PHP : openssl_encrypt result 32o string with 16o input string

Question

I have a problem with the openssl_encrypt function.

In aes-128-cbc, why function return a 32-bytes string with a 16-bytes string as input?

Sample :

$binaryK0 = openssl_encrypt(hex2bin("00000000000000000000000000000000"),"AES-128-CBC", hex2bin("00112233445566778899AABBCCDDEEFF"),OPENSSL_RAW_DATA, hex2bin("00000000000000000000000000000000"));
echo "openssl_encrypt length:".strlen($binaryK0).'<br>';
$binaryK0 = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, hex2bin("00112233445566778899AABBCCDDEEFF"), hex2bin("00000000000000000000000000000000"), MCRYPT_MODE_CBC, hex2bin("00000000000000000000000000000000"));
echo "mcrypt_encrypt length:".strlen($binaryK0).'<br>';

Result : openssl_encrypt length:32 mcrypt_encrypt length:16

`openssl_encrypt` uses Pkcs7-padding, `mcrypt_encrypt` Zero-Byte-padding, [here](https://www.php.net/manual/en/function.mcrypt-encrypt.php#117667) and [here](https://en.wikipedia.org/wiki/Padding_(cryptography)). If the plaintext has a length corresponding to an integer multiple of the blocksize (16 bytes for AES), as in the posted code with a length of 16 bytes, then Pkcs7-padding adds a full block (corresponding to a total length of 32 bytes), Zero-Byte-padding adds nothing (so the length remains unchanged at 16 bytes). — Topaco, Oct 21 '19 at 10:51

score 1 · Answer 1 · answered Oct 21 '19 at 14:54

Thank you Topaco.

With your comment, we invetigate in php openssl source code. We find "OPENSSL_NO_PADDING" option and now it's work fine.

$binaryK0 = openssl_encrypt(hex2bin("00000000000000000000000000000000"),"AES-128-CBC", hex2bin("00112233445566778899AABBCCDDEEFF"),**OPENSSL_NO_PADDING**, hex2bin("00000000000000000000000000000000"));

PHP : openssl_encrypt result 32o string with 16o input string

1 Answers1