Is the DES algorithm in OPENSSL random? Look at the hex dumps of encrypted1.bin and encrypted2.bin . They both have same password A which was used to encrypt sampletext

[achilles:~/Arena/crypto] $ openssl enc -e -des -in plaintext -out encrypted1.bin
enter des-cbc encryption password:
Verifying - enter des-cbc encryption password:

[achilles:~/Arena/crypto] $ openssl enc -e -des -in plaintext -out encrypted2.bin
enter des-cbc encryption password:
Verifying - enter des-cbc encryption password:


So both are encrypting the same text with the same password. Now when I hexdump them I get

[achilles:~/Arena/crypto] $ hd encrypted1.bin 
    00000000  53 61 6c 74 65 64 5f 5f  50 cc a6 a8 6f 52 cf 53  |Salted__P...oR.S|
    00000010  c7 8e 71 ea 98 4b 2a 8c  a1 4d bd 0f d0 90 62 cb  |..q..K*..M....b.|
    00000020  b1 a0 7a ef b5 a8 c1 14                           |..z.....|
    00000028
    [achilles:~/Arena/crypto] $ hd encrypted2.bin 
00000000  53 61 6c 74 65 64 5f 5f  0c c2 44 d0 19 bb a9 5e  |Salted__..D....^|
00000010  af 56 24 ce b3 b4 30 4f  61 1c f4 ba bd fc 1d a7  |.V$...0Oa.......|
00000020  b4 99 77 b9 1c 15 8a 42                           |..w....B|
00000028


How is this possible? How can the hexdump completely vary for the encryption of the same plain text with the same password and same algo (DES). And when encrypted1 and encrypted2 are decrypted they give me back the SAME plain text?
Using the -k option, you can specify a password. Passwords are not really encryption keys, so OpenSSL uses a key derivation process to turn the password into an encryption key. It turns out by default OpenSSL uses a salt in that derivation process (which is why you see Salted__ in the output, which is a magic to indicate that the next 8 bytes are the randomly generated salt). The ciphertext only starts from byte 16 onwards.

If the salt changes, the encryption key changes. If the encryption key changes, the ciphertext changes. By default OpenSSL generates a new random salt every execution. That is why you are seeing the changing ciphertext.

To turn this off you can add -nosalt. This is fine for testing purposes. As stated in the OpenSSL docs "This option SHOULD NOT be used except for test purposes or compatibility with ancient versions of OpenSSL and SSLeay". Otherwise your ciphertext is deterministic which can lead to cryptanalysis and a broken (i.e., insecure) system.

Alternatively -K lets you directly specify a key value in hexadecimals, skipping the (OpenSSL specific) password key derivation - and therefore the salt generation - entirely. You also need to specify the IV using -iv in that case. The IV should be random to achieve security in CBC mode if the key is reused, but the generation of the IV is left to the user.