openssl command line tool is a demo of the OpenSSL library. It has a pretty haphazard interface and poor documentation. I don't recommend using it for anything other than testing the OpenSSL library. (Yes, there are people who manage CAs with
openssl. I fear for their sanity.)
AES operates with a key, not with a password. An AES-128 key is exactly 16 bytes.
-k doesn't take a key as input, it takes a password. This password is hashed to derive a key; the default is MD5 and it can be overridden with command line option
-md. This isn't documented in the manual as far as I can see, you just have to read the source (
apps/enc.c, call to
EVP_BytesToKey). The MD5 digest produces a 16-byte value from any string, but this isn't what was used here. In this case, the key is actually
REDRYDER\0\0\0\0\0\0\0\0 where the
\0 are null bytes.
-K lets you pass a key, in hexadecimal. If you pass fewer bytes than the key size, OpenSSL completes with null bytes. So to pass the key
REDRYDER\0\0\0\0\0\0\0\0, you can pass
$(echo REDRYDER | od -An -tx1 | tr -d ' ') which is
The AES-128-ECB decryption operation of the ciphertext block FC89BFC2B05F1C2E64B8784392783AC9 with the key 52454452594445520000000000000000 yields 464c41473d4441495359000000000000 (using hexadecimal to represent the byte sequences). That's
For little cryptographic manipulations like these, I like the Python toplevel with the Pycrypto library.
>>> from binascii import hexlify, unhexlify
>>> from Crypto.Cipher import AES
>>> ciphertext = unhexlify('FC 89 BF C2 B0 5F 1C 2E 64 B8 78 43 92 78 3A C9'.replace(' ', ''))
>>> key = 'REDRYDER'.ljust(16, '\0')
>>> AES.new(key, AES.MODE_ECB).decrypt(ciphertext)