Question

Disclaimer: New to cryptography.

I have an external process that uses OpenSSL to encrypt data, which right now, uses a salt.

An iPhone app grabs that data from a server, downloads it to the app’s documents directory, and needs to decrypt it. The iPhone OS does not include the OpenSSL library. You can build it yourself, but it’s difficult and tricky. The “easiest” solution I’ve found, thanks to Stackoverflow’s help, is to use CommonCrypto/CommonCryptor.h which is part of the Security Framework.

But the C function to decrypt data needs an iv to correctly decrypt.

Is there a way to derive the iv from the encrypted data (which, to me, seems like it would negate the extra security)? Or do I need to, first, specify the iv somehow and let the iPhone app know what it is? Or, just don’t use a salt?

Edit1: To clarify, I’m using OpenSSL to encrypt text in a data file. A script using OpenSSL encrypts the text, uploads to Dropbox, then the app downloads the file from Dropbox, parses it, and attempts to decrypt the text.

Edit2: Yes, I’m using the OpenSSL command line utility with the -pass option.

Answer 1

The IV should be chosen randomly for each message you encrypt. I assume you are using the OpenSSL command line utility, openssl enc, but it’s not clear whether you are using password-based encryption (the -pass and -salt options) or specifying the key explicitly (the -K and -IV options).

For the best security, I recommend that you use the -K option, and randomly generate a new IV for each message. Send the IV along with the ciphertext. For example, you could append the ciphertext to the IV in one file, and then strip the IV from the beginning of the file when you are ready to decrypt.

The IV can be public; you don’t have to hide it. The important thing is that you use an unpredictable IV for each message.