Quantcast
Channel: PowerShell.com – PowerShell Scripts, Tips, Forums, and Resources
Viewing all articles
Browse latest Browse all 8583

Powershell Secure String Encryption

$
0
0

I have a question about the AES encryption used by PowerShell's ConvertFrom-SecureString cmdlet when a key is specified with the -Key parameter.  If I specify a 256 bit key I would assume that PowerShell is using AES 256 to encrypt my SecureString, but I receive completely different results for my encrypted string if I attempt to encrypt the same string using the System.Security.Cryptography.AESManaged namespace.  I have given simple examples of these two methods below.

Method 1 (Using Secure String):

#Plain Text Password
  $Password = "password"
    $Key = @(1..32)

#Convert Password to a secure string
  $SecureString = ConvertTo-SecureString -AsPlainText -Force -String $Password

#Convert SecureString to an encrypted string using the encryption key
  $EncryptedString = ConvertFrom-SecureString -SecureString $SecureString -Key $Key

Result: 76492d1116743f0423413b16050a5345MgB8AGoAaABXAE8AMgBhAG0AawBoAEwAYgB3ADIAdgBoAHkAQwBXADgARABnAFEAPQA9AHwAZgBjAGQAOQA2ADMAYgBlAGEAOAA1AGMAZgAyAGYAYQA2AGQANQBlAGIAMgBjAGEANwB
hADgAOAA0ADQAOAA4ADkAMQBmADUAZQAwADcANQA4AGYAMQBiAGIAZQBhAGQAZgAwADEAZgAxADcAMgA5ADkAOQA5ADgAYwBjAGUAMgA=

Method 2 (Using AESManaged)

#Plain Text Password
 $Password = "password"
 
 #Convert Password to Bytes (Unicode)
 $PasswordBytes = [System.Text.Encoding]::Unicode.GetBytes($Password)
 
 #Same Key as Before
 $Key = @(1..32)
 
 $AES = New-Object System.Security.Cryptography.AESManaged
 
 #Set Initialization Vector to all Zeroes
 $AES.IV = New-Object Byte[]($AES.IV.Length)
 $AES.Key = $Key
 
 $Encryptor = $AES.CreateEncryptor()
 
 #Encrypt the Bytes
 $EncryptedBytes = $Encryptor.TransformFinalBlock($PasswordBytes, 0, $PasswordBytes.length)
 
 #Encrypted String
 $EncryptedString = [Convert]::ToBase64String($EncryptedBytes)

 Result: AtBP5ctXaBlD9lUKXipy0YZvjfvpQen+bEjvw8i9j9I=

I was wondering if anyone knows how ConvertFrom-SecureString works under the hood.  Is there a reason I am receiving such a different result for these 2 methods that are both using AES.  Even when I use a non-zero IV with the AESManaged method I receive a result that is significantly shorter than the result I receive when using ConvertFrom-SecureString.  Perhaps ConvertFrom-SecureString is doing more behind the scenes, or perhaps I am missing something simple.  Thank you for your help.

 

 


Viewing all articles
Browse latest Browse all 8583

Trending Articles