Wrong AES Encrypt output on inputs with special characters
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Describe the bug**
When using the "AES Encrypt" (input parameter set to `Raw`) operation with a UTF-8 input text which has special characters (in this case an `é`), the output is different from 3 different sources (`openssl`, `botan` and the `cryptii` online encrypter), all of which produce the same output.
If you perform a "To Hex" operation before the "AES Encrypt" operation, and set the input paramenter to `Hex`, it then produces the expected output.
**To Reproduce**
1. Go to CyberChef
2. Add an "AES Encrypt" operation
3. Set key to `B4294F848BD875E697FAF7CFAF40D102C733066C11C4356029710C9D5EBF26E7`
4. Set IV to `00000000000000000000000000000000`
5. In the input, set `input character encoding` to `UTF-8`
6. Add `emporté` in as the input text
7. The output will then be `d2c844670dcf3ed9fe28f764e631fcb4` which is wrong.
8. Add a "To Hex" operation before the "AES Encrypt"
9. Set the "AES Encrypt" input to `To Hex`
10. Output will be `1dfbb577dca5a8f207cf9fd4b0da7aee` which is right.
**Expected behaviour**
I would expect that it accepts special characters within UTF-8 when it is selected as the input encoding, such as below:
With `botan` cli:
```
echo "emporté" > input.txt
truncate -s -1 input.txt
botan cipher --cipher=AES-256/CBC --key=B4294F848BD875E697FAF7CFAF40D102C733066C11C4356029710C9D5EBF26E7 --nonce=00000000000000000000000000000000 input.txt > out.enc
xxd -ps out.enc
```
Produces: `1dfbb577dca5a8f207cf9fd4b0da7aee`
With `openssl enc`:
```
echo "emporté" > input.txt
truncate -s -1 input.txt
openssl enc -aes-256-cbc -nosalt -in input.txt -out out.enc -p -K "B4294F848BD875E697FAF7CFAF40D102C733066C11C4356029710C9D5EBF26E7" -iv "00000000000000000000000000000000"
xxd -ps out.enc
```
Produces: `1dfbb577dca5a8f207cf9fd4b0da7aee`
And obviously the same output with same parameters on [cryptii](https://cryptii.com/pipes/aes-encryption)
**Screenshots**
Wrong:

Right:

**Desktop (if relevant, please complete the following information):**
- OS: Linux 6.7.5
- CyberChef version: 10
Contributor guide
Research direction
Start by reproducing the AES Encrypt operation with UTF-8 input `emporté`, the supplied key and IV, then trace the AES Encrypt operation's raw-input encoding path. Compare it with the To Hex path and the expected ciphertext `1dfbb577dca5a8f207cf9fd4b0da7aee`; done means the direct UTF-8 operation matches that output and the regression is covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100