<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=FR link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I had to write a small program which at some point need to encrypt a piece of <o:p></o:p></p><p class=MsoNormal>data that I intended to be able to decrypt later (at least) using OpenSLL.<o:p></o:p></p><p class=MsoNormal>So I started to review the doc about the enc command.<o:p></o:p></p><p class=MsoNormal>I saw that it was possible to use salt, key, IV and/or a passphrase.<o:p></o:p></p><p class=MsoNormal>Though I believed naively it will be a simple task ... but it was not so easy.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>First I tried : <o:p></o:p></p><p class=MsoNormal>openssl enc -aes-128-cbc -iv ... -K ... -in ... -out ...<o:p></o:p></p><p class=MsoNormal>openssl enc -d -aes-128-cbc -iv ... -K ... -in ... <o:p></o:p></p><p class=MsoNormal>It works as expected.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I checked it was possible to retrieve the key and IV given the salt :<o:p></o:p></p><p class=MsoNormal>openssl enc -aes-128-cbc -S ... -P<o:p></o:p></p><p class=MsoNormal>salt=...<o:p></o:p></p><p class=MsoNormal>key=...<o:p></o:p></p><p class=MsoNormal>iv =...<o:p></o:p></p><p class=MsoNormal>It also works as expected.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I checked [unfortunately] with a passphrase :<o:p></o:p></p><p class=MsoNormal>openssl enc -aes-128-cbc -S ... -in ... -out ... <o:p></o:p></p><p class=MsoNormal>openssl enc -d -aes-128-cbc -S ... -in ... <o:p></o:p></p><p class=MsoNormal>It works as expected.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I was happy with that and confident enouth to start working.<o:p></o:p></p><p class=MsoNormal>Then I tried :<o:p></o:p></p><p class=MsoNormal>openssl enc -d -aes-128-cbc -iv ... -K ... -in ... <o:p></o:p></p><p class=MsoNormal>But it fails with "bad decrypt"<o:p></o:p></p><p class=MsoNormal>So I search for errors in my code.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Then trying desperately anything and everything I was surprised that :<o:p></o:p></p><p class=MsoNormal>openssl enc -d -aes-128-cbc -in ... <o:p></o:p></p><p class=MsoNormal>Succeeded ?<o:p></o:p></p><p class=MsoNormal>I started to understand that the salt was stored with the data.<o:p></o:p></p><p class=MsoNormal>Happy again (not for long), I tried :<o:p></o:p></p><p class=MsoNormal>openssl enc -aes-128-cbc -iv ... -K ... -in ... -out ...<o:p></o:p></p><p class=MsoNormal>openssl enc -d -aes-128-cbc -in ... <o:p></o:p></p><p class=MsoNormal>But this time got 'bad magic number'.<o:p></o:p></p><p class=MsoNormal>:-(<o:p></o:p></p><p class=MsoNormal>It was late and I felt down as I didn't see any 'magic', just curse !<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Now the reason :<o:p></o:p></p><p class=MsoNormal>Yes the salt is stored with the encrypting data. But not always.<o:p></o:p></p><p class=MsoNormal>And not only when it is not supplied (therefore generated).<o:p></o:p></p><p class=MsoNormal>It is stored when no key is given.<o:p></o:p></p><p class=MsoNormal>And when stored, even good IV and key fails to decrypt. <o:p></o:p></p><p class=MsoNormal>You must enter the password (but are NOT prompted for).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>In the hope it will save some time to others,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Michel.<o:p></o:p></p></div></body></html>