With openssl, why does a decrypted & re-encrypted file differ from the original encrypted copy?

Question

I have a private 2048 key that I can use to decrypt 2056 bits of encrypted data. I get out 128 bits unencrypted data. I have verified that this data is correct. (I dont know the original encrypt command).

openssl rsautl -decrypt -inkey private.pem -in data.2056bits.enc.bin -out data.128bits.dec.bin

I guess that the shrinking from 2056 bits input to 128 bits output is done using some kind of padding.

What I would like to do now is to reverse the decryption. Encrypting data.128bits.dec.bin i would like to end up with the same data.2056bits.enc.bin that I started with. I thought that the below lines would do this:

opendssl rsa -in private.pem -pubout > pub.pem
openssl rsautl -encrypt -inkey pub.pem -pubin -in data.128bits.dec.bin -out data.2056bits.enc.bin 

However data.2056bits.enc.bin is different than the one I started with.

It is however a valid encryption. I can do a

openssl rsautl -decrypt -inkey private.pem -in data.2056bits.enc.bin -out data.128bits.dec.bin

again and end up with the same data.128bits.dec.bin.

What am I dont wrong? Can there be 2 different data.2056bits.enc.bin s that yield the same data.128bits.dec.bin ?

Answer 1

One of the basic goals of cryptography is that someone who intercepts encrypted messages shouldn't be able to learn anything about the unencrypted originals. If you can determine whether two encrypted messages have the same content without actually decrypting them, then you've found a weakness.

To prevent that, an encryption scheme must produce different results when encrypting the same message twice. The padding that is added when you do an RSA encryption is different every time.

If you want to study RSA without padding (a.k.a. "textbook RSA") you can use the -raw option to rsautl. The input must be exactly the size of the key modulus since there's no padding. Just make sure you don't use it for any serious application.