openssl incompatible with RNDecryptor? - objective-c

Question

I am trying to perform decryption with RNDecryptor. What I have done is to take the output from an openssl encryption operation and try to decode it using RNDecryptor.
This command encrypts this string with aes-256-cbc with a passcode of abc.123. It then
converts the output to base64.
$ echo "This is good" | openssl enc -e -aes-256-cbc -k abc.123 -md md5 -base64
U2FsdGVkX1+mgp+PlVPeyjiEJzkN6jWwN9z5CynnHu4=
I then take the base64 string "U2FsdGVkX1+mgp+PlVPeyjiEJzkN6jWwN9z5CynnHu4=", and put it into my Objective C program...
NSString *b64Encrypted = #"U2FsdGVkX1+mgp+PlVPeyjiEJzkN6jWwN9z5CynnHu4=";
NSData *notB64 = [b64Encrypted base64DecodedData];
NSData *decryptedData = [RNDecryptor decryptData:notB64 withPassword:#"abc.123" error:&decryptionError];
if (decryptionError != nil) {
NSLog([decryptionError debugDescription]);
}
Result is
Error Domain=net.robnapier.RNCryptManager Code=2 "Unknown header" UserInfo=0x102505ab0 {NSLocalizedDescription=Unknown header}
When I take a close look at the data, This is some things I notice...
From openssl, the data from hexdump looks like the following... (Note I did not convert to base64)
~ $ echo "This is good" | openssl enc -e -aes-256-cbc -k abc.123 -md md5 -out g.1
~ $ hexdump g.1
00000 53 61 6c 74 65 64 5f 5f 19 dd cc 48 19 9e c3 2c Salted__...H...,
00010 16 1c 71 c5 c7 56 3b 97 c8 48 fc ae 7c 56 a1 91 ..q..V;..H..|V..
What I notice is that the data starts with "Salted__" then the next 8 bytes is the salt.
When I use the RNEncryptor method, the resulting data never starts with the "Salted__" seen when using openssl. It does always start with the hex value of 0x0201
NSData *encryptedData = [RNEncryptor encryptData:data
withSettings:kRNCryptorAES256Settings
password:password
error:&error];
So my question is... Is RNEncryptor/RNDecryptor doing the right thing, and is it compatible with openssl?

Answer 1

So I found out the problem. Basically to be compatible with opessl, use the RNOpenSSLEncryptor class.
For reference the RNDecryptor class has a header in the expected data. The first two bytes make up the header. The first byte indicates the presences of v1hmac or RNCrypterFileVersion. The second byte is an option to go along with the first byte.
So if you want to be compatible with opnssl, use the RNOpenSSLEnryptor/RNOpenSSLDecryptor class.

Answer 2

OpenSSL adds its own salt. You can try -nosalt option in enc command.