Context & Use Case
I am setting up an encryption/decryption pipeline where logs/data are encrypted upstream using vector.dev before reaching Splunk.
Encryption Algorithm: AES-256-CBC with PKCS7 padding.
Secret Key: Static key (configured in TA_cryptosuite).
IV Strategy: Dynamic per-message IV generated via iv = random_bytes(16) in Vector, which is prepended to the ciphertext/encrypted payload before Base64 encoding (or handled alongside the payload).
Question / Feasibility
Is it feasible with TA_cryptosuite to configure only the static secret key in the add-on settings, and dynamically extract/evaluate the IV directly from the encrypted field (e.g., parsing the first 16 bytes of the decoded payload) during the Splunk decryption search command?
Desired Workflow Example
Upstream (Vector):
IV = random_bytes(16)
Ciphertext = encrypt_aes_256_cbc(data, key, IV)
Payload = base64_encode(IV + Ciphertext)
Splunk Search (TA_cryptosuite):
Extract/pass the IV dynamically from the field during decryption without needing a separate static IV configured per key/app.
Does TA_cryptosuite currently support extracting/evaluating dynamic IVs from the encrypted field directly, or could support/a syntax pattern for this be added?
Context & Use Case
I am setting up an encryption/decryption pipeline where logs/data are encrypted upstream using vector.dev before reaching Splunk.
Encryption Algorithm: AES-256-CBC with PKCS7 padding.
Secret Key: Static key (configured in TA_cryptosuite).
IV Strategy: Dynamic per-message IV generated via iv = random_bytes(16) in Vector, which is prepended to the ciphertext/encrypted payload before Base64 encoding (or handled alongside the payload).
Question / Feasibility
Is it feasible with TA_cryptosuite to configure only the static secret key in the add-on settings, and dynamically extract/evaluate the IV directly from the encrypted field (e.g., parsing the first 16 bytes of the decoded payload) during the Splunk decryption search command?
Desired Workflow Example
Upstream (Vector):
IV = random_bytes(16)
Ciphertext = encrypt_aes_256_cbc(data, key, IV)
Payload = base64_encode(IV + Ciphertext)
Splunk Search (TA_cryptosuite):
Extract/pass the IV dynamically from the field during decryption without needing a separate static IV configured per key/app.
Does TA_cryptosuite currently support extracting/evaluating dynamic IVs from the encrypted field directly, or could support/a syntax pattern for this be added?