c++ - How to do AES decryption using OpenSSL -
i'd use openssl library decrypt aes data. code has access key. project uses libopenssl else, i'd stick library.
i went looking directly /usr/include/openssl/aes.h
since openssl site light on documentation. decrypt function one:
void aes_decrypt(const unsigned char *in, unsigned char *out, const aes_key *key);
unfortunately, doesn't have way specify length of in
pointer, i'm not sure how work.
there several other functions believe take numeric parm differentiate between encryption , decryption. example:
void aes_ecb_encrypt(*in, *out, *key, enc); void aes_cbc_encrypt(*in, *out, length, *key, *ivec, enc); void aes_cfb128_encrypt(*in, *out, length, *key, *ivec, *num, enc); void aes_cfb1_encrypt(*in, *out, length, *key, *ivec, *num, enc); void aes_cfb8_encrypt(*in, *out, length, *key, *ivec, *num, enc); void aes_cfbr_encrypt_block(*in, *out, nbits, *key, *ivec, enc); void aes_ofb128_encrypt(*in, *out, length, *key, *ivec, *num); void aes_ctr128_encrypt(*in, *out, length, *key, ivec[], ecount_buf[], *num); void aes_ige_encrypt(*in, *out, length, *key, *ivec, enc); void aes_bi_ige_encrypt(*in, *out, length, *key, *key2, *ivec, enc);
from understand using google, enc
parm gets set aes_encrypt
or aes_decrypt
specify action needs take place.
which brings me 2 questions:
- what these names mean? ecb, cbc, cfb128, etc..., , how decide 1 should using?
- what
unsigned char *ivec
parm needed of these, , from?
there's no size given because block sizes aes fixed based on key size; you've found ecb mode implementation, isn't suitable direct use (except teaching tool).
ecb, cbc, cfb128, etc, short names modes of operation in common use. have different properties, if never touch ecb mode, should alright.
i suggest staying further away low-level code; use evp_*
interfaces instead, if can, , can move of these decisions text configuration file, users select between different ciphers, block sizes, , modes of operation if there should ever reason change away defaults.
my sympathies, openssl documentation feels worse is, , isn't great. may find network security openssl useful book. wish had found sooner last time needed use openssl. (don't let silly title fool -- should have been titled "openssl". oh well.)
edit forgot mention initialization vectors. used make sure if encrypt same data using same key, ciphertext won't identical. need iv decrypt data, don't need keep iv secret. should either generate 1 randomly each session (and send along rsa or el gamal or dh-encrypted session key) or generate identically on both endpoints, or store locally file, that.
Comments
Post a Comment