title: Get AES Key from EVP_CIPHER_CTX
body: <p>I'm using openssl trying to use an RSA public key, to encrypt an AES key, and use that AES to send  large-ish data over HTTP(s) to a 3rd party site. I know that's a lot of encryption, the second layer comes when the network is down, and the data has to be cached on disk until it can be <code>POST</code>ed.</p>
  
  <p>I've been using the example code from <a href="http://saju.net.in/blog/?p=36" rel="nofollow">this blog</a>, a chunk of which is inlined below:</p>
  
  <pre><code>int aes_init(unsigned char *key_data, int key_data_len, unsigned char *salt, EVP_CIPHER_CTX *e_ctx)
  {
    int i, nrounds = 5;
    unsigned char key[32], iv[32];
    /*
     * Gen key &amp; IV for AES 256 CBC mode. A SHA1 digest is used to hash the supplied key material.
     * nrounds is the number of times the we hash the material. More rounds are more secure but
     * slower.
     */
    i = EVP_BytesToKey(EVP_aes_256_cbc(), EVP_sha1(), salt, key_data, key_data_len, nrounds, key, iv);
    if (i != 32) {
      printf("Key size is %d bits - should be 256 bits\n", i);
      return -1;
    }
    for(int x = 0; x&lt;32; ++x)
      printf("Key: %x iv: %x \n", key[x], iv[x]);
    for(int x = 0; x&lt;8; ++x)
      printf("salt: %x\n", salt[x]);
    EVP_CIPHER_CTX_init(e_ctx);
    EVP_EncryptInit_ex(e_ctx, EVP_aes_256_cbc(), NULL, key, iv);
    return 0;
  }
  </code></pre>
  
  <p>I'd like to stick with his <code>aes_init()</code> function, but I can't find a way to get the key out of the <code>EVP_CIPHER_CTX</code> once it has been initialised.</p>
  
  <p><code>apropos</code> lists a few functions relating to <code>EVP_CIPHER_CTX</code>:</p>
  
  <pre><code>$ apropos EVP_CIPHER_CTX
  EVP_CIPHER_CTX_block_size (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_cipher (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_cleanup (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_ctrl (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_flags (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_get_app_data (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_init (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_iv_length (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_key_length (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_mode (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_nid (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_set_app_data (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_set_key_length (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_set_padding (3ssl) - EVP cipher routines
  EVP_CIPHER_CTX_type (3ssl) - EVP cipher routines
  </code></pre>
  
  <p><code>EVP_CIPHER_CTX_set_key_length</code> looks promising, but is there then some magical offset from which I have to read the <code>EVP_CIPHER_CTX</code>? Otherwise, I'll have to modify his function to return the <code>key</code> (and the <code>iv</code>), or throw away the function and inline the code.</p>
  
  <p>The end goal here is to encrypt a large portion of data using AES, and encrypt the AES key using our RSA public key, base64 encode both, and broadcast them to the server. (Which I believe is the correct way of doing things)</p>
  
  <p>The only issue then, is extracting the key from the <code>EVP_CIPHER_CTX</code>.</p>