        $output = openssl_decrypt(base64_decode($string), $encrypt_method, $key, 0, $iv);
13    }
14    return $output;
15}
16 
17echo "Your Encrypted password is = ". $pwd = encrypt_decrypt('spaceo', 'encrypt');
18echo "Your Decrypted password is = ". encrypt_decrypt($pwd, 'decrypt');
19

1The problem is that in the CryptoJS code a password is used to derive the key and the IV to be used for AES encryption, but mcrypt only uses the key to encrypt/decrypt. This information needs to be passed to php. Since you don't want to transmit the password, you have to derive the key and IV in the same way in php.
2
3The following code derives the key and IV from a password and salt. It is modeled after the code in my answer here (for more information).
4
5function evpKDF($password, $salt, $keySize = 8, $ivSize = 4, $iterations = 1, $hashAlgorithm = "md5") {
6    $targetKeySize = $keySize + $ivSize;
7    $derivedBytes = "";
8    $numberOfDerivedWords = 0;
9    $block = NULL;
10    $hasher = hash_init($hashAlgorithm);
11    while ($numberOfDerivedWords < $targetKeySize) {
12        if ($block != NULL) {
13            hash_update($hasher, $block);
14        }
15        hash_update($hasher, $password);
16        hash_update($hasher, $salt);
17        $block = hash_final($hasher, TRUE);
18        $hasher = hash_init($hashAlgorithm);
19
20        // Iterations
21        for ($i = 1; $i < $iterations; $i++) {
22            hash_update($hasher, $block);
23            $block = hash_final($hasher, TRUE);
24            $hasher = hash_init($hashAlgorithm);
25        }
26
27        $derivedBytes .= substr($block, 0, min(strlen($block), ($targetKeySize - $numberOfDerivedWords) * 4));
28
29        $numberOfDerivedWords += strlen($block)/4;
30    }
31
32    return array(
33        "key" => substr($derivedBytes, 0, $keySize * 4),
34        "iv"  => substr($derivedBytes, $keySize * 4, $ivSize * 4)
35    );
36}
37The salt is generated during encryption in CryptoJS and needs to be sent to php with the ciphertext. Before invoking evpKDF the salt has to be converted to a binary string from hex.
38
39$keyAndIV = evpKDF("Secret Passphrase", hex2bin($saltHex));
40$decryptPassword = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, 
41        $keyAndIV["key"], 
42        hex2bin($cipherTextHex), 
43        MCRYPT_MODE_CBC, 
44        $keyAndIV["iv"]);
45If only encryptedPassword.toString() was sent to the server, then it is necessary to split the salt and actual ciphertext before use. The format is a proprietary OpenSSL-compatible format with the first 8 bytes being "Salted__", the next 8 bytes being the random salt and the rest is the actual ciphertext. Everything together is Base64-encoded.
46
47function decrypt($ciphertext, $password) {
48    $ciphertext = base64_decode($ciphertext);
49    if (substr($ciphertext, 0, 8) != "Salted__") {
50        return false;
51    }
52    $salt = substr($ciphertext, 8, 8);
53    $keyAndIV = evpKDF($password, $salt);
54    $decryptPassword = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, 
55            $keyAndIV["key"], 
56            substr($ciphertext, 16), 
57            MCRYPT_MODE_CBC, 
58            $keyAndIV["iv"]);
59
60    // unpad (PKCS#7)
61    return substr($decryptPassword, 0, strlen($decryptPassword) - ord($decryptPassword[strlen($decryptPassword)-1]));
62}
63The same can be achieved with the OpenSSL extension instead of Mcrypt:
64
65function decrypt($ciphertext, $password) {
66    $ciphertext = base64_decode($ciphertext);
67    if (substr($ciphertext, 0, 8) != "Salted__") {
68        return false;
69    }
70    $salt = substr($ciphertext, 8, 8);
71    $keyAndIV = evpKDF($password, $salt);
72    $decryptPassword = openssl_decrypt(
73            substr($ciphertext, 16), 
74            "aes-256-cbc",
75            $keyAndIV["key"], 
76            OPENSSL_RAW_DATA, // base64 was already decoded
77            $keyAndIV["iv"]);
78
79    return $decryptPassword;
80}