title: Encode/Encrypt issue while porting Python to Perl script
body: <p>I have a Python script which works fine. It is able decode/decrypt a provided pwd, and encode/encrypt it back, as follows:</p>
  
  <pre><code>#!/usr/bin/python
  
  from Crypto.Cipher import DES3
  import base64
  
  secret = base64.decodestring('tcxpLw1PsMR0CtXt/HfbIZomvJtDyE6h1Gl4vblX2W4=')
  key = secret[:24]
  iv = secret[24:]
  
  # Encoded Encrypted password
  EEpwd = '4TOHTKsvihUXuUd9M3TpoA=='
  print "Encoded Encrypted Password : ",EEpwd
  
  # Decoded Encrypted password
  DEpwd = base64.decodestring(EEpwd)
  
  # Decoded Decrypted password
  DDpwd = DES3.new(key, DES3.MODE_CBC, iv).decrypt(DEpwd)
  print "Decoded (Decrypted ( PWD ) ) : ",DDpwd
  
  # New Decoded Encrypted password
  NewDEpwd = DES3.new(key, DES3.MODE_CBC, iv).encrypt(DDpwd)
  
  # New Encoded Encrypted password
  NewEEpwd = base64.b64encode(NewDEpwd)
  print "New Encoded (Encrypted (",DDpwd,") ) : ",NewEEpwd
  </code></pre>
  
  <p>... this gives me the following output:</p>
  
  <pre><code>Encoded Encrypted Password :  4TOHTKsvihUXuUd9M3TpoA==
  Decoded (Decrypted ( PWD ) ) :  MYweakPW
  New Encoded (Encrypted ( MYweakPW ) ) :  4TOHTKsvihUXuUd9M3TpoA==
  </code></pre>
  
  <p>Now I have to migrate this script to Perl, so I did:</p>
  
  <pre><code>#!/usr/bin/perl
  use MIME::Base64;
  use Crypt::CBC;
  
  $secret = decode_base64('tcxpLw1PsMR0CtXt/HfbIZomvJtDyE6h1Gl4vblX2W4=');
  $key = substr($secret,0,24);
  $iv = substr($secret,24);
  
  $cipher = Crypt::CBC-&gt;new(
                  -cipher =&gt; 'DES_EDE3',
                  -key    =&gt; $key,
                  -iv     =&gt; $iv,
                  -header =&gt; 'none',
                  -padding =&gt; 'null',
                  -literal_key =&gt; 1
                  );
  
  # Encoded Encrypted password
  $EEpwd = '4TOHTKsvihUXuUd9M3TpoA==';
  print "Encoded Encrypted Password : ". $EEpwd ."\n";
  
  # Decoded Encrypted password
  $DEpwd = decode_base64($EEpwd);
  
  # Decoded Decrypted password
  $DDpwd = $cipher-&gt;decrypt($DEpwd);
  print "Decoded (Decrypted ( PWD ) ) : $DDpwd \n";
  
  # New Decoded Encrypted password
  $NewDEpwd = $cipher-&gt;encrypt($DDpwd);
  
  # New Encoded Encrypted password
  $NewEEpwd = encode_base64($NewDEpwd);
  print "New Encoded (Encrypted ($DDpwd) ) : $NewEEpwd \n";
  </code></pre>
  
  <p>... but this returns to me:</p>
  
  <pre><code>Encoded Encrypted Password : 4TOHTKsvihUXuUd9M3TpoA==
  Decoded (Decrypted ( PWD ) ) : MYweakPW 
  New Encoded (Encrypted (MYweakPW) ) : 4TOHTKsvihU=
  </code></pre>
  
  <p><strong>Question:</strong> Why when I encrypt/encode the password back in Perl, it returns a shorten string ? What is missing to have that matching ?</p>
  
  <p>Regards
  RZ</p>
  
  <hr>
  
  <p><strong>EDIT</strong></p>
  
  <p>Since I am changing the accepted answer, let me clarify some aspects of this code usage, to justify some choices.
  Of course this is not the entire script. I have removed as much as possible any private info, as well as other pieces of the script that was already working, isolating the piece of code that was requiring attention.
  The overall intend of the script is manage passwords used in some others scripts/apps, when the password is changed on the remote servers.</p>
  
  <p>This specific piece of code it handling the password stored by Remmina in the saved sessions. Unfortunately Remmina does not provided a centralized method to replace the saved passwords, so in my case, every time I change my password at Windows domain, all my Remmina saved sessions get outdated (and I have dozens of it!)</p>
  
  <p>The way that Remmina store the passwords are:</p>
  
  <ul>
  <li><p>at <code>$HOME/.remmina/remmina.pref</code> there are a line containing <code>secret=*</code> , encoded, with the DES3 <code>key</code> and <code>iv</code> </p></li>
  <li><p>at each session file, named <code>$HOME/.remmina/*.remmina</code> there are a line containing <code>password=*</code> with your password, encoded and encrypted</p></li>
  </ul>
  
  <p>That said, it is irrelevant to say if the original encrypted/encoded password was correctly or incorrectly generated ... That is the way Remmina does it and I have to deal with it :-/</p>
  
  <p>Depending on the parameters provided on the command line, the script should be able to retrieve the stored password from <code>*.remmina</code> files, or get a new one and replace that on <code>*.remmina</code> files, so the point raised by @jm666 on his EDIT2 is very relevant, as, when I get a new password from command line, it won't be previously padded in any way.</p>
  
  <p>For my particular scenario, I know that passwords will never be shorter then 8 bytes, but can be longer, and not a multiple of 8, so I have tested this with new different passwords, and realized that, to encrypt passwords for Remmina, the appropriate is <code>padding = 'null'</code> </p>
  
  <ul>
  <li>A particular case seems to be when the password have exactly 8 bytes long (or multiples of it). In this case, I had to 'manually' add a single <code>null</code> char in the end of the provided string, to force padding add the extra <code>null</code> chars</li>
  </ul>