Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've tried 3 AES 256-bit CBC encryption programs, and I seem to be getting different results for each one with the same 32-character password, which consists of all @ signs.

They are:

Polaris SSL AES-256 (C code)
OpenSSL "enc" command (command line)
Some random website that uses Javascript to implement AES (website)

Is there so much variation in AES implementations that a file that is encrypted with one AES program cannot be decrypted with another one's?

share|improve this question
As a sidenote: You shouldn't feed a 32 character password to AES, but rather a 32 byte key. If you want password based encryption, you should first hash then password with PBKDF2 or a similar slow KDF to produce the key instead of using the password directly. –  CodesInChaos Sep 4 '13 at 8:03

1 Answer 1

AES in CBC mode starts with a random initialization vector for the first block of data.

This is a randomly chosen 256-bits of data, that comprises the first block. Other modes, such as ECB mode do not have this feature of a random initialization vector and always encrypt the same block of plaintext into the same ciphertext. This leaks out information.

See: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.