{
  "schema_version": "1.0.0",
  "record_type": "citation-evidence-pack",
  "pack_id": "openssl-aes-decrypt",
  "title": "OpenSSL AES decrypt compatibility evidence",
  "description": "Reproducible OpenSSL enc envelope outcomes for a valid PBKDF2 recipe, a wrong passphrase, and malformed Base64.",
  "scope": "These cases prove the documented parser and decryption outcomes for the selected synthetic inputs. AES-CBC success is a candidate plaintext, not authenticity proof.",
  "canonical_url": "https://encrypt-online.com/evidence/openssl-aes-decrypt.json",
  "tool": {
    "id": "openssl-aes-decrypt",
    "name": "OpenSSL AES Decrypt",
    "path": "/tools/openssl-aes-decrypt",
    "canonical_url": "https://encrypt-online.com/tools/openssl-aes-decrypt"
  },
  "implementation": {
    "version": "source-sha256:90ec572ae1ac1d21",
    "aggregate_sha256": "90ec572ae1ac1d217e6a1d0704dff42e8660b1fda9107d8a46c61c2f19fe502c",
    "sources": [
      {
        "path": "lib/openssl-aes-diagnostics-core.mjs",
        "sha256": "488d946f98241edbb5dddee3344a549ff3044de66da10be3db5262a40d6026b7"
      },
      {
        "path": "lib/openssl-aes-diagnostics-fixtures.mjs",
        "sha256": "b836b499a67eb53f20b439ff600e18f9aa06f811831ffc5945c03410f5ad078f"
      }
    ]
  },
  "verification": {
    "last_verified": "2026-08-05",
    "command": "npm run check:citation-evidence",
    "environments": [
      "Node.js release check with Web Crypto",
      "Chromium desktop 1440x900 evidence presentation"
    ]
  },
  "standards": [
    {
      "name": "OpenSSL enc command documentation",
      "section": "enc options, PBKDF2, salt, and Base64",
      "url": "https://docs.openssl.org/3.5/man1/openssl-enc/"
    },
    {
      "name": "PKCS #5 v2.1",
      "section": "Section 5.2, PBKDF2",
      "url": "https://www.rfc-editor.org/rfc/rfc8018#section-5.2"
    }
  ],
  "cases": [
    {
      "case_id": "OPENSSL-PBKDF2-SHA256-VALID-001",
      "classification": "valid",
      "symptom": "A salted AES-256-CBC payload should decrypt with the recorded PBKDF2 recipe.",
      "safe_input": {
        "encrypted_base64": "U2FsdGVkX18AESIzRFVmd6AysJr3kjG6ddefhiTwfyQHabJl/YRpf4az+tnwaI1j",
        "passphrase": "browser-only sample",
        "inputEncoding": "base64",
        "saltLength": 8,
        "cipher": "aes-256-cbc",
        "kdf": "pbkdf2",
        "digest": "sha256",
        "iterations": 10000
      },
      "expected_output": {
        "status": "decrypted-with-selected-settings",
        "plaintext_utf8": "OpenSSL compatibility check\n",
        "salt_hex": "0011223344556677",
        "cipher": "aes-256-cbc"
      },
      "failure_code": null,
      "expected_outcome": "Treat the plaintext as a candidate and verify its expected structure or checksum separately.",
      "fixture_sha256": "8cc11115530f729f18bb30d505a9976a415dfd7bc3a4c191af046b131b299522"
    },
    {
      "case_id": "OPENSSL-PASSPHRASE-MISMATCH-002",
      "classification": "mismatch",
      "symptom": "The same envelope is tested with a passphrase that does not match the original recipe.",
      "safe_input": {
        "encrypted_base64": "U2FsdGVkX18AESIzRFVmd6AysJr3kjG6ddefhiTwfyQHabJl/YRpf4az+tnwaI1j",
        "passphrase": "wrong synthetic passphrase",
        "inputEncoding": "base64",
        "saltLength": 8,
        "cipher": "aes-256-cbc",
        "kdf": "pbkdf2",
        "digest": "sha256",
        "iterations": 10000
      },
      "expected_output": {
        "status": "rejected",
        "message": "Decryption did not produce valid AES-CBC padding. The passphrase, cipher, KDF, digest, iterations, salt length, or payload may differ from the selected settings."
      },
      "failure_code": "BAD_DECRYPT",
      "expected_outcome": "Reconstruct every original parameter instead of assuming the passphrase is the only mismatch.",
      "fixture_sha256": "5d45b48fcb359b24ac3a2da51e4d711e70587a9d7f40c73199a37a11bcbc4f49"
    },
    {
      "case_id": "OPENSSL-BASE64-MALFORMED-003",
      "classification": "malformed",
      "symptom": "The payload contains characters outside standard Base64.",
      "safe_input": {
        "encrypted_base64": "***",
        "passphrase": "synthetic",
        "inputEncoding": "base64",
        "saltLength": 8,
        "cipher": "aes-256-cbc",
        "kdf": "pbkdf2",
        "digest": "sha256",
        "iterations": 10000
      },
      "expected_output": {
        "status": "rejected",
        "message": "The payload contains characters that are not valid Base64."
      },
      "failure_code": "INVALID_BASE64",
      "expected_outcome": "Reject before key derivation or AES processing.",
      "fixture_sha256": "c9665fcb049943237b9c6ed996e055e9378092967d36ee34e9549f42ce49f47f"
    }
  ]
}