Encode/Encrypt issue while porting Python to Perl script

Question

I have a Python script which works fine. It is able decode/decrypt a provided pwd, and encode/encrypt it back, as follows:

#!/usr/bin/python

from Crypto.Cipher import DES3
import base64

secret = base64.decodestring('tcxpLw1PsMR0CtXt/HfbIZomvJtDyE6h1Gl4vblX2W4=')
key = secret[:24]
iv = secret[24:]

# Encoded Encrypted password
EEpwd = '4TOHTKsvihUXuUd9M3TpoA=='
print "Encoded Encrypted Password : ",EEpwd

# Decoded Encrypted password
DEpwd = base64.decodestring(EEpwd)

# Decoded Decrypted password
DDpwd = DES3.new(key, DES3.MODE_CBC, iv).decrypt(DEpwd)
print "Decoded (Decrypted ( PWD ) ) : ",DDpwd

# New Decoded Encrypted password
NewDEpwd = DES3.new(key, DES3.MODE_CBC, iv).encrypt(DDpwd)

# New Encoded Encrypted password
NewEEpwd = base64.b64encode(NewDEpwd)
print "New Encoded (Encrypted (",DDpwd,") ) : ",NewEEpwd

... this gives me the following output:

Encoded Encrypted Password :  4TOHTKsvihUXuUd9M3TpoA==
Decoded (Decrypted ( PWD ) ) :  MYweakPW
New Encoded (Encrypted ( MYweakPW ) ) :  4TOHTKsvihUXuUd9M3TpoA==

Now I have to migrate this script to Perl, so I did:

#!/usr/bin/perl
use MIME::Base64;
use Crypt::CBC;

$secret = decode_base64('tcxpLw1PsMR0CtXt/HfbIZomvJtDyE6h1Gl4vblX2W4=');
$key = substr($secret,0,24);
$iv = substr($secret,24);

$cipher = Crypt::CBC->new(
                -cipher => 'DES_EDE3',
                -key    => $key,
                -iv     => $iv,
                -header => 'none',
                -padding => 'null',
                -literal_key => 1
                );

# Encoded Encrypted password
$EEpwd = '4TOHTKsvihUXuUd9M3TpoA==';
print "Encoded Encrypted Password : ". $EEpwd ."\n";

# Decoded Encrypted password
$DEpwd = decode_base64($EEpwd);

# Decoded Decrypted password
$DDpwd = $cipher->decrypt($DEpwd);
print "Decoded (Decrypted ( PWD ) ) : $DDpwd \n";

# New Decoded Encrypted password
$NewDEpwd = $cipher->encrypt($DDpwd);

# New Encoded Encrypted password
$NewEEpwd = encode_base64($NewDEpwd);
print "New Encoded (Encrypted ($DDpwd) ) : $NewEEpwd \n";

... but this returns to me:

Encoded Encrypted Password : 4TOHTKsvihUXuUd9M3TpoA==
Decoded (Decrypted ( PWD ) ) : MYweakPW 
New Encoded (Encrypted (MYweakPW) ) : 4TOHTKsvihU=

Question: Why when I encrypt/encode the password back in Perl, it returns a shorten string ? What is missing to have that matching ?

Regards RZ

---

EDIT

Since I am changing the accepted answer, let me clarify some aspects of this code usage, to justify some choices. Of course this is not the entire script. I have removed as much as possible any private info, as well as other pieces of the script that was already working, isolating the piece of code that was requiring attention. The overall intend of the script is manage passwords used in some others scripts/apps, when the password is changed on the remote servers.

This specific piece of code it handling the password stored by Remmina in the saved sessions. Unfortunately Remmina does not provided a centralized method to replace the saved passwords, so in my case, every time I change my password at Windows domain, all my Remmina saved sessions get outdated (and I have dozens of it!)

The way that Remmina store the passwords are:

• at $HOME/.remmina/remmina.pref there are a line containing secret=* , encoded, with the DES3 key and iv

• at each session file, named $HOME/.remmina/*.remmina there are a line containing password=* with your password, encoded and encrypted

That said, it is irrelevant to say if the original encrypted/encoded password was correctly or incorrectly generated ... That is the way Remmina does it and I have to deal with it :-/

Depending on the parameters provided on the command line, the script should be able to retrieve the stored password from *.remmina files, or get a new one and replace that on *.remmina files, so the point raised by @jm666 on his EDIT2 is very relevant, as, when I get a new password from command line, it won't be previously padded in any way.

For my particular scenario, I know that passwords will never be shorter then 8 bytes, but can be longer, and not a multiple of 8, so I have tested this with new different passwords, and realized that, to encrypt passwords for Remmina, the appropriate is padding = 'null'

• A particular case seems to be when the password have exactly 8 bytes long (or multiples of it). In this case, I had to 'manually' add a single null char in the end of the provided string, to force padding add the extra null chars

Answer 1

The padding option you have chosen would not appear to be the same as the one that the Python encryption library is using.

I found that by changing the -padding option to 'space', the re-encrypted password was the same as the original.