# What does it mean if second half of 8-char string encrypted in 3DES is always identical?

In the recent Adobe passwords leak, presumably encrypted in 3DES ECB, second half of all 8-character passwords is identical: ioxG6CatHBw==

Source: http://pastebin.com/iDTFARwq (guesses based on obvious password hints)

L8qbAD3jl3jioxG6CatHBw== password
j9p+HwtWWT/ioxG6CatHBw== 12345678
rpkvF+oZzQvioxG6CatHBw== iloveyou
2dJY5hIJ4FHioxG6CatHBw== sunshine
Ttgs5+ZAZM7ioxG6CatHBw== princess
Dts8klglTQDioxG6CatHBw== computer
y7F6CyUyVM/ioxG6CatHBw== superman
2hD1nmJUmh3ioxG6CatHBw== asdfasdf
cSZM/nlchzzioxG6CatHBw== 1q2w3e4r
e+4n2zDarnvioxG6CatHBw== 1qaz2wsx
ueE89xIj8RTioxG6CatHBw== internet
ietF94QrMIbioxG6CatHBw== michelle
ecW6IyEemknioxG6CatHBw== football
lVwka/Mn8TPioxG6CatHBw== baseball
ghrvkwCcX4bioxG6CatHBw== jennifer
eOsrbcW/PeTioxG6CatHBw== abcd1234
Nz4/TI6o5RrioxG6CatHBw== trustno1
iMhaearHXjPioxG6CatHBw== whatever
OPQxDLW2L+DioxG6CatHBw== 11111111


Does it allow for guessing the keying option used or other 3DES encryption properties?

-

DES has a block size of 8 bytes. Two blocks therefore come to 16 bytes.

It looks like Adbobe were encrypting passwords using two blocks of 3-DES in ECB mode.

Because all these passwords are eight bytes long, the second block is empty and is just filled with zeros. The second block gets started at all because of the string-terminating NUL character at the position 9 of the password. The character that the rest of the block is padded with is also NUL. Because we're in ECB mode, this block encrypts to the same value each time.

That's why all these passwords have the same eight trailing bytes: ioxG6CatHBw==. This is just the sequence of bytes you get when you encrypt 64 zero bits using their key.

-
Is there a valid reason for encrypting 8 bytes using two blocks if the second block does not store any additional information? Is this standard procedure for 3DES or an Adobe-customized version? –  Adam Nov 2 '13 at 21:26
@Adam, Adobe have completely screwed up. This is not the proper way to store passwords. While they used a strong cipher (3DES) they used it in the wrong context and worse, in the wrong mode. It's a screw up, pure and simple. –  Simon Johnson Nov 2 '13 at 21:34
Is there any reason to believe that it's zero padding and not e.g. PKCS7? I'd expect most paddings to show the same behavior. –  CodesInChaos Nov 6 '13 at 8:18
What you are running into is padding together with ECB mode. This padding can be any static padding. Most common is PKCS#5 padding, but zero padding is also possible. It is not possible to test which padding is used, unless you get the program to encrypt a "password" that contains a block of 8 zeros or 8 bytes valued 08 for PKCS#5. In that case you would expect the same bytes to be generated.