Reusing IV but still generating different code?
The properties of CBC mode are only specific to when you are actually using a key and IV as specified for AES-CBC. That means, using a 128, 192 or 256 bit key - commonly specified as 16, 24 or 32 bytes - and a 128 bit key - as 16 bytes. Many tools allow other parameters such as passwords instead. Some tools, especially online tools, forget to mention that they allow different parameters than a direct key and IV, because they have been written by utter tools.

If you're using a password instead of a key it is likely that a password based key derivation method is used to derive the key. These PBKDF's commonly use a random salt and likely an work factor or iteration count. Because the salt differs each time, the derived key will differ each time as well. So in that case it doesn't matter that your IV is the same twice.

Similarly, if you specify an IV of less than 16 bytes it is likely that memory beyond the IV is used and that the result differs. However, in that case you would not be able to decrypt the first block correctly.



OpenSSL command line - by default - uses it's own PBKDF called EVP_BytesToKey using an (insecure) single iteration and an 8 byte salt. You can see this if you look at the header, as the first bytes spell Salted__ followed by an 8 byte salt (which is indistinguishable from the rest of the ciphertext).

If you want to use CBC as it is specified, you have to use the (uppercase) -K and (lowercase) -iv option and use 32, 48 or 64 hexadecimal digits for the key and 32 hexadecimal digits for the IV. These are hexadecimal representations of the binary key and IV - they are decoded by openssl to bytes before they are used.

So try something like:

openssl enc -aes-128-cbc -e -in text1.txt -out text2.txt -K '000102030405060708090A0B0C0D0E0F' -iv '000102030405060708090A0B0C0D0E0F'


instead. With whatever keys and IV's you want to try, of course.