Is there some standard reference somewhere (perhaps an RFC?) that explains how such OpenSSL-inter-operable AES-encrypted things are produced and later decrypted?
Ideally, an answer would link to a standard reference for the entire process, or perhaps a brief summary list of steps with a link to a standard reference for each step, something like:
To decrypt such a thing beginning with
"U2FsdGVkX1" and with a known password,
- first do
base64decoding -- see Wikipedia: base64. The result will start with
"Salted__". Be careful not to use C strings, because the result may include several
- (I guess something about salting and the IV goes here?)
- (I guess something about CBC or CTR goes here?) -- see Wikipedia: block cipher modes of operation.
- (Perhaps something about message authentication goes here?)
- AES-decrypt each block with
decrypt_one_AES_block( key, block_of_128_bits )-- see Wikipedia: AES article and A Stick Figure Guide to the Advanced Encryption Standard (AES).
- save the result of each
decrypt_one_AES_block(), concatenate them all together, and that's your plaintext. If the original was human-readable text or an HTML file, it may be OK to store the result in a C string; but other kinds of things may include several
0x00bytes incompatible with C strings.
It may sound like I'm planning to write an implementation myself. I reassure you that I plan to use one of several available libraries -- it's just that when reviewing the libraries, I'd like to know what they should be doing. What should OpenSSL libraries be doing?
Is there a standard for OpenSSL-interoperable AES encryption?