How to match .NET AES with Linux EVP encryption - linux

Question

I have a file that I need to decrypt in a C# .NET application. This is a situation where the files are produced by a legacy system that cannot be modified.
Here is the code used to decrypt the files in the Linux app (I cut out some things having to do with loading the data from the file and such that were not specific to the encryption):
#define BUFFER_SIZE 8192
#define ENCRYPTION_KEY_LENGTH 16
unsigned char OutBuf[BUFFER_SIZE];
unsigned char InBuf[BUFFER_SIZE];
unsigned char arucIV[ENCRYPTION_KEY_LENGTH];
unsigned char arucKey[ENCRYPTION_KEY_LENGTH];
istream * pIn = &std::cin;
ostream * pOut = &std::cout;
string sInFile, sOutFile;
bool decrypt = false;
int rc, nOut, nIn;
EVP_CIPHER_CTX * pCTX = EVP_CIPHER_CTX_new();
pIn->read((char*)arucIV, ENCRYPTION_KEY_LENGTH);
nIn = pIn->gcount();
if(nIn == ENCRYPTION_KEY_LENGTH)
{
rc = AesKeyGen(arucIV, arucKey, ENCRYPTION_KEY_LENGTH);
if(rc == 0)
{
if(EVP_DecryptInit_ex(pCTX, EVP_aes_128_ctr(), NULL, arucKey, arucIV))
{
while(pIn->good() && pOut->good())
{
pIn->read((char*)InBuf, BUFFER_SIZE);
nIn = pIn->gcount();
if(nIn)
{
if(EVP_DecryptUpdate(pCTX, OutBuf, &nOut, InBuf, nIn))
{
pOut->write((char*)OutBuf, nOut);
}
}
}
if(EVP_DecryptFinal_ex(pCTX, OutBuf, &nOut))
{
pOut->write((char*)OutBuf, nOut);
}
}
}
else
{
printf("Error Generating key.\n");
}
}
else
{
printf("Error reading IV from input.\n");
}
In .NET I tried this code and it decrypts the first 16 bytes correctly, but the rest is garbage:
byte[] result = new byte[cipherText.Length];
using (RijndaelManaged rm = new RijndaelManaged())
{
rm.BlockSize = 128;
rm.Key = Key;
rm.IV = IV;
rm.Mode = CipherMode.CFB;
rm.Padding = PaddingMode.Zeros;
ICryptoTransform ctr = rm.CreateDecryptor();
int position = 0;
while (position + 128 < cipherText.Length)
{
ctr.TransformBlock(cipherText, position, 128, result, position);
position += 128;
}
ctr.TransformFinalBlock(cipherText, position, cipherText.Length - position);
}
So the question is what do I have to do in .NET to match how the openssl / linux app is decrypting? The linux box this is happening on is using openssl 1.0.1t.
I thought I might try just building the linux app on windows, but when I download openssl for windows 1.0.1t the include folder is empty so none of the headers are available to build it.
What do I do?

Answer 1

EVP_aes_128_ctr is AES 128 in CTR mode. And since CTR mode is effectively a stream cipher, there's no notion of padding.
.NET does not expose CTR mode, so this isn't directly portable to .NET. If you really need it to work from .NET you'll have to use AES in CipherMode.ECB (and PaddingMode.None with BlockSize = 128) to implement CTR from the description at https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_.28CTR.29.