Set padding in OpenSSL for AES_ecb_encrypt

Question

I'm decrypting some java encrypted text with OpenSSL. Reading this post I wrote the following code.

unsigned int i = 0;
printf("Out array - Before\n");
for(i = 0; i < sizeof(out); i++) {
    if(i % 32 == 0)
        printf("\n");
    printf("%02X", out[i]);
}
printf("\n");

AES_set_decrypt_key((const unsigned char *)a.at(3).c_str(), 128, &aesKey_);
for(i = 0; i < sizeof(bytes); i += AES_BLOCK_SIZE) {
    std::cout << "Decrypting at " << i << " of " << sizeof(bytes) << "\n";
    AES_ecb_encrypt(bytes + i, out + i, &aesKey_, AES_DECRYPT);
}

std::cout << "HEX        : " << a.at(2).c_str() << "\n"
<< "Decrypting : " << bytes << "\n"
<< "With Key   : " << a.at(3).c_str() << "\n"
<< "Becomes    : " << out << "\n";

printf("Out array - AFTER\n");
for(i = 0; i < sizeof(out); i++) {
    if(i % 32 == 0)
        printf("\n");
    printf("%02X", out[i]);
}
printf("\n");

It appears to decrypt the data fine, though the PKCS5-padding gets decrypted along and some extra garbage (I'm assuming this is due to the PKCS5-padding ).

Out array - BEFORE 0000000000000000000000000000000000000000000000000000000000000000
Decrypting at 0 of 18
Decrypting at 16 of 18
HEX        : B00FE0383F2E3CBB95A5A28FA91923FA00
Decrypting : ��8?.<������#�
With Key   : I'm a secret key
Becomes    : no passwordHQ�EZ��-�=%.7�n
Out array - AFTER 6E6F2070617373776F72644851030303C7457F5ACCF12DAA053D252E3708846E

The above is output from my code, no passwordHQ ( 6E6F2070617373776F72644851 ) is the expected output, but you can see the padding is decoded 030303 followed by the garbage C7457F5ACCF12DAA053D252E3708846E .

So how do I set the padding in OpenSSL?

I expected there to be an AES_set_padding (or similar) function, but I'm obviously missing it in the documentation.

Answer 1

Please try and use the higher level function defined in EVP_* . For those functions PKCS#7 padding is standard. Note that PKCS#5 padding officially is only for 8 byte block ciphers .

After some searching I found that evp.h should contain:

const EVP_CIPHER *EVP_aes_128_ecb(void);

which you should be able to use with

int EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
     unsigned char *key, unsigned char *iv);

additional information about EVP functions does suggest that it shoud automatically use the correct padding. The IV is of course ignored for ECB mode, so any pointer should do.