1
$\begingroup$

If I run the following, for openSSL:

echo -n "0123456789abcdef0123456789abcdef" | openssl aes-128-ecb -nosalt -nopad | xxd

and enter the key "YELLOW SUBMARINE", I get the following ciphertext:

a2a5 8316 129f c596 8341 c78a 0c36 5d20
a2a5 8316 129f c596 8341 c78a 0c36 5d20

Yet in PyCrypto, the following code:

from Crypto.Cipher import AES
key = b'YELLOW SUBMARINE'
cipher = AES.new(key, AES.MODE_ECB, "")
msg =  cipher.encrypt(b'0123456789abcdef0123456789abcdef')

Outputs:

20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad
20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad

(line breaks added for clarity)

What is the cause of this discrepancy? Both are 128-bit AES in ECB mode. PyCrypto doesn't appear to be salting, and padding should be unnecessary in any case with this plaintext.

P.S. The same thing happens with M2Crypto:

import M2Crypto
cipher=M2Crypto.EVP.Cipher('aes_128_ecb',b'YELLOW SUBMARINE',"", op=1,
padding=0, salt=None)
out=b''
plaintext=b'0123456789abcdef0123456789abcdef'
out=out+cipher.update(plaintext)
print ' '.join(x.encode('hex') for x in out)

Outputs:

20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad
20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad
$\endgroup$
2
  • 1
    $\begingroup$ They probably have different methods for transforming the text string password into a 128-bit key for using in AES. $\endgroup$
    – mikeazo
    Feb 21, 2015 at 15:45
  • $\begingroup$ Please add your own answer instead of editing it in your question. In this case the accepted answer already contains the same resolution, so I've simply deleted the answer from the question. $\endgroup$
    – Maarten Bodewes
    Feb 21, 2015 at 18:28

1 Answer 1

4
$\begingroup$

Commandline openssl enc normally does Password Based Encryption which derives the actual key, and IV (although IV is ignored for ECB), from the password or passphrase you enter, using a variant of PBKDF1. To get "raw" encryption you must specify the key in hex with -K (uppercase), in which case -nosalt is irrelevant (because it applies only to PBKDF). Except for the most recent releases of OpenSSL (and my test system has an older one) with -K you must also specify an -iv in hex even when the cipher/mode used doesn't need it, like ECB.

lin04:~ $ echo -n YELLOW SUBMARINE |od -tx1 |awk '$1="";gsub(/ /,"")' 59454c4c4f57205355424d4152494e45 lin04:~ $ echo -n 0123456789abcdef |openssl aes-128-ecb -nopad \ -K 59454c4c4f57205355424d4152494e45 -iv 00 |od -tx1 0000000 20 1e 80 2f 7b 6a ce 6f 6c d0 a7 43 ba 78 ae ad 0000020

Out of scope of your question, but I hope you know that using ECB is in most cases a very bad idea. I've seen probably dozens of questions and answers here and security.SE about that. As the most glaring fairly recent example, see the Adobe password breach, which allowed many many passwords to be broken due to using ECB.

$\endgroup$
1
  • $\begingroup$ Thanks for the clear answer. Yeah, I'm just using it for the Matasano Crypto challenges. It makes it pretty clear why it's a bad idea in practice. $\endgroup$
    – jamesmcm
    Feb 21, 2015 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.