gchq / gchq/CyberChef

Wrong AES Encrypt output on inputs with special characters

Open
#1,735 6 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

**Describe the bug**
When using the "AES Encrypt" (input parameter set to `Raw`) operation with a UTF-8 input text which has special characters (in this case an `é`), the output is different from 3 different sources (`openssl`, `botan` and the `cryptii` online encrypter), all of which produce the same output.

If you perform a "To Hex" operation before the "AES Encrypt" operation, and set the input paramenter to `Hex`, it then produces the expected output.

**To Reproduce**
1. Go to CyberChef
2. Add an "AES Encrypt" operation
3. Set key to `B4294F848BD875E697FAF7CFAF40D102C733066C11C4356029710C9D5EBF26E7`
4. Set IV to `00000000000000000000000000000000`
5. In the input, set `input character encoding` to `UTF-8`
6. Add `emporté` in as the input text
7. The output will then be `d2c844670dcf3ed9fe28f764e631fcb4` which is wrong.
8. Add a "To Hex" operation before the "AES Encrypt"
9. Set the "AES Encrypt" input to `To Hex`
10. Output will be `1dfbb577dca5a8f207cf9fd4b0da7aee` which is right.

**Expected behaviour**
I would expect that it accepts special characters within UTF-8 when it is selected as the input encoding, such as below:

With `botan` cli:

```
echo "emporté" > input.txt
truncate -s -1 input.txt
botan cipher --cipher=AES-256/CBC --key=B4294F848BD875E697FAF7CFAF40D102C733066C11C4356029710C9D5EBF26E7 --nonce=00000000000000000000000000000000 input.txt > out.enc
xxd -ps out.enc
```
Produces: `1dfbb577dca5a8f207cf9fd4b0da7aee`

With `openssl enc`:

```
echo "emporté" > input.txt
truncate -s -1 input.txt
openssl enc -aes-256-cbc -nosalt -in input.txt -out out.enc -p -K "B4294F848BD875E697FAF7CFAF40D102C733066C11C4356029710C9D5EBF26E7" -iv "00000000000000000000000000000000"
xxd -ps out.enc
```
Produces: `1dfbb577dca5a8f207cf9fd4b0da7aee`

And obviously the same output with same parameters on [cryptii](https://cryptii.com/pipes/aes-encryption)

**Screenshots**
Wrong:
![Screenshot from 24 02 24 15:27:31](https://github.com/gchq/CyberChef/assets/7622286/1e8d38a4-ca4c-4b9a-8fd0-fc80df208a2a)

Right:
![Screenshot from 24 02 24 15:27:44](https://github.com/gchq/CyberChef/assets/7622286/c2ac90e8-e25b-429a-a205-33c7684a7bbd)

**Desktop (if relevant, please complete the following information):**
- OS: Linux 6.7.5
- CyberChef version: 10

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the AES Encrypt operation with UTF-8 input `emporté`, the supplied key and IV, then trace the AES Encrypt operation's raw-input encoding path. Compare it with the To Hex path and the expected ciphertext `1dfbb577dca5a8f207cf9fd4b0da7aee`; done means the direct UTF-8 operation matches that output and the regression is covered.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cryptography
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.