I have a question about the AES encryption used by PowerShell's ConvertFrom-SecureString cmdlet when a key is specified with the -Key parameter. If I specify a 256 bit key I would assume that PowerShell is using AES 256 to encrypt my SecureString, but I receive completely different results for my encrypted string if I attempt to encrypt the same string using the System.Security.Cryptography.AESManaged namespace. I have given simple examples of these two methods below.
Method 1 (Using Secure String):
#Plain Text Password
$Password = "password"
$Key = @(1..32)
#Convert Password to a secure string
$SecureString = ConvertTo-SecureString -AsPlainText -Force -String $Password
#Convert SecureString to an encrypted string using the encryption key
$EncryptedString = ConvertFrom-SecureString -SecureString $SecureString -Key $Key
Result: 76492d1116743f0423413b16050a5345MgB8AGoAaABXAE8AMgBhAG0AawBoAEwAYgB3ADIAdgBoAHkAQwBXADgARABnAFEAPQA9AHwAZgBjAGQAOQA2ADMAYgBlAGEAOAA1AGMAZgAyAGYAYQA2AGQANQBlAGIAMgBjAGEANwB
hADgAOAA0ADQAOAA4ADkAMQBmADUAZQAwADcANQA4AGYAMQBiAGIAZQBhAGQAZgAwADEAZgAxADcAMgA5ADkAOQA5ADgAYwBjAGUAMgA=
Method 2 (Using AESManaged)
#Plain Text Password
$Password = "password"
#Convert Password to Bytes (Unicode)
$PasswordBytes = [System.Text.Encoding]::Unicode.GetBytes($Password)
#Same Key as Before
$Key = @(1..32)
$AES = New-Object System.Security.Cryptography.AESManaged
#Set Initialization Vector to all Zeroes
$AES.IV = New-Object Byte[]($AES.IV.Length)
$AES.Key = $Key
$Encryptor = $AES.CreateEncryptor()
#Encrypt the Bytes
$EncryptedBytes = $Encryptor.TransformFinalBlock($PasswordBytes, 0, $PasswordBytes.length)
#Encrypted String
$EncryptedString = [Convert]::ToBase64String($EncryptedBytes)
Result: AtBP5ctXaBlD9lUKXipy0YZvjfvpQen+bEjvw8i9j9I=
I was wondering if anyone knows how ConvertFrom-SecureString works under the hood. Is there a reason I am receiving such a different result for these 2 methods that are both using AES. Even when I use a non-zero IV with the AESManaged method I receive a result that is significantly shorter than the result I receive when using ConvertFrom-SecureString. Perhaps ConvertFrom-SecureString is doing more behind the scenes, or perhaps I am missing something simple. Thank you for your help.