OpenSSL is a powerful cryptography toolkit that can be used for encryption of files and messages.
If you want to use the same password for both encryption of plaintext and decryption of ciphertext, then you have to use a method that is known as symmetric-key algorithm.
From this article you’ll learn how to encrypt and decrypt files and messages with a password from the Linux command line, using OpenSSL.
HowTo: Encrypt a File
$ openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc
| Options | Description |
|---|---|
| openssl | OpenSSL command line tool |
| enc | Encoding with Ciphers |
| -aes-256-cbc | The encryption cipher to be used |
| -salt | Adds strength to the encryption |
| -in | Specifies the input file |
| -out | Specifies the output file. |
Interesting fact: 256bit AES is what the United States government uses to encrypt information at the Top Secret level.
Warning: The -salt option should ALWAYS be used if the key is being derived from a password.
Without the -salt option it is possible to perform efficient dictionary attacks on the password and to attack stream cipher encrypted data.
When the salt is being used the first eight bytes of the encrypted data are reserved for the salt: it is generated at random when encrypting a file and read from the encrypted file when it is decrypted.
HowTo: Decrypt a File
$ openssl enc -aes-256-cbc -d -in file.txt.enc -out file.txt
| Options | Description |
|---|---|
| -d | Decrypts data |
| -in | Specifies the data to decrypt |
| -out | Specifies the file to put the decrypted data in |
Base64 Encode & Decode
It is needed for safe transport through e-mail systems, and other systems that are not 8-bit safe.
By default the encrypted file is in a binary format.
If you are going to send it by email, IRC, etc. you have to save encrypted file in Base64-encode.
Cool Tip: Want to keep safe your private data? Create a password protected ZIP file from the Linux command line. Really easy! Read more →
To encrypt file in Base64-encode, you should add -a option:
$ openssl enc -aes-256-cbc -salt -a -in file.txt -out file.txt.enc
| Option | Description |
|---|---|
| -a | Tells OpenSSL that the encrypted data is in Base64-ensode |
Option -a should also be added while decryption:
$ openssl enc -aes-256-cbc -d -a -in file.txt.enc -out file.txt
Non Interactive Encrypt & Decrypt
Warning: Since the password is visible, this form should only be used where security is not important.
By default a user is prompted to enter the password.
If you are creating a BASH script, you may want to set the password in non interactive way, using -k option.
Cool Tip: Need to improve security of the Linux system? Encrypt DNS traffic and get the protection from DNS spoofing! Read more →
Public key cryptography was invented just for such cases.
Encrypt a file using a supplied password:
$ openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc -k PASS
Decrypt a file using a supplied password:
$ openssl enc -aes-256-cbc -d -in file.txt.enc -out file.txt -k PASS
I have used the last command line to decrypt a file but my lecturer hinted that I need to use a parameter related to encoding. What is it? The code is base64.
if I understand your question correctly you need to add
-ato your command for input in base64 formatThanks! That was super helpful.
with -k password it is showing “error in input file”
sintax to decript a message
im trying to decrypt without specifying the file name as i want to do a whole folder and decrypt an encrypted folder via bash script.
it gives an error message
error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
Help would be appreciated!
I encrypted a .dmg file using openssl encryption on my Macbook Pro, keeping the output name the same as the input name. I didn’t know this would be problematic, as I am now unable to decrypt the .dmg file even with the correct password.
Some folks say it could not be done, but it seemed to have worked for me. Now, I can’t open the file and am afraid it will be impossible to decrypt.
Note: If I use the same code, but change the output name, it can decrypt just fine. My issue was that I encrypted the file using the same output name as the input, which has made it impossible for me to decrypt it.
Here’s what the code looks like:
openssl enc -aes-256-cbc -d -in /Users/huntert/Desktop/IMPT.dmg -out /Users/huntert/Desktop/IMPT.dmg
enter aes-256-cbc encryption password:
Verifying – enter aes-256-cbc encryption password:
When I tried to decrypt it, I received the folllowing messages:
enter aes-256-cbc decryption password:
error reading input file
I should’ve been more cautious and tried it on a rubbish file. Lesson learned.
Hello, the option to give the password is
-pass pass:
or
-pass file:
works for ecoding & decoding
hi,
I have a problem to decrypt a file
I have encrypted my file after I used this file in matlab (modulation ..) and then I cannot decrypt the extracted file from matlab
error is ” error reading file ”
what I have to do ?
hello,
thank you for this, very helpful.
one thing I ask, where do I get the openssl (I assume executable) from to run the encrypt and decrypt?
Neil
Hello, how are you? I have an encrypted file which I forgot the password, it is a file (.evp), what command line do I get to decrypted it?
Hello everybody,
I’m tring to find out if will possible to decrypt a directory with a certificate private with open SSL.
If you want a solution i’m here
Thanks
Kurtis
Hello Thanks for this article.
But how do we do this programmatically? I’ve a situation where I need to use a password to login to a server programmatically. We cannot hard code the password to decrypt the file. One option I know is to store the password in a vault but that takes too long/expensive to implement. Please suggest. thanks
Hi,
I used to deploy encrypted bash programs to production using openssl.
I suggest looking at https://linuxconfig.org/using-openssl-to-encrypt-messages-and-files-on-linux
Or,
If your program is compiled code, then why not encrypt secret in a file (manually) then decrypt it in your code into a variable? Then, you can programmatically use it as input to your authentication process.
Hope this helps.
Here is a sample code in GNU-C:
//------------------------------------ int main (int argc, char *argv[], char *envp[]) { char *cmdstr = (char *) malloc (254); memset(cmdstr, '\0', sizeof(254)); /* build the command string for encryption */ strcpy(cmdstr, "openssl enc -aes-256-cbc -in file.txt -out file.txt.enc -iter 29 -pass pass:mysecret"); /* encrypt */ if (run_my_script (cmdstr) == -1) fprintf(stderr, "Failed to encrypt file\n"); /* rebuilt the command string for decryption */ strcpy(cmdstr, "openssl enc -aes-256-cbc -d -in file.txt.enc -out decrypted_file.txt -iter 29 -pass pass:mysecret"); /* decrypt */ if (run_my_script (cmdstr) == -1) fprintf(stderr, "Failed to decrypt file.txt.enc\n"); free(cmdstr); return 0; } int run_my_script (const char *command) { int status; pid_t pid; pid = fork (); if (pid == 0) { /* This is the child process. Execute the shell command. */ execl (SHELL, SHELL, "-c", command, NULL); _exit (EXIT_FAILURE); } else if (pid < 0) /* The fork failed. Report failure. */ status = -1; else /* This is the parent process. Wait for the child to complete. */ if (waitpid (pid, &status, 0) != pid) status = -1; return status; }opriont
-iter# is neede.g.
ENCRYPT (interactive):
DECRYPT (interactive):
ENCRYPT (non-interactive):
DECRYPT (non-interactive):
Is possible to know what was the key length used in a encrypted file?
The iteration count is for the PBKDF2 hashing algorithm that is designed to make password cracking much much harder. Using a low iteration count like 29 is not very useful. The count should be made as large as you can without it becoming too annoying (1 to 2 seconds of iteration). The current default of 10000 is var too low, even when it was released! 500000 or higher is better.
I have done:
guy@clarke:~$ openssl enc -aes-256-cbc -a -salt -pbkdf2 -in file.txt.enc -out file.txt
enter aes-256-cbc encryption password:
Verifying – enter aes-256-cbc encryption password:
guy@clarke:~$ openssl enc -aes-256-cbc -d -a -in file.txt.enc -out file.txt
enter aes-256-cbc decryption password:
error reading input file
A. text in file.txt.enc to be encoded in file.txt:
https://gist.github.com/corvax19/4275922
B. resulting encoded in file.txt
U2FsdGVkX19hus8SHsZ2WKpla8jAjyHi+bFpu77cy15vtKCR5ZNtTLat9/CSEnmX
Ti52Oh5sGthW/OVaE0aNxw==
As you can see the resulting text is split between ‘X’ and ‘T’, that is why there are 2 sequences in the file.txt and the decrypt command fails: ‘error reading input file’.
1. FsdGVkX19hus8SHsZ2WKpla8jAjyHi+bFpu77cy15vtKCR5ZNtTLat9/CSEnmX
2. Ti52Oh5sGthW/OVaE0aNxw==
Is there any solution without losing openssl resource in my script? Thanks.
CLARKE, you can trim space chars:
$ echo -n ‘secret you want encrypted’ | openssl enc -aes-256-cbc -iter 1666 -a -salt -pbkdf2 | base64 | tr -d ‘[:space:]’
enter aes-256-cbc encryption password:
Verifying – enter aes-256-cbc encryption password:
VTJGc2RHVmtYMS83azBCc0lFc096YktqdTdTTWtGaFJYR3NOU0tTbFZQcTJVa0lHRTFsY0w3a0lHZW04dVZ6Vgo=
hi there, wondering if you can encrypt/decrypt using a “key” similar to the one you create when using certificates.
Cheers