password based AES encryption ignores salt parameter

What steps will reproduce the problem?

In trying to understand CryptoJS, I wanted to mimic the OpenSSL command line 
below:
$ echo -n "Message" | openssl enc -aes256 -k "password" -S 4521F86027413403

This is my basic usage:
CryptoJS.AES.encrypt("Message", "password", { salt: 
CryptoJS.enc.Hex.parse("4521F86027413403") });

What is the expected output? What do you see instead?

I saw the salt parameter being ignored, and needed to update line 813 of 
cipher-core.js to add the salt parameter on the calle to execute();

            // Derive key and other params
            var derivedParams = cfg.kdf.execute(password, cipher.keySize, cipher.ivSize, cfg.salt);

The execute function does a  "if (!salt) {" check, so if cfg.salt is undefined, 
that won't be a problem.

What version of the product are you using? On what operating system?
Using 3.1.2 on Mac 10.8.2 using both Firefox 19 and Chrome 25

Please provide any additional information below.
Here is a working QUnit test with the related OpenSSL command lines I was 
testing against.

test("AES 256 test data 1", function() {
    // $ echo -n "Message" | openssl enc -aes256 -k "password" -S 4521F86027413403 | xxd -p -cols 32
    // 53616c7465645f5f4521f86027413403323e5ebe72d99cf302c99183c05cf050a

    // $ openssl enc -aes256 -k "password" -S 4521F86027413403 -P
    // salt=4521F86027413403
    // key=0CD1D07EB67E19EF56EA0F3A9A8F8A7C957A2CB208327E0E536608FF83256C96
    // iv =6C4C31BDAB7BAFD35B23691EC521E28D

    // $ echo -n "Message" | openssl enc -aes256 -K 0CD1D07EB67E19EF56EA0F3A9A8F8A7C957A2CB208327E0E536608FF83256C96 -iv 6C4C31BDAB7BAFD35B23691EC521E28D | xxd -p
    // 23e5ebe72d99cf302c99183c05cf050a

    var testVector = { plaintext : "Message",
        iv : "6C4C31BDAB7BAFD35B23691EC521E28D",
        key : "0CD1D07EB67E19EF56EA0F3A9A8F8A7C957A2CB208327E0E536608FF83256C96",
        ciphertext : "53616c7465645f5f4521f86027413403323e5ebe72d99cf302c99183c05cf050a"};

    var enc2 = CryptoJS.AES.encrypt(testVector.plaintext, CryptoJS.enc.Hex.parse(testVector.key),
        { iv : CryptoJS.enc.Hex.parse(testVector.iv), mode: CryptoJS.mode.CBC});

    equal(CryptoJS.enc.Hex.stringify(enc2.ciphertext), testVector.ciphertext.substring(33), "same ciphertext");

    var enc = CryptoJS.AES.encrypt(testVector.plaintext, "password", { salt: CryptoJS.enc.Hex.parse("4521F86027413403") });

    var iv = CryptoJS.enc.Hex.stringify(enc.iv).toUpperCase();
    equal(iv, testVector.iv, "decrypt matches known iv");

    var key = CryptoJS.enc.Hex.stringify(enc.key).toUpperCase();
    equal(key, testVector.key, "decrypt matches known key");

    var ciphertext = CryptoJS.enc.Hex.stringify(enc.ciphertext);
    equal(ciphertext, testVector.ciphertext.substring(33), "decrypt matches known test data");
});
Original issue reported on code.google.com by kevin.ha...@gmail.com on 20 Mar 2013 at 4:19
zeisschoice / crypto-js

password based AES encryption ignores salt parameter #85
