I am writing a small class to add to my application that will handle things like config secrets. (I don't want to get into this topic as a lot of research has gone into the approach we've decided to take for this.)
One of the requirements is to encrypt file secrets. (Think a TLS certificate key or PGP secret key.) I am able to generate (and decrypt) a secret key that can be used to encrypt/decrypt the files outside of the application using the AWS KMS service. (See this for information about what this actually returns: https://docs.aws.amazon.com/cli/latest/reference/kms/generate-data-key.html)
So, to my way of thinking that just means I need to store the encrypted version of the key along with the file so that I can decrypt the key, use it to decrypt the file when it is used.
My confusion comes from the use of the openssl encrypt/decrypt functions on the file data due to the IV. I've read a lot about IV over the last couple of days and understand its general purpose, but am left with a number of questions attempting to reconcile this with what I see in the "real world".
When I use openssl from a command line to encrypt a file I've read to use this:
openssl aes-256-cbc -salt -in secrets.txt -out secrets.txt.enc
Notice there is no IV passed in, though the -salt parameter may serve a similar purpose?
But when I decrypt the same file I use a command like this:
openssl aes-256-cbc -d -in secrets.txt.enc -out secrets.txt.new
Notice no -salt parameter, no IV, or anything of that nature, so how is it able to decrypt the file without that information?
In the openssl encrypt/decrypt functions in PHP, and other discussions around IV, it sounds highly recommended to use an IV when encrypting data, which then suggests I need to store/use the IV when decrypting it as well, but this isn't being done from the command line, so how is that working? Is the command line above less secure for that? Do I not need to use an IV based on the fact that each file will have its own secure encryption key?