6.1.2. PBES1 Decryption Operation

The decryption operation for PBES1 consists of the following steps, which decrypt a ciphertext C under a password P to recover a message M:

Obtain the eight-octet salt S and the iteration count c.
Apply the PBKDF1 key derivation function (Section 5.1) to the password P, the salt S, and the iteration count c to produce a derived key DK of length 16 octets:
```
DK = PBKDF1 (P, S, c, 16)
```
Separate the derived key DK into an encryption key K consisting of the first eight octets of DK and an initialization vector IV consisting of the next eight octets:
```
K = DK<0..7>
IV  = DK<8..15>
```
Decrypt the ciphertext C with the underlying block cipher (DES or RC2) in CBC mode under the encryption key K with initialization vector IV to recover an encoded message EM. If the length in octets of the ciphertext C is not a multiple of eight, output "decryption error" and stop.
Separate the encoded message EM into a message M and a padding string PS:
```
EM = M || PS
```
where the padding string PS consists of some number psLen octets each with value psLen, where psLen is between 1 and 8. If it is not possible to separate the encoded message EM in this manner, output "decryption error" and stop.
Output the recovered message M.

6.1.2. PBES1 Decryption Operation​