免责声明：密码学新手。
我有一个使用 OpenSSL 加密数据的外部进程，该进程现在使用盐。
iPhone 应用程序从服务器获取该数据，将其下载到应用程序的文档目录，然后需要对其进行解密。 iPhone OS 不包含 OpenSSL 库。您可以自己构建它，但这既困难又棘手。感谢 Stackoverflow 的帮助，我找到的“最简单”的解决方案是使用 CommonCrypto/CommonCryptor.h，它是安全框架的一部分。
但是解密数据的C函数需要一个iv才能正确解密。
有没有办法从加密数据中导出 iv（对我来说，这似乎会抵消额外的安全性）？或者我是否需要首先以某种方式指定 iv 并让 iPhone 应用程序知道它是什么？或者，只是不使用盐？
Edit1：为了澄清，我使用 OpenSSL 来加密数据文件中的文本。使用 OpenSSL 的脚本加密文本，上传到 Dropbox，然后应用程序从 Dropbox 下载文件，解析它，并尝试解密文本。
Edit2：是的，我正在使用带有 -pass 选项的 OpenSSL 命令行实用程序。
Disclaimer: New to cryptography.
I have an external process that uses OpenSSL to encrypt data, which right now, uses a salt.
An iPhone app grabs that data from a server, downloads it to the app's documents directory, and needs to decrypt it. The iPhone OS does not include the OpenSSL library. You can build it yourself, but it's difficult and tricky. The "easiest" solution I've found, thanks to Stackoverflow's help, is to use CommonCrypto/CommonCryptor.h which is part of the Security Framework.
But the C function to decrypt data needs an iv to correctly decrypt.
Is there a way to derive the iv from the encrypted data (which, to me, seems like it would negate the extra security)? Or do I need to, first, specify the iv somehow and let the iPhone app know what it is? Or, just don't use a salt?
Edit1: To clarify, I'm using OpenSSL to encrypt text in a data file. A script using OpenSSL encrypts the text, uploads to Dropbox, then the app downloads the file from Dropbox, parses it, and attempts to decrypt the text.
Edit2: Yes, I'm using the OpenSSL command line utility with the -pass option.
发布评论
评论（3）
应为您加密的每条消息随机选择 IV。我假设您正在使用 OpenSSL 命令行实用程序
openssl enc，但不清楚您是否使用基于密码的加密（-pass和-salt选项）或显式指定密钥（-K和-IV选项）。为了获得最佳安全性，我建议您使用 -K 选项，并为每条消息随机生成一个新的 IV。将 IV 与密文一起发送。例如，您可以将密文附加到一个文件中的 IV，然后在准备解密时从文件的开头删除 IV。
IV 可以是公开的；你不必隐藏它。重要的是你为每条消息使用不可预测的 IV。
The IV should be chosen randomly for each message you encrypt. I assume you are using the OpenSSL command line utility,
openssl enc, but it's not clear whether you are using password-based encryption (the-passand-saltoptions) or specifying the key explicitly (the-Kand-IVoptions).For the best security, I recommend that you use the -K option, and randomly generate a new IV for each message. Send the IV along with the ciphertext. For example, you could append the ciphertext to the IV in one file, and then strip the IV from the beginning of the file when you are ready to decrypt.
The IV can be public; you don't have to hide it. The important thing is that you use an unpredictable IV for each message.
iv 不能从加密数据中推导出来，它必须在双方通信之外达成一致或公开。另外，根据加密模式，可能不需要，但 CBC 是最常见的，并且确实需要 iv。 iv 基本上使得从第一个块中收集任何信息变得更加困难。
在你的情况下，你只需要找出 iv，它要么是静态的，只是硬编码，要么是传输的，可能在前导码中，弄清楚如何从数据中提取它。
iv可能简单为 0。SSL
的一个问题是尝试捕获数据包。这可以通过应用程序 Charles（此处链接） 轻松完成，它有免费试用版。我经常使用它。
The iv can not be derived from the encrypted data, it must be either agreed on outside of the communications between the two sides or made public. Also depending on the encryption mode it may not be required, but CBC is the most common and does require an iv. The iv basically makes it harder to glean any information from the first block.
In your case you just need to figure out the iv, either it is static and just hard-code it or it it is transmitted, possibly in a pre-amble, figure out how to extract it from the data.
The iv may be as simple as 0.
One problem with SSL is trying to capture the packets. That can be done easily with the app Charles (link here), it has a free trial. I use it regularly.
就我个人而言，我使用编译 OpenSSL 来实现各种功能，请尝试这个教程 http://www.x2on.de/2010/07/13/tutorial-iphone-app-with-compiled-openssl-1-0-0a-library/确实很简单。
干杯！。
Personally I use to compile OpenSSL for a wide variety of functionality, try this tuto http://www.x2on.de/2010/07/13/tutorial-iphone-app-with-compiled-openssl-1-0-0a-library/ really is simple.
Cheers!.