1

When encrypting a file with openssl using the Camellia 256-bit cipher, you can explicitly specify the block mode (e.g. camellia-256-cfb or camellia-256-ofb etc). However if you only use the -camellia256 option without block mode, what is the assumed implicit mode?

I tried figuring out by encrypting the same file with all different modes, using a fixed dummy iv and key, like this:

#!/usr/bin/env bash

# create 1MB file with random data
openssl rand 1048576 -out random.bin

iv='11111111111111111111111111111111'
key='2222222222222222222222222222222222222222222222222222222222222222'
ciphers=(camellia256 camellia-256-cfb camellia-256-cfb1 camellia-256-cfb8 camellia-256-ecb camellia-256-ofb)

for c in ${ciphers[*]}; do
  # encrypt
  openssl enc -$c -iv $iv -K $key -in random.bin -out random-$c.bin
  # show hash of encrypted result
  openssl dgst -sha256 random-$c.bin
done

And the output is:

SHA256(random-camellia256.bin)= 5625222f4bc4dd0e690ebfd24ade853f22d5155584756d9da41b6d8657d01a75
SHA256(random-camellia-256-cfb.bin)= 2b57e9cd8566af072a6162b21dc4e69337d2a9a23443fc7c25c0c1eba7f2d6eb
SHA256(random-camellia-256-cfb1.bin)= ae96dc3bdea49ec1d5c706db7f4e097f8e4e641abf2bb108eb57aa90d00eb84e
SHA256(random-camellia-256-cfb8.bin)= 7266631c9616fbfc00039dd868ba74af09d8829af11b45d83d46cb12925dceb2
SHA256(random-camellia-256-ecb.bin)= f91f4d164d40e7abb2b6a11e051d12ff82d256e4f52437d9f8997670cdb337b8
SHA256(random-camellia-256-ofb.bin)= 79a29d5790a68498ca90acb8b19fcb4e2a0066527a9de2419b9633d9f3cbaa6e

Of course it's different every time I run the script, due to the random input.

Alternatively, if I use a file filled with zeroes (0x00 bytes) instead of random data, like this:

dd bs=1048576 count=1 if=/dev/zero of=zeroes.bin

The output is:

SHA256(zeroes-camellia256.bin)= 22116d07d0c5b43e736f9990ad3f48c7710fe78ba1d6bb993dfa5a6d3a6fb133
SHA256(zeroes-camellia-256-cfb.bin)= cc75fc3257959bcaee12de3da7ef547d2f548a936d9068abde103c158d9540a8
SHA256(zeroes-camellia-256-cfb1.bin)= 912dc60b10bfad7d33fed18c1419f83437fcf84708a9336f3bbcf0a6164cd70d
SHA256(zeroes-camellia-256-cfb8.bin)= 70d340b32f58c9f2169a91c20698893046b76cd560e7a0fe2a1001591990fb8e
SHA256(zeroes-camellia-256-ecb.bin)= b9fdd441312bf9992fdca2fbbdbc165a738359312de53b0ddc71e383880cd43f
SHA256(zeroes-camellia-256-ofb.bin)= cc75fc3257959bcaee12de3da7ef547d2f548a936d9068abde103c158d9540a8

Note how the cfb and ofb outputs are the same here. But that's probably due to how those block modes define the cipher stream based on the input data.

Anyway, the one without an explicitly defined block mode is again different from all others.

So my question is: what block mode does openssl use when I specify -camellia256 as the cipher algorithm?

By the way, when I test the same with AES instead of Camellia, it appears that aes256 is the same as aes-256-cbc.

2
  • try it with an hex specified IV consisting of all zeros and see if the first block matches the ECB mode. Then use the first ciphertext block as IV. I'm presuming it's likely CBC. You can also reference the source code of course. Sep 16, 2020 at 12:36
  • @MaartenBodewes OK i've been sloppy, I missed camellia_256_cbc being present at well. Added that to the list in my test script and yes, it's the same. I also checked the source code, crypto/evp/c_allc.c contains: EVP_add_cipher_alias(SN_camellia_256_cbc, "camellia256"); so it checks out :)
    – RocketNuts
    Sep 16, 2020 at 13:33

1 Answer 1

1

OpenSSL generally defaults to CBC mode and PKCS#7 compatible padding, so it is not a surprise that this also happens for Camellia. This differs per cryptographic library, by the way, there is no mode that is the default for all crypto libraries (Java standard provider defaults to ECB).

Generally you can always create a mode from ECB mode, as a single ECB block encryption is just the execution of the block cipher. I won't go too deep in explaining how to do this, but generally it is easy enough to do for the first two blocks.

However, as you've indicated, all that is not necessary as you can also specify the CBC mode directly and then compare.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .