2 edited tags
| link
    Tweeted twitter.com/#!/StackSecurity/status/489560695214989313
source | link

256 Bit Key into AES 128 same output as 256 Bit Key into AES 256

I have two different crypto libraries I created, one is in java and uses the standard built-in java crypto libraries.

The other uses openssl and has been wrapped in java through the JNI.

I'm currently replacing the default java library code with the openssl library code, and verifying the encryptions against each other to make sure nothing breaks for my end user. I'm curious, because java is only guaranteed to support 128 bit keys using its implementation of PBKDF2, so I'm using AES CBC 128 with java. I had originally coded for AES CBC 256 in openssl, not thinking.

What I'm curious about is this: When I input a 256 bit key into java's AES CBC 128, I got the same output as I did for openssl's AES CBC 256. When I input a 128 bit key into AES CBC 128, I got a different output than when I input the same key into openssl's AES CBC 256. (I used the same 16 byte IV across all trials)

I assume the two different encryption schemes would generate completely different results, so I'm confused as to why this is happening. I thought I had a better understanding of the cipher than it appears I actually do.

Apologies if this is a painfully obvious result, I'm still somewhat new to crypto.