Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

When using this very minimal CryptoJS AES example:

<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/aes.js"></script>
<script type='text/javascript'>
var passphrase = "Secret";
var enc = CryptoJS.AES.encrypt("Message", passphrase);
var result = enc.toString();
var decrypted = CryptoJS.AES.decrypt(result,passphrase).toString(CryptoJS.enc.Utf8);
document.write("Key="+enc.key+"<br>IV="+enc.iv+"<br>Salt="+enc.salt+"<br>Ciphertext="+enc.ciphertext+"<br>Result="+result+"<br>Decrypted="+decrypted);
</script>

(Live demo here: http://jsfiddle.net/RwnYL/)

Note that the Key, IV and Salt are always different. But the output (here displayed as Base64) always starts with the same 10 characters. I'm probably missing something, but why is this?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If you decode the resulting cipher text with a base64 decoder it says:

Salted__XXXXXXXXXXX

Where XXXX changes, but "Salted__" doesn't. So I guess it is a prefix added to the ciphertext to define its format.

share|improve this answer
    
Thanks! Stupid, I never bothered to actually base64-decode it. Well that explains it :) –  RocketNuts Mar 20 at 9:50
    
Wouldn't that be a pretty easy distinguisher to tell if they're using this library and algorithm (AES) if it's always appending that text to the front of the ciphertext? –  NDF1 Mar 20 at 20:00
1  
Yes it would be. So what? It shouldn't matter. The algorithms and libraries used are always supposed to be known. Under the standard security models everything but the key is supposed to be public. Otherwise you are using security through obscurity. –  izaera Mar 20 at 20:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.