Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've tried 3 AES 256-bit CBC encryption programs, and I seem to be getting different results for each one with the same 32-character password, which consists of all @ signs.

They are:

Polaris SSL AES-256 (C code)
OpenSSL "enc" command (command line)
Some random website that uses Javascript to implement AES (website)

Is there so much variation in AES implementations that a file that is encrypted with one AES program cannot be decrypted with another one's?

share|improve this question
As a sidenote: You shouldn't feed a 32 character password to AES, but rather a 32 byte key. If you want password based encryption, you should first hash then password with PBKDF2 or a similar slow KDF to produce the key instead of using the password directly. – CodesInChaos Sep 4 '13 at 8:03

AES in CBC mode starts with a random initialization vector for the first block of data.

This is a randomly chosen 256-bits of data, that comprises the first block. Other modes, such as ECB mode do not have this feature of a random initialization vector and always encrypt the same block of plaintext into the same ciphertext. This leaks out information.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.