In OpenSSL, if the enc command is used (enc.c) the generation of the IV from a password is performed alongside the derivation of the key (by the function EVP_BytesToKey
: source). As they say here:
The EVP_BytesToKey(3) function provides some limited support for password based encryption. Careful selection of the parameters will provide a PKCS#5 PBKDF1 compatible implementation. However, new applications should not typically use this (preferring, for example, PBKDF2 from PCKS#5).
Therefore, it is safe to derive an IV from a password if a proper salt is used in the derivation (see RFC 2898). If a random salt is selected each time, you are not using the same IV each time you use the password.
Furthermore, it is also safe to derive key and IV from the same output of the KDF if enough randomness is already provided by the salt. That is, the size of the salt shall be already enough to ensure that is difficult for an attacker to pre-compute all the possible keys for a dictionary of passwords. Thus, it is not reasonable to split key and IV derivation just to add the burden of computing all the possible pairs (key, IV).
My next question is, why do they not use PBKDF2 for enc command with password?
openssl xyz
command-line tool work the way it does?’ is ‘It was convenient for one of the developers a decade or two ago during testing, and then it stuck.’ Deeper psychoanalysis of the motivation for the design decisions in it is typically an exercise in fruitilitilessness. $\endgroup$