3
votes
$\begingroup$

I am using AES encryption (Rijindael) with Base-64 encoding in Obj-C and VB. I am currently using the following two projects to achieve this:

Obj-C: https://github.com/dev5tec/FBEncryptor/tree/3c739f18c94ea257aba5cb7b6a97f49af2589977

Visual Basic: http://www.codeproject.com/Articles/15280/Cryptography-101-for-the-NET-Framework#_articleTop

When I encrypt with what I believe is AES 256-bit on each platform, I get completely different results. Here is an example:

-Keyword: Hello

-Text To Encrypt (plain text): test

-Obj-C Result: 3V5u+L76l5sOOnlxzW7huA==

-VB Result: HR1TCsoEvFMDkdCjZui9Og==

Why are they so different if both claim to be the same type of encryption? Does this have to do with the IV?

Could someone point me in the right direction, or at least confirm that both are in fact using AES 256?

EDIT: I've re-written the VB code with Microsoft's Rijndael Managed frameworks and it looks a little something like this: http://codeupload.com/6319

However, the Obj-C version still doesn't want to decrypt the text. I believe that it is due to a difference in IVs because as you can see, I haven't figured out how to randomly generate an IV. Also note that the salt is NOT static even though a static variable still exists. The Salt is generated through the GenerateSalt method.

$\endgroup$
7
  • 1
    $\begingroup$ If the IV is different, then the result would be different. Does the output change every time you run it? $\endgroup$
    – mikeazo
    Jun 22, 2012 at 18:33
  • 3
    $\begingroup$ Note the padding schemes they use could be different. There are different accepted ways to pad up to a multiple of 16 bytes. $\endgroup$
    – B-Con
    Jun 22, 2012 at 18:40
  • 1
    $\begingroup$ That VB article is pretty bad. Several crucial parts are plain wrong, and others are badly written and misleading. Frightning how many 5 votes it received. $\endgroup$ Jun 22, 2012 at 22:29
  • $\begingroup$ I've added a comment pointing out what's wrong with that article codeproject.com/Articles/15280/… $\endgroup$ Jun 23, 2012 at 12:43
  • $\begingroup$ Wow guys, you're all really helpful. I appreciate the help and answers. Could anyone point me in the right direction for the VB encryption? thanks! $\endgroup$ Jun 23, 2012 at 16:07

1 Answer 1

8
votes
$\begingroup$

I can immediately think of four reasons:

  • They're both not using AES256. I see in the Obj-C document a direct statement that they are using AES256 (unless you deliberately change it), I don't see any statement in the Visual Basic document that says what key size they're using (unless that's what they mean by "Block Bits").

  • Different keys. AES256 takes a key of 256 bits; there's no standard method to take a five character string and convert that into a 256 bit value. Now, there are a lot of possible methods; there's no particular assurance that they both use the same one.

  • Different modes of operation. The AES block cipher takes 128-bit values, and translates that into 128-bit values. However, not all our messages can fit into 128 bits, and in addition, sometimes there are other things we'd like to do other than message encryption. A Mode of Operation is a method that takes a block cipher, and uses it as a tool to perform some more generally useful function (such as encrypting a much longer message). There are a number of standard modes of operations, the Obj-C document states that it is using CBC mode; the Visual Basic document has scary sounding words which might be a garbled explination of CBC mode.

  • IVs. Some modes of operation (such as CBC mode) have the encryptor select an "Initialization Vector" randomly; that can be translated along with the encrypted message (because the decryptor will need that value). One of the things that this Initialization Vector does if you encrypt the message a second time, the second ciphertext will not resemble the first ciphertext at all; that way, someone listening will not be able to deduce that you've just repeated a message. The Obj-C document specifically says that it will pick a random IV (unless to tell give it one yourself).

As you can see, there are a bunch of reasons why the two ciphertexts may be different. One thing you can try: hand the ciphertext from one to the other, and ask them to decrypt it; if they can, you can be pretty sure that both sides are doing basically the same thing.

One final warning: the visual basic document has some fairly egregious mistatements in it; either the author doesn't really know what he's talking about, or he is quite bad at explaining things. I fear it may be the former; I personally would not trust any encryption software written by him.

$\endgroup$
2
  • 2
    $\begingroup$ Add to the list, Padding and input message preprocessing (encoding, etc). $\endgroup$
    – mikeazo
    Jun 22, 2012 at 18:59
  • $\begingroup$ That's really helpful, and clears up a lot. Thanks! $\endgroup$ Jun 22, 2012 at 21:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.