AES-256-CBC encryption returning different result in Python and PHP , HELPPP

The issue is in your PHP code. The openssl_encrypt function takes a passpharse argument:

If the passphrase is shorter than expected, it is silently padded with NUL characters; if the passphrase is longer than expected, it is silently truncated.

For AES 256, this should be 32 characters. Your $key variable is getting padded with null bytes.

The difference is in the first line of each function.

In your Python code, this just converts the ASCII key from a string to bytes. Since the length of the initial key is 32, this is fine.

    key = key_base64.encode('utf-8')

In your PHP, this decodes the from base 64 back to bytes, which shortens the key to 24 bytes.

    $key = base64_decode($key_base64);

To make the Python code the same as the PHP code, you would need to do:

key = base64.b64decode(key)

However, this will fail later on in the code in Python because the length of the key is only 24, and Python does not silently pad the key.

One work around is to use a hash of the key for the passphrase and truncate it to 32 characters. Keep in mind this is NOT a good security practice, see @maarten-bodewes comment below. Here are examples in Python and PHP. I removed the exception handling for simplicity.

from cryptography.hazmat.primitives.ciphers import Cipher, modes
from cryptography.hazmat.primitives.ciphers.algorithms import AES256
from cryptography.hazmat.primitives.padding import PKCS7
import hashlib
import base64


def encrypt_string(input_string: str, key: bytes, iv: bytes):
    # the key must be of length 32
    key_hash = hashlib.sha256(key).digest()[:32]
    cipher = Cipher(AES256(key_hash), modes.CBC(iv))
    pad = PKCS7(AES256.block_size).padder()
    
    encryptor = cipher.encryptor()
    cipher_data = encryptor.update(
        pad.update(input_string.encode('utf-8')) 
        + pad.finalize()
    )
    combined_data = iv + cipher_data
    return base64.b64encode(combined_data)

if __name__ == '__main__':
    key = b'password'
    iv = b'aaaabbbbccccdddd'
    input_string = "abcdefghijklmnopqrstuvwxyz"
    encrypted_data = encrypt_string(input_string, key, iv)
    print("Encrypted string:", encrypted_data.decode())

# prints:
# Encrypted string: YWFhYWJiYmJjY2NjZGRkZALrlaYfFmHrO6FOv64BdVueK/yYNjjgtdQx+A0eR9iv

And the PHP code:

<?php
function encrypt_string($input_string, $key, $iv) {
    // take the first 32 characters, just to be explicit
    $key_hash = substr(hash('sha256', $key, true), 0, 32);
    $ciphertext = openssl_encrypt(
        $input_string, "aes-256-cbc", $key_hash, OPENSSL_RAW_DATA, $iv
    );
    $combined_data = $iv . $ciphertext;
    return base64_encode($combined_data);
}

$key = 'password';
$iv = "aaaabbbbccccdddd";
$input_string = "abcdefghijklmnopqrstuvwxyz";
$encrypted_data = encrypt_string($input_string, $key, $iv);
echo "Encrypted string: " . $encrypted_data . "n";
?>

// echos:
// Encrypted string: YWFhYWJiYmJjY2NjZGRkZALrlaYfFmHrO6FOv64BdVueK/yYNjjgtdQx+A0eR9iv