That is why if you have these thee letters anywhere in your code AES then you are probably vulnerable. If you want to do it right you have few options:
Doing crypto on your own is enormously hard.
This is so interesting! Thanks for sharing that about CBC, I learned something new too!
I like that you pointed to more resources in your follow up comment, since knowing what not to do is only have the battle 
Agreed mostly, if you’re going to use AES, make sure it is AES-GCM. However, more people seem to be advocating for XSalsa20-Poly1305 these days. Use libsodium or NaCl bindings if you can. Write the least amount of code to interface with existing battle tested libraries.
If you find yourself actually implementing algorithms and you’ve never done it before stop. You’re 100% likely to do something incorrectly and your system will be insecure.
Just be aware, that it applies to all unauthenticated encryption, not only CBC. Of course you can build authenticated protocol using CBC, but that is still full of pitfalls.
Small correction, XChaCha20 not XSalsa20. The difference is compression function that optimises better on the X86-64 CPUs, as there is reduced dependency between rows. However XChaCha20 is still not standardised by IETF and due to that is not included in OpenSSL.
That.
Actually not really. Implementing most of the cryptographic primitives (with exception to AES due to the design issues) is quite easy and straightforward. What is hard is how to implement protocols, as this is where most of the cryptographic problems is happening. Erlang has quite nice API for using the primitives, which is simple, the hard part is how to join primitives with other to have secure protocol.
I know I’m a bit late to the game here … but I spent all day trying to port this related (and reasonably-looking NodeJS call):
const decryptedData = CryptoJS.AES.decrypt(
ciphertext,
passphrase
).toString(CryptoJS.enc.Utf8);
to Elixir. In my case I was passing in a Base64 encoded string with a Salted prefix.
In crypto-js there’s a function called parse:
https://github.com/brix/crypto-js/blob/develop/src/cipher-core.js#L610
My implementation (thanks a lot @mattbaker for your help):
defmodule SSODecryption do
def parse(openSSLStr) do
{:ok, ciphertext_b64} = Base.decode64(openSSLStr)
<<salted_indicator::binary-size(8), salt::binary-size(8), ciphertext::binary>> =
ciphertext_b64
case salted_indicator do
"Salted__" ->
{salt, ciphertext}
_ ->
{:error, "No salt found"}
end
end
def parse_and_decrypt(openSSLStr, passphrase, algo \\ :aes_256_cbc) do
case parse(openSSLStr) do
{:error, reason} ->
{:error, reason}
{salt, ciphertext} ->
{key, iv} = derive_key_and_iv(passphrase, salt)
perform_decryption(ciphertext, iv, key, algo)
end
end
defp derive_key_and_iv(passphrase, salt) do
# Concatenate the passphrase and salt as the starting point for hash computations.
passphrase_salt = passphrase <> salt
# Compute the first hash using the passphrase and salt.
a = :crypto.hash(:md5, passphrase_salt)
# For subsequent hashes, concatenate the result of the previous hash with the original passphrase and salt.
b = :crypto.hash(:md5, a <> passphrase_salt)
c = :crypto.hash(:md5, b <> passphrase_salt)
# The IV is derived from the first two hash outputs.
iv = a <> b
# The key is derived from the third hash output.
key = c
{key, iv}
end
defp perform_decryption(ciphertext, iv, key, algo) do
try do
case :crypto.crypto_one_time(algo, iv, key, ciphertext,
encrypt: false,
padding: :pkcs_padding
) do
result when is_binary(result) ->
case Jason.decode(result) do
{:ok, decoded} -> {:ok, decoded}
{:error, _reason} -> {:error, "Failed to decode JSON"}
end
_reason ->
{:error, "Decryption failed for an unknown reason"}
end
rescue
_exception ->
{:error, "Decryption failed"}
end
end
end
I’m not positive about the error handling and it only works for the salted case right now, but it seems to let me move some NodeJS code away. Thanks again for the answers on this thread.