Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having trouble getting OpenSSL's ciphertext to match the NIST test vectors.

Example : in "ecb_e_m.txt" from, the first test is (in hex)

Key        = 00000000000000000000000000000000

Plaintext  = 00000000000000000000000000000000

Ciphertext = C34C052CC0DA8D73451AFE5F03BE297F

I save the plaintext (in binary) to a file called pt, and run

openssl aes-128-ecb -nosalt -K 00000000000000000000000000000000 -p -nopad -in pt -out ct

Upon looking at the contents of ct, it contains

66 E9 4B D4 EF 8A 2C 3B 88 4C FA 59 CA 34 2B 2E

What am I doing wrong?

I have used the 128-bit ECB test vectors from this page :, and the ciphertext OpenSSL generates for these DOES match the given ciphertext.

share|improve this question
up vote 7 down vote accepted

The ecb_e_m.txt file is for "Monte Carlo Tests". These are described in the accompanying katmct.pdf file, section 4:

Each Monte Carlo Test consists of four million cycles through the candidate algorithm implementation. These cycles are divided into four hundred groups of 10,000 iterations each. Each iteration consists of processing an input block through the candidate algorithm, resulting in an output block. At the 10,000th cycle in an iteration, new values are assigned to the variables needed for the next iteration. The results of each 10,000th encryption or decryption cycle are recorded and included by the submitter in the appropriate file.

So if you use key K = 00...00 and begin with text T = 00...00, then encrypt T, then encrypt again the encryption result, then encrypt again, and so on, until 10000 successive encryptions have been done, then you obtain the value in the NIST test vector (C3 4C 05...). (I confirm this value with my own code.)

The command line you give, with OpenSSL, performs only one encryption, and yields a distinct result, the one you obtain (and which I can confirm, too, with my own code).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.