Understanding how password based encryption works

Question

I want to understand how password based encryption works. As I know the password is used to generate just the key. There is also an always random salt, which is user for the avoidance of dictionary attacks and not letting bad guys to get the hash of the password. So the password and the salt are creating a Key, which can be used for the encryption. After the key is created it is used by the cipher object.

But what I do not understand is the specification of the PBE methods. Lets say we have – PBEWithSHAAnd128BitAES-CBC-BC. From the name of this I understand, that the key is 128Bit and can be used for AES. Also the key is hashed with SHA and the provider is Bouncy Castle. But what I do not understand, how the CBC goes into the naming? Does it say, that I may be allowed to use this key just for CBC? But when I try to use it with CTS mode or OFB, everything works fine. So why does the block mode stand there? Or do I misunderstand the whole thing?

Answer 1

The algorithm definition here is for password based encryption (as the name perhaps obviously implies) and not just password based key derivation.

So Bouncy Castle is providing not only a way to derive a key, but also the ability to encrypt data, and in this case would use AES-128 in CBC mode to do so.

If you only care about the key derivation part, you can use the resulting 128-bit key with any cryptosystem that accepts a random 128-bit key. No need to limit it CBC mode, or even to AES.