so I have a AES-256-ecb base64 string which I decoded using an online tool. However, I'm more of a command line guy so I'm trying to use command line to decode it.
echo "nzE+iKr82Kh8BOQg0k/LViTZJup+9DReAsXd/PCtFZP5FHM7WtJ9Nz1NmqMi9G0i7rGIvhK2jRcGnFyWDT9MLoJvY1gZKI2xsUuS3nJ/n3T1Pe//4kKId+B3wfDW/TgqX6Hg/kUj8JO08wGe9JxtOEJ6XJA3cO/cSna9v3YVf/ssHTbXkb+bFgY7WLdHJyvF6lD/wfpY2ZnA1787ajtm+/aWWVMxDOwKuqIT1ZZ0Nw4=" | openssl enc -aes-256-ecb -d -a -K 366a74cb3c959de17d61db30591c39d1
this is what i've tried but i get bad decrypt error
nzE+iKr82Kh8BOQg0k/LViTZJup+9DReAsXd/PCtFZP5FHM7WtJ9Nz1NmqMi9G0i7rGIvhK2jRcGnFyWDT9MLoJvY1gZKI2xsUuS3nJ/n3T1Pe//4kKId+B3wfDW/TgqX6Hg/kUj8JO08wGe9JxtOEJ6XJA3cO/cSna9v3YVf/ssHTbXkb+bFgY7WLdHJyvF6lD/wfpY2ZnA1787ajtm+/aWWVMxDOwKuqIT1ZZ0Nw4=
is the encrypted base64 text
-aes-256-ecb is the encryption cipher
and 366a74cb3c959de17d61db30591c39d1 is the key
The result is supposed to be another base64 string:
RG9udCB3b3JyeSBzYWtldCBvbmUgZGF5IHdlIHdpbGwgcmVhY2ggdG8Kb3VyIGRlc3RpbmF0aW9uIHZlcnkgc29vbi4gQW5kIGlmIHlvdSBmb3JnZXQgCnlvdXIgdXNlcm5hbWUgdGhlbiB1c2UgeW91ciBvbGQgcGFzc3dvcmQKPT0+ICJ0cmlidXRlX3RvX2lwcHNlYyIKClZpY3Rvciw=
What you thought was the hex key was actually the binary key. We know this because if it were the hex representation, then the key would only be 128 bits, but AES-256 needs a key that's 256 bits. The real hex key is effectively a double layer of hex then, so passing 3336366137346362336339353964653137643631646233303539316333396431 as the key instead of 366a74cb3c959de17d61db30591c39d1 makes it work:
$ echo "nzE+iKr82Kh8BOQg0k/LViTZJup+9DReAsXd/PCtFZP5FHM7WtJ9Nz1NmqMi9G0i7rGIvhK2jRcGnFyWDT9MLoJvY1gZKI2xsUuS3nJ/n3T1Pe//4kKId+B3wfDW/TgqX6Hg/kUj8JO08wGe9JxtOEJ6XJA3cO/cSna9v3YVf/ssHTbXkb+bFgY7WLdHJyvF6lD/wfpY2ZnA1787ajtm+/aWWVMxDOwKuqIT1ZZ0Nw4=" | openssl enc -aes-256-ecb -d -a -K 3336366137346362336339353964653137643631646233303539316333396431 | base64
RG9udCB3b3JyeSBzYWtldCBvbmUgZGF5IHdlIHdpbGwgcmVhY2ggdG8Kb3VyIGRlc3RpbmF0aW9u
IHZlcnkgc29vbi4gQW5kIGlmIHlvdSBmb3JnZXQgCnlvdXIgdXNlcm5hbWUgdGhlbiB1c2UgeW91
ciBvbGQgcGFzc3dvcmQKPT0+ICJ0cmlidXRlX3RvX2lwcHNlYyIKClZpY3RvciwPDw8PDw8PDw8P
Dw8PDw8=
$
Related
I would like to decrypt a text using a 32 characters key and a salt from command line in my MacOS. I have encrypted it in Windows using a program. But, whenever I try to decrypt it from command line I couldn't and get an error.
echo -n PuYNZO+SLqFo6g97gxKr2uAPRUph/sZgaJ3T5YIBPIc= | openssl enc -d -a -aes-256-cbc -K TheTestKeyUsedIs32CharactersLong -S 53616c7455736564 -iv 0 -p
hex string is too short, padding with zero bytes to length
hex string is too short, padding with zero bytes to length
non-hex digit
invalid hex key value
When I try to encrypt
100836
in MacOS it gives me completely different string.
U2FsdGVkX19TYWx0VXNlZA4AWDWo5nzi8p5pYyAeUMg=
using following command:
openssl enc -aes-256-cbc -a -S 53616c7455736564 -iter 5 -k TheTestKeyUsedIs32CharactersLong -in input.txt -out openssl_output.txt
From the application I am using in Windows
100836
is converting into
PuYNZO+SLqFo6g97gxKr2uAPRUph/sZgaJ3T5YIBPIc=
My salt text is SaltUsed
My 32 bit character key is TheTestKeyUsedIs32CharactersLong
Input is PuYNZO+SLqFo6g97gxKr2uAPRUph/sZgaJ3T5YIBPIc=
Should be decrypted in 100836
But, result is completely unexpected.
I have also tried a java program to decrypt it but there I was getting other strings so thought to correct it with command line first and then will jump into the code.
I also tried the key in hex digits but still the response was incorrect and was not as expected.
#Wasif and I spent some time debugging in chat and in the end believe it's most likely a compatbility issue between OpenSSL 1.1.1.d on Windows and OpenSSL 1.1.1.b on macOS.
We went through a number of tests and permutations, using (Key, IV) tuples in hex, using passwords, with and without salts, and ultimately our testing came down to a simple check.
Using openssl enc -a -aes-256-cbc -pass pass:MYPASSWORD -p -in input.txt on Windows we got:
salt=E70092FEBA619144
key=29631452F8C259DFE6FD8E9372EC4B20392395F36B7A0B11769CEBEA987E90A0
iv =93BF2E94462A43B23EF585C0F4B3F1A8
U2FsdGVkX1/nAJL+umGRRGi3ybIPFXf7qrgov7SyXnI=
Using openssl aes-256-cbc -d -a -pass pass:MYPASSWORD -in cipherText.txt (which contains 'U2FsdGVkX1/nAJL+umGRRGi3ybIPFXf7qrgov7SyXnI=' on the Mac we got:
4593573484:error:06FFF064:digital envelope routines:CRYPTO_internal:bad decrypt
Despite this simple test failing, the Mac and Windows boxes successfully encrypted and decrypted locally.
Weird, but this looks like version incompatibility.
Try specifying the digest alorithm:
Default digest has changed between different versions.
See
How to resolve the "EVP_DecryptFInal_ex: bad decrypt" during file decryption
Im trying to decrypt a text, which was encrypted with AES-256-ECB with the given key. To decrypt, Im using the same version of the openssl which was used for encryption (OpenSSL 1.1.1d 10 Sep 2019).
String to decrypt: VAWawVAWawxiyH20dI+t5NPAY9w== (inside file.txt)
Key: 461a966faef244e4808d6b2b8e928d01 (inside key.txt)
I tried those commands:
cat file.txt | base64 -d > file2.txt
openssl enc -AES-256-ECB -d -in file2.txt -out answer.txt --kfile key.txt
And im getting: bad magic number. Whats the problem?
openssl enc will normally use a password to derive a key. So it is the derived key that is used to decrypt the file. The derivation process requires a "salt", and openssl enc during encryption stores that salt at the beginning of the file along with a "magic number" to identify it. If the magic number is missing (usually because the file wasn't encrypted by openssl enc or because the password based key derivation derivation method wasn't used) then you get this error.
The -kfile option tells OpenSSL to read the password from a file and then derive the key from it. Probably want you intended was to not use password derivation at all, but to use the explicit key. In which case you need to use the -K option and supply the key on the command line using hex.
I have a third-party source of encrypted measurement data that are updated often and need decryption. I know how to decrypt the data in perl or ruby with the mcrypt library.
For documentation purposes and easy access, I would like to document how one would decrypt the ciphertext with command line tools. I have tried the mcrypt and openssl command line tools and cannot seem to decrypt the ciphertext correctly with the command line tools.
The data is encrypted with rijndael-128 in mode ecb. This is outside of my control.
Given the following minimal example:
The encrypted data is stored in file "./ciphertext" in binary.
The ciphertext is the sequence of these bytes: 0xfb 0x0d 0xfb 0xa2 0xfc 0x43 0x0a 0xe5 0xe8 0x8b 0x25 0xac 0x06 0x9c 0xdd 0x77
The file can be created e.g. in bash with printf '\xfb\x0d\xfb\xa2\xfc\x43\x0a\xe5\xe8\x8b\x25\xac\x06\x9c\xdd\x77' >/tmp/ciphertext
The encryption key is 32 repeating bytes of value 121 (that would be 32 lowercase "y"s in ASCII)
I can decrypt the cyphertext in ruby with mcrypt like this:
require "rubygems"
require "mcrypt"
key = "y"*32
ciphertext = IO.read("ciphertext", :encoding => "BINARY")
puts(Mcrypt.new("rijndael-128", :ecb, "y"*32).decrypt(ciphertext))
and in Perl like this:
#!/usr/bin/perl
use Crypt::Rijndael;
my $key = ("y" x 32);
my $ciphertext;
open(my $fh, '<', "ciphertext") or die "cannot open ciphertext";
{
local $/;
$ciphertext = <$fh>;
};
my $cipher = Crypt::Rijndael->new($key, Crypt::Rijndael::MODE_ECB());
print($cipher->decrypt($ciphertext) . "\n");
I would like to know how to decrypt ciphertext encrypted like this with command line tools, preferably openssl, or mcrypt. I have tried these invocations, but I cannot get them right apparently:
$ mcrypt -k yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy -a rijndael-128 -m ECB -d ciphertext
Warning: It is insecure to specify keywords in the command line
An OpenPGP encrypted file has been detected.
Unknown suffix. Will append '.dc'.
File ciphertext was NOT decrypted successfully.
$ openssl enc -aes-256-ecb -d -a -K 7979797979797979797979797979797979797979797979797979797979797979 -in ciphertext -out file.txt
bad decrypt
140057024816256:error:0606506D:digital envelope routines:EVP_DecryptFinal_ex:wrong final block length:../crypto/evp/evp_enc.c:559:
The -a option tells openssl the cipher is base64 encoded. But that's wrong, it is not, in fact, base64 encoded. Also, because no padding was used on encryption you also need to specify the -nopad option.
openssl aes-256-ecb -d -nopad -K 7979797979797979797979797979797979797979797979797979797979797979 -in ciphertext
I am trying to encrypt using RC4 using openssl. I can match results with online cipher tools only with key as hex but not as plaintext.
Using password option with plaintext - DOES NOT MATCH.
# echo -ne "stackoverflow" | openssl rc4 -pass pass:"rc4cipher" -nopad -nosalt | xxd -p
Result : 8189898ec30bd96a81bca0e293
Getting the symmetric key for the password
#echo -ne "stackoverflow" | openssl rc4 -pass pass:"rc4cipher" -nopad -nosalt -p
key=1E8B649064CC6657312EE7346ED410A4
With hexa key for the above password (-k option) - MATCHES.
echo -ne "stackoverflow" | openssl rc4 -K "1E8B649064CC6657312EE7346ED410A4" -nopad -nosalt | xxd -p
Result :8189898ec30bd96a81bca0e293
I can match my result with online tools by using key as hex but not as plain text.
Can someone help please me with the option to use with openssl ?
Thanks,
Ak
Keys should consist of random binary data. They should not consist of text. If you need to perform password based encryption you need to use a password hash or, more precisely, a Password Based Key Derivation Function to turn the password into a key. Common PBKDF's are bcrypt, scrypt, PBKDF2 and Argon2.
And this is what OpenSSL (command line) does underneath: it uses a weak, OpenSSL proprietary algorithm called EVP_BytesToKey. This is basically only compatible with OpenSSL implementations or compatibility libs.
Most online tools (which you should never use to validate any implementation in the end) simply convert the text to binary using character-encoding such as UTF-8, Windows-1252 or any other - usually unspecified - encoding. This is not secure; it's as braindead as most click-bait encryption tools found online.
I am trying to use Openssl to decrypt the following AES 128 bits CBC based64 text (not padded) contained in the input.txt
bzxCHMWF+KVMumKb6rXTJQ0803fpYyxgdtZ8/nvc0Fc=
the first 16bytes are the IV. the encryption key is h4ckth1sk3yp4d16
I tried using the command:
openssl enc -aes-128-cbc -d -base64 -K 6834636b746831736b33797034643136 -iv 627a7843484d57462b4b564d756d4b62 -in input.txt -out result.txt
in the input.txt, I remove the first 16 bytes of the encrypted text when running the above command.
but I kept getting the error:
bad decrypt 3073874120:error:0606506D:digital envelope routines:EVP_DecryptFinal_ex:wrong final block length:evp_enc.c:532:
can anyone tell what's wrong here? thanks!