Am learning OpenSSL EVP API and trying to understand the ways to generate a symmetric key using OpenSSL EVP in C++ program.
I have two questions in this regard: 1) To understand what the command openssl enc -aes-256-cbc -k secret -P -md sha1 does? It printed salt, key, and IV. I mean the -aes-256-cbc option to enc is not doing anything in generating the salt, key, IV as we are using -P option. Please correct me if wrong.
2) To generate a symmetric key as above using OpenSSL EVP functions, I assume below sequence of steps. Please correct me if missed any. Is there any flaw in doing like this for a symmetric key?
1) generates a random number 2) apply the HMAC on the passphrase by using this random number as the key.