I've got an LTO5 tape that was backed up using Backup Exec (BE), which used hardware compression when writing to the tape. I've been given the passphrase that BE used to create the actual encryption key, so I can access and restore the tape's file backup sessions without any issues. But there are online database sessions on there too, and these are not so easily restored without replicating the original database environment.
Now, I have 3rd party tools that will do the job for me, but they won't work with encrypted tapes. So I want to use Linux' stenc utility to enable me to read the decrypted data from the tape so I can copy the tape to an unencrypted one, but to do so I need to give stenc the actual key that BE uses.... but BE stores keys in encrypted form and will not export them.
I know LTO drives use AES-256 GCM encryption. Every key generator I've seen uses a "salt" along with the passphrase to generate AES-256 keys. The various versions of BE that I've used will all read the tape once I've used their key management process to create the key using the passphrase, so this implies (to me, at least) that either they're generating the key without a salt, or are using the same salt across installations.
Is there a way to generate a key for AES GCM without a salt? I must admit that I'm an encryption newb so forgive me if this is a nonsensical question.