title: C++ OpenSSL API : How to compute CLI default IV from PBKDF2 derivation
body: <p>I'm trying to implement AES decryption into one of my C++ program. The idea would be to use the following openSSL command line to generate the ciphered text (but to use the C++ API to decipher) :</p>
  
  <pre><code>openssl enc -aes-256-cbc -in plaintext.txt -base64 -md sha512 -pbkdf2 -pass pass:&lt;passwd&gt;
  </code></pre>
  
  <p>As the official doc is a bit too complicated I based my implementation on this tutorial to implement the decryption : <a href="https://eclipsesource.com/blogs/2017/01/17/tutorial-aes-encryption-and-decryption-with-openssl/" rel="nofollow noreferrer">https://eclipsesource.com/blogs/2017/01/17/tutorial-aes-encryption-and-decryption-with-openssl/</a></p>
  
  <p>It does works well, but uses a deprecated key-derivation algorithm which I wanna replace with PBKDF2.</p>
  
  <p>As far as I understand I should then use <code>PKCS5_PBKDF2_HMAC()</code> rather than the <code>EVP_BytesToKey()</code> suggested in the tutorial. My problem is that <code>EVP_BytesToKey</code> was able to derivate both <strong>key</strong> and <strong>IV</strong> from salt and password, where <code>PKCS5_PBKDF2_HMAC</code> only seems to derivate one at a time.</p>
  
  <p>I couldn't find any more information/tutorial on how to get both <strong>key</strong> and <strong>IV</strong>, and tried several implementations, but couldn't find how the openSSL CLI generates the IV.
  I'd really like to avoid to write the IV in either the CLI or the payload, the implementation of the tutorial was really convenient for that.</p>
  
  <p>Could someone help me ?</p>
  
  <p>Thanks, best regards</p>