Can't recover IV from openssl output

Question

Reading other posts like this one give me the impression that the iv can be retrieved from an openssl enc output, and indeed, I see that under one circumstance, it works:

# These two commands print the same salt, key, and iv
openssl enc -aes-256-cbc -pass pass:MYPASSWORD -p -in foo_clear -out foo_enc
openssl enc -aes-256-cbc -pass pass:MYPASSWORD -d -P -in foo_enc

However, when I attempt to specify the iv by use of the -iv option, I cannot get it to work:

MY_IV=12345678901234567890123456789012
# These two commands print different iv's but the same salt and key
openssl enc -aes-256-cbc -iv $MY_IV -pass pass:MYPASSWORD -p -in foo_clear -out foo_enc
openssl enc -aes-256-cbc -pass pass:MYPASSWORD -d -P -in foo_enc

Why is the iv recoverable for the one circumstance but not the other?

Answer 1

In the question that you referenced, the accepted answer explains how to derive the iv (and key) from the the password - not how to derive the iv from the ciphertext produced by openssl enc.

The reason for this, and for the behavior that you observed, is that openssl enc does not store the iv with the ciphertext. openssl enc derives the iv from the password, unless the iv is specified using the -iv option.

The first and second commands that you posted function as expected, because you did not specify the -iv options in these commands. So openssl enc derived the iv from the password for both of these commands. The iv's for both commands were the same, because the passwords provided in both commands were the same.

In the third command, you specified the -iv option. But, in the fourth command, you did not specify the iv option. Therefore, for the fourth command, openssl enc derived the iv from the password, and of course this iv was different than the one that you specified in the third command. For the fourth command to function correctly, you would need to specify the same iv that you used in the third command, using the -iv option.

For more information, see https://wiki.openssl.org/index.php/Enc

Also, the default key derivation method used by openssl enc is very weak, as noted in the question that you referenced. For a stronger key derivation function, use the -pbkdf2 option. See https://crypto.stackexchange.com/questions/3298/is-there-a-standard-for-openssl-interoperable-aes-encryption for how the salt is stored, and the key and iv are derived from the password when using the -pbkdf2 option.