Skip to content

Dynamic IV Extraction During Decryption #6

Description

@Vishnubandlamudi

Context & Use Case
I am setting up an encryption/decryption pipeline where logs/data are encrypted upstream using vector.dev before reaching Splunk.

Encryption Algorithm: AES-256-CBC with PKCS7 padding.

Secret Key: Static key (configured in TA_cryptosuite).

IV Strategy: Dynamic per-message IV generated via iv = random_bytes(16) in Vector, which is prepended to the ciphertext/encrypted payload before Base64 encoding (or handled alongside the payload).

Question / Feasibility
Is it feasible with TA_cryptosuite to configure only the static secret key in the add-on settings, and dynamically extract/evaluate the IV directly from the encrypted field (e.g., parsing the first 16 bytes of the decoded payload) during the Splunk decryption search command?

Desired Workflow Example
Upstream (Vector):
IV = random_bytes(16)
Ciphertext = encrypt_aes_256_cbc(data, key, IV)
Payload = base64_encode(IV + Ciphertext)
Splunk Search (TA_cryptosuite):
Extract/pass the IV dynamically from the field during decryption without needing a separate static IV configured per key/app.

Does TA_cryptosuite currently support extracting/evaluating dynamic IVs from the encrypted field directly, or could support/a syntax pattern for this be added?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions