Issue with EvpKDF implementation in JavaScript CryptoJS

For the past few days, I've been trying to understand how this code fragment in JavaScript with the CryptoJS library works. I want to port it to Python. I've written an AES algorithm that replicates the JavaScript error, which occurs because AES accepts keys larger than 256 bits, but the number of rounds changes: for 256 bits / 32 + 6 = 14 rounds, for 512 bits / 32 + 6 = 22 rounds, and so on. I've also replicated the EvpKDF algorithm in Python using MD5.

Here's what I don't understand: I run the sha512 hashing function with 1000 iterations, getting a variable 'i' of size 512 bits.

function encrypt(secret, passwrd) {
    for (var i = CryptoJS.SHA512(passwrd), n = 0; n < 1000; n++) i = CryptoJS.SHA512(i);
    console.log("1000 SHA-512:\n", i.toString());

Then in the code, there are parameters: AES key size is 32 * 4 = 128 bytes (1024 bits), and the number of iterations for the EvpKDF algorithm is 1000. As I understand it, the EvpKDF algorithm is executed inside CryptoJS.AES.encrypt.

CryptoJS.algo.AES.keySize = 32;
CryptoJS.algo.EvpKDF.cfg.iterations = 1000;

So, the EvpKDF algorithm with the value i.toString() undergoes 1000 iterations and is expanded to 128 bytes, which AES uses as the secret code for encrypting the 'secret' value.

var iv = CryptoJS.SHA256(passwrd).toString().substring(0, 32);
var ciphertext = CryptoJS.AES.encrypt(secret, i.toString(), {
    mode: CryptoJS.mode.CBC,
    padding: CryptoJS.pad.Pkcs7,
    iv: CryptoJS.enc.Utf8.parse(iv)
});

return ciphertext;
}

I've extracted the operation of the EvpKDF function from internal execution in AES and passed the value to AES with a new variable, intending to replicate this in Python, but the results don't match. Please help me understand what happens with the password i.toString(). Perhaps it's padded with zero bytes before undergoing 1000 iterations of EvpKDF.

This is the original code I want to replicate in Python.

function hex2a(t) {
    for (var e = t.toString(), i = "", n = 0; n < e.length && "00" !== e.substr(n, 2); n += 2) i += String.fromCharCode(parseInt(e.substr(n, 2), 16));
    return i; 
}

function decoder(secret, passwrd) {
    for (var i = CryptoJS.SHA512(passwrd), n = 0; n < 1000; n++) i = CryptoJS.SHA512(i);
    CryptoJS.algo.AES.keySize = 32;           
    CryptoJS.algo.EvpKDF.cfg.iterations = 1000;  
    var r = CryptoJS.AES.decrypt(secret, i.toString());
    return (out = hex2a(r)), out;
}


function encrypt(secret, passwrd) {
    for (var i = CryptoJS.SHA512(passwrd), n = 0; n < 1000; n++) i = CryptoJS.SHA512(i);
    console.log("11512 SHA-512:\n", i.toString());
    CryptoJS.algo.AES.keySize = 32;
    CryptoJS.algo.EvpKDF.cfg.iterations = 1000;
   
    
    var iv = CryptoJS.SHA256(passwrd).toString().substring(0, 32);
    console.log("IV:\n", iv);
    var ciphertext = CryptoJS.AES.encrypt(secret, i.toString(), {
        mode: CryptoJS.mode.CBC,
        padding: CryptoJS.pad.Pkcs7,
        iv: CryptoJS.enc.Utf8.parse(iv)
    });

    return ciphertext;
}

var ciphertext = encrypt('1231231321231231kjfsgbfjdskgbjkfd', 'a111111111111111111111111111111b');
var decryptedData = decoder(ciphertext, 'a111111111111111111111111111111b');
console.log("Ciphertext:\n", ciphertext.toString());  
console.log("Plaintext:\n", decryptedData);

<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script>

And this code separates EvpKDF, with encryption moved out; decryption remains unchanged for verification.

function hex2a(t) {
    for (var e = t.toString(), i = "", n = 0; n < e.length && "00" !== e.substr(n, 2); n += 2) i += String.fromCharCode(parseInt(e.substr(n, 2), 16));
    return i; 
}

function decoder(secret, passwrd) {
    for (var i = CryptoJS.SHA512(passwrd), n = 0; n < 1000; n++) i = CryptoJS.SHA512(i);
    CryptoJS.algo.AES.keySize = 32;           
    CryptoJS.algo.EvpKDF.cfg.iterations = 1000;  
    var r = CryptoJS.AES.decrypt(secret, i.toString());
    return (out = hex2a(r)), out;
}


function encrypt(secret, passwrd) {
    for (var i = CryptoJS.SHA512(passwrd), n = 0; n < 1000; n++) i = CryptoJS.SHA512(i);
    console.log("11512 SHA-512:\n", i.toString());
    CryptoJS.algo.EvpKDF.cfg.keySize = 32;
       
    var keyEvpKDF =  CryptoJS.EvpKDF(i, {iterations: 1000});
   
    var wer = keyEvpKDF.toString();
    console.log("EVPKDF:\n", wer);
    
    var iv = CryptoJS.SHA256(passwrd).toString().substring(0, 32);
  
    var ciphertext = CryptoJS.AES.encrypt(secret, wer.toString(), {
        mode: CryptoJS.mode.CBC,
        padding: CryptoJS.pad.Pkcs7,
        iv: CryptoJS.enc.Utf8.parse(iv)
    });

    return ciphertext;
}

var ciphertext = encrypt('1231231321231231kjfsgbfjdskgbjkfd', 'a111111111111111111111111111111b');
var decryptedData = decoder(ciphertext, 'a111111111111111111111111111111b');
console.log("Ciphertext:\n", ciphertext.toString());  
console.log("Plaintext:\n", decryptedData);

Addition


        var massage =  "123456789ABCDEFGabcdef00000000000000000000000000000000";
        var i = "7bff3331f9dcfbb2e1c5b6cb4170689db91fe5b12258d59672fe0e9ce61780c61f3e6dc324e58cc2170c6a8010083aafe07930708ee63c0022a7e9bce784c4c5";
        var salt = "9bd349cb2f91bfa5";
        var iv = "8e13cab9687b07bd5b1da565216e4e92";
        
        //EvpKDF explicitly
        var keyEvpKDF =  CryptoJS.EvpKDF(i, salt, {keySize: 32, iterations: 1000, iv: iv});
        var EvpKDFstr = keyEvpKDF.toString(); //EvpKDF String
        var EvpKDFWoAr = CryptoJS.enc.Utf8.parse(keyEvpKDF); //EvpKDF WordArray
        console.log("EVPKDF explicitly:\n", EvpKDFstr);
        
        var ciphertextE = CryptoJS.AES.encrypt(massage, EvpKDFWoAr, {mode: CryptoJS.mode.CBC,
            padding: CryptoJS.pad.Pkcs7, keySize: 32, iv: CryptoJS.enc.Utf8.parse(iv), salt: CryptoJS.enc.Utf8.parse(salt)});  
        
        console.log("explicitly AES.encrypt key:\n",CryptoJS.enc.Utf8.stringify(ciphertextE.key));
        
        console.log("explicitly AES.encrypt massage:\n",ciphertextE.toString());
        console.log("explicitly AES.encrypt salt:\n",ciphertextE.salt);
        console.log("explicitly AES.encrypt iv:\n",CryptoJS.enc.Utf8.stringify(ciphertextE.iv));
        
        
        
        //EvpKDF implicitly
        CryptoJS.algo.AES.keySize = 32;
        CryptoJS.algo.EvpKDF.cfg.iterations = 1000;
        
        var ciphertextI = CryptoJS.AES.encrypt(massage, i.toString(), {iv: iv, salt: salt});  
        console.log("implicitly AES.encrypt key:\n",ciphertextI.key.toString());
        
        console.log("implicitly AES.encrypt massage:\n",ciphertextI.toString());
        console.log("implicitly AES.encrypt salt:\n",ciphertextI.salt.toString());
        console.log("implicitly AES.encrypt iv:\n",ciphertextI.iv.toString());
        
        
        
        //decode
        function hex2a(t) {
        for (var e = t.toString(), i = "", n = 0; n < e.length && "00" !== e.substr(n, 2); n += 2) i += String.fromCharCode(parseInt(e.substr(n, 2), 16));
        return i; 
    }
    
       
        CryptoJS.algo.AES.keySize = 32;           
        CryptoJS.algo.EvpKDF.cfg.iterations = 1000;  
        var rE = CryptoJS.AES.decrypt(ciphertextE, i.toString()); //decode EvpKDF explicitly
        var rI = CryptoJS.AES.decrypt(ciphertextI, i.toString()); //decode EvpKDF implicitly
        var outE = hex2a(rE);
        var outI = hex2a(rI);
    
        console.log("decode EvpKDF explicitly:\n",outE);
        console.log("decode EvpKDF implicitly:\n",outI);

"EVPKDF explicitly:", "41baff1b3e0aba71509def0ae44129b8dcb5ce08a21f54227cbe16bde8e161408d1c4e2484ef91f2ba61df3bedd64b344cfbb785b672a02441e0ec14b09ca84320521ae2ba5fdc8a3b6b0351b833398b3de9031446c3ab3ffacdb47e4ea2c7c0673fd8218031d28d0ca295c6dd64286dde9cade5503bf159d8c909be7d69028b"

"explicitly AES.encrypt key:", "41baff1b3e0aba71509def0ae44129b8dcb5ce08a21f54227cbe16bde8e161408d1c4e2484ef91f2ba61df3bedd64b344cfbb785b672a02441e0ec14b09ca84320521ae2ba5fdc8a3b6b0351b833398b3de9031446c3ab3ffacdb47e4ea2c7c0673fd8218031d28d0ca295c6dd64286dde9cade5503bf159d8c909be7d69028b"

"explicitly AES.encrypt massage:", "IDecjotjMm3KE4fwMnTaKgwd2//Xl/veH6Dc+YL0jQ1lfLYqT6sTTVB4lfW2qXR9IVWzGijUGBSqwifF8kJghg=="

"explicitly AES.encrypt salt:", undefined

"explicitly AES.encrypt iv:", "8e13cab9687b07bd5b1da565216e4e92"

"implicitly AES.encrypt key:",
"9e9a0315c2634e545f31c56396fd6ca5c0076fb78359c1213e537e2d1d028cb0c62815ebfc58ca3cee05d5abeacceb7bb55c188b3adb40c7f3df512e821c5472739b97fd910f01646e448e4985f23847fa02a1a184e0c95a23575c16f8149dd97a60c2142cdd1ded194e00c04e3c6d2dcfd72fd773928a9051bfb45f8d42664a"

"implicitly AES.encrypt massage:", "U2FsdGVkX1/8GxXBJqyUBRxvpmVWUfpLDTNXKp8mTxsWJi0a57tJ96BHpKcBucQQkYnExKPhfPmptdm8D6vPhiYbzEW2uUIhseDkaCLjido="

"implicitly AES.encrypt salt:", "fc1b15c126ac9405"

"implicitly AES.encrypt iv:", "8b9ac5889118213f100b1bf38f21b616"

"decode EvpKDF explicitly:", ""

"decode EvpKDF implicitly:", "123456789ABCDEFGabcdef00000000000000000000000000000000"

Solution

The results differ for several reasons:

On 4.0.0, an explicitly specified salt is ignored during implicit key derivation. The explicitly set salt is only taken into account on 4.2.0.
On 4.0.0, you should therefore use the salt of the implicit key derivation in the explicit key derivation in order to be able to compare the results.
In the implicit key derivation, the IV is always derived together with the key as the 4 words (= 16 bytes) following the key. An explicitly specified IV is ignored in all versions, including 4.2.0.
Your code for the explicit key derivation must therefore be extended to include the derivation of the IV.
Salt, IV etc. are to be specified as WordArrays.

Here is a possible test scenario for 4.0.0: In the first test part, an implicit key derivation is applied. The implicitly generated salt is used in the second part for the explicit key derivation.
The generated values for key, IV and ciphertext are identical in both cases.
Note that the explicitly set salt and IV are ignored for the implicit key derivation:

//
// implicit key derivation
//
var salt = CryptoJS.enc.Hex.parse('01020304fffefdfc');
var iv = CryptoJS.enc.Hex.parse('7071727374757677bfbebdbcbbbab9b8');
CryptoJS.algo.AES.keySize = 32;    // default: 8          
CryptoJS.algo.EvpKDF.cfg.iterations = 1000;    // default: 1
var encrypted = CryptoJS.AES.encrypt(
    'The quick brown fox jumps over the lazy dog', 
    'Secret Passphrase', 
    {
        salt: salt,    // ignored
        iv: iv         // ignored
    });
console.log('- implicit key derivation:');
console.log('salt:' + encrypted.salt.toString());
console.log('key:' + encrypted.key.toString());
console.log('iv:' + encrypted.iv.toString());
console.log('ciphertext:' + encrypted.ciphertext.toString());
//
// explicit key derivation
//
var keyIv = CryptoJS.EvpKDF(
    'Secret Passphrase', 
    encrypted.salt,    // apply salt from implicit key derivation
    {
        keySize: 32 + 4, 
        iterations: 1000, 
        hasher: CryptoJS.algo.MD5
    }); 
var key = CryptoJS.lib.WordArray.create(keyIv.words.slice(0, 32), 128);
var iv = CryptoJS.lib.WordArray.create(keyIv.words.slice(32, 36), 16);
var encrypted2 = CryptoJS.AES.encrypt('The quick brown fox jumps over the lazy dog', key, {iv: iv});
console.log('- explicit key derivation:');
console.log('salt:' + encrypted.salt.toString());
console.log('key:' + key.toString());
console.log('iv:' + iv.toString());
console.log('ciphertext:' + encrypted2.ciphertext.toString());

<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script>

And here is a test for 4.2.0: An explicitly set salt is used for the implicit and explicit key derivation.
The generated values for key, IV and ciphertext are identical in both cases.
Note that the explicitly set IV is ignored for the implicit key derivation:

//
// implicit key derivation
//
var salt = CryptoJS.enc.Hex.parse('01020304fffefdfc');
var iv = CryptoJS.enc.Hex.parse('7071727374757677bfbebdbcbbbab9b8');
CryptoJS.algo.AES.keySize = 32;    // default: 8          
CryptoJS.algo.EvpKDF.cfg.iterations = 1000;    // default: 1
var encrypted = CryptoJS.AES.encrypt(
    'The quick brown fox jumps over the lazy dog', 
    'Secret Passphrase', 
    {
        salt: salt,    // applied
        iv: iv         // ignored
    });
console.log('- implicit key derivation:');
console.log('salt:' + salt.toString());
console.log('key:' + encrypted.key.toString());
console.log('iv:' + encrypted.iv.toString());
console.log('ciphertext:' + encrypted.ciphertext.toString());

//
// explicit key derivation
//
var keyIv = CryptoJS.EvpKDF(
    'Secret Passphrase', 
    salt, 
    {
        keySize: 32 + 4, 
        iterations: 1000, 
        hasher: CryptoJS.algo.MD5
    }); 
var key = CryptoJS.lib.WordArray.create(keyIv.words.slice(0, 32), 128);
var iv = CryptoJS.lib.WordArray.create(keyIv.words.slice(32, 36), 16);
var encrypted2 = CryptoJS.AES.encrypt('The quick brown fox jumps over the lazy dog', key, {iv: iv});
console.log('- explicit key derivation:');
console.log('salt:' + salt.toString());
console.log('key:' + key.toString());
console.log('iv:' + iv.toString());
console.log('ciphertext:' + encrypted2.ciphertext.toString());

<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js"></script>