EVP Symmetric Encryption and Decryption - Revision history

T8m at 10:27, 15 May 2023

2023-05-15T10:27:34Z

2019-07-04T21:59:59Z

Whitespace.

2019-07-04T21:40:28Z

Cleanup link.

2019-04-30T11:55:19Z

Reformat code according to OpenSSL coding style and provide downloadable sample C file

2017-11-30T20:44:16Z

2017-04-28T22:57:38Z

Add InfoBox

2017-04-28T22:52:38Z

Add links to all EVP articles.

2017-03-02T09:12:37Z

Add sentence about the IV being random

2017-02-24T08:56:15Z

Fixed IV length

2017-01-13T00:04:51Z

EVP_CIPHER_CTX_free_ptr -> EVP_CIPHER_CTX_ptr

@@ Line 34: / Line 34: @@
       /* A 256 bit key */
-      unsigned char *key = (unsigned char *)"01234567890123456789012345678901";
+      unsigned char *key = { 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
       /* A 128 bit IV */
-      unsigned char *iv = (unsigned char *)"0123456789012345";
+      unsigned char *iv = { 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
       /* Message to be encrypted */

← Older revision		Revision as of 21:59, 4 July 2019
Line 20:		Line 20:

	The code below sets up the program. In this example we are going to take a simple message ("The quick brown fox jumps over the lazy dog"), and then encrypt it using a predefined key and IV. In this example the key and IV have been hard coded in - in a real situation you would never do this! Following encryption we will then decrypt the resulting ciphertext, and (hopefully!) end up with the message we first started with. This program expects two functions to be defined: "encrypt" and "decrypt". We will define those further down the page. Note that this uses the auto-init facility in 1.1.0.		The code below sets up the program. In this example we are going to take a simple message ("The quick brown fox jumps over the lazy dog"), and then encrypt it using a predefined key and IV. In this example the key and IV have been hard coded in - in a real situation you would never do this! Following encryption we will then decrypt the resulting ciphertext, and (hopefully!) end up with the message we first started with. This program expects two functions to be defined: "encrypt" and "decrypt". We will define those further down the page. Note that this uses the auto-init facility in 1.1.0.
−

	#include <openssl/conf.h>		#include <openssl/conf.h>

@@ Line 101: / Line 101: @@
 * Finalising the encryption operation
-During initialisation we will provide an EVP_CIPHER object. In this case we are using EVP_aes_256_cbc(), which uses the AES algorithm with a 256-bit key in [[CBC]] mode. Refer to [[EVP#Working with Algorithms and Modes]] for further details.
+During initialisation we will provide an EVP_CIPHER object. In this case we are using EVP_aes_256_cbc(), which uses the AES algorithm with a 256-bit key in [[CBC]] mode. Refer to [[EVP#Working with Algorithms and Modes|Working with Algorithms and Modes]] for further details.
   int encrypt(unsigned char *plaintext, int plaintext_len, unsigned char *key,

@@ Line 16: / Line 16: @@
 ==Setting it up==
-The code below sets up the program. In this example we are going to take a simple message ("The quick brown fox jumps over the lazy dog"), and then encrypt it using a predefined key and IV. In this example the key and IV have been hard coded in - in a real situation you would never do this! Following encryption we will then decrypt the resulting ciphertext, and (hopefully!) end up with the message we first started with. This program expects two functions to be defined: "encrypt" and "decrypt". We will define those further down the page.
+The code below sets up the program. In this example we are going to take a simple message ("The quick brown fox jumps over the lazy dog"), and then encrypt it using a predefined key and IV. In this example the key and IV have been hard coded in - in a real situation you would never do this! Following encryption we will then decrypt the resulting ciphertext, and (hopefully!) end up with the message we first started with. This program expects two functions to be defined: "encrypt" and "decrypt". We will define those further down the page. Note that this uses the auto-init facility in 1.1.0.
@@ Line 50: / Line 50: @@
     int decryptedtext_len, ciphertext_len;
-−
     /* Encrypt the plaintext */
@@ Line 75: / Line 71: @@
     printf("%s\n", decryptedtext);
     return 0;

← Older revision		Revision as of 22:57, 28 April 2017
Line 1:		Line 1:
		+	{{DocInclude
		+	\|Name=Symmetric Encryption and Decryption
		+	\|Url=http://wiki.openssl.org/index.php/Manual:Evp(3)
		+	\|Include=evp.h}}
		+
	The [[Libcrypto API\|libcrypto]] library within OpenSSL provides functions for performing symmetric encryption and decryption operations across a wide range of algorithms and modes. This page walks you through the basics of performing a simple encryption and corresponding decryption operation.		The [[Libcrypto API\|libcrypto]] library within OpenSSL provides functions for performing symmetric encryption and decryption operations across a wide range of algorithms and modes. This page walks you through the basics of performing a simple encryption and corresponding decryption operation.

@@ Line 290: / Line 290: @@
 * [[EVP]]
 * [[Libcrypto API]]
 [[Category:Crypto API]]
 [[Category:C level]]
 [[Category:Examples]]

@@ Line 77: / Line 77: @@
+  }
-The program sets up a 256 bit key and a 128 bit IV. This is appropriate for the 256-bit AES encryption that we going to be doing in CBC mode. Make sure you use the right key and IV length for the cipher you have selected, or it will go horribly wrong!!
+The program sets up a 256 bit key and a 128 bit IV. This is appropriate for the 256-bit AES encryption that we going to be doing in CBC mode. Make sure you use the right key and IV length for the cipher you have selected, or it will go horribly wrong!! The IV should be random for CBC mode.
 We've also set up a buffer for the ciphertext to be placed in. It is important to ensure that this buffer is sufficiently large for the expected ciphertext or you may see a program crash (or potentially introduce a security vulnerability into your code). Note: The ciphertext may be longer than the plaintext (e.g. if padding is being used).

@@ Line 228: / Line 228: @@
 <pre>typedef unsigned char byte;
 typedef std::basic_string<char, std::char_traits<char>, zallocator<char> > secure_string;
-using EVP_CIPHER_CTX_free_ptr = std::unique_ptr<EVP_CIPHER_CTX, decltype(&::EVP_CIPHER_CTX_free)>;
+using EVP_CIPHER_CTX_ptr = std::unique_ptr<EVP_CIPHER_CTX, decltype(&::EVP_CIPHER_CTX_free)>;
 ...
@@ Line 259: / Line 259: @@
 <pre>void aes_encrypt(const byte key[KEY_SIZE], const byte iv[BLOCK_SIZE], const secure_string& ptext, secure_string& ctext)
+{
-     EVP_CIPHER_CTX_free_ptr ctx(EVP_CIPHER_CTX_new(), ::EVP_CIPHER_CTX_free);
+     EVP_CIPHER_CTX_ptr ctx(EVP_CIPHER_CTX_new(), ::EVP_CIPHER_CTX_free);
      int rc = EVP_EncryptInit_ex(ctx.get(), EVP_aes_256_cbc(), NULL, key, iv);
      if (rc != 1)