Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In an Ars Technica article about Adobe's use of 3DES in ECB mode, there's a paragraph

The passwords, according to password expert Steve "Sc00bz" Thomas, are encrypted in a mode known as ECB. That was a poor choice on the part of Adobe engineers, because ECB often leaks information about the passwords, such as their last few characters and some of their lengths. In certain cases, for example, passwords that end in e will generate an encrypted string that ends in n2auThm2+Q==; those that are nine or 17 characters long will sometimes end in mfZq5OGbb5.

Is it really the case?

share|improve this question
Sigh. I really wish whoever it was that introduced the word 'entropy' to journalists wouldn't have. It gets my vote for the most overused cryptography-related word by laymen, hands down. Case-in-point: the article says attackers can "reduce the entropy" using a meet-in-the-middle attack? (???) – Reid Nov 2 '13 at 19:37
@Reid What the fuck. – orlp Nov 3 '13 at 1:10
I find myself wondering more why they've got an encryption of the password rather than a hash. – figlesquidge Nov 3 '13 at 10:25
up vote 7 down vote accepted

The article mentions that 3-DES was used to encrypt these passwords in ECB mode. DES has a 64-bit/8-byte block.

So let's say you use ECB to encrypt a nine byte password. The first 8-bytes are encrypted using ECB. So far so good.

But what happens when we come to the ninth byte? Well we're now in a new block but only the first byte is populated with any data. The rest are zeros (assuming no padding is used).

This means that there are only 256 possible encryptions of the second block for all nine byte passwords. With a large enough database, it will be relatively easy to guess what these encryptions are. If you had a dictionary of common nine character passwords, a mere frequency analysis of the last character of the password and a comparison to the frequency of the second ECB blocks would be enough!

So yes, the paragraph is correct. It's a significant hole in the scheme they used.

share|improve this answer
It does not matter what padding mode is used, as long as it is deterministic. – Maarten Bodewes Nov 3 '13 at 13:55

ECB leaks the identity of blocks. After padding some blocks on the end will be eminently predictable, for instance a block with a single 'e' and all zero padding.

share|improve this answer

It is the case. All 8 character passwords in the leaked file end in "ioxG6CatHBw==" Source:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.