Open SSL Encrypt & Decrypt Files With Password Using OpenSSL

OpenSSL is a powerful cryptography toolkit that can be used for encryption of files and messages.

If you want to use the same password for both encryption of plaintext and decryption of ciphertext, then you have to use a method that is known as symmetric-key algorithm.

From this article you’ll learn how to encrypt and decrypt files and messages with a password from the Linux command line, using OpenSSL.

HowTo: Encrypt a File

$ openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc
OptionsDescription
openssl OpenSSL command line tool
enc Encoding with Ciphers
-aes-256-cbc The encryption cipher to be used
-salt Adds strength to the encryption
-in Specifies the input file
-out Specifies the output file.

Interesting fact: 256bit AES is what the United States government uses to encrypt information at the Top Secret level.

Warning: The -salt option should ALWAYS be used if the key is being derived from a password.

Without the -salt option it is possible to perform efficient dictionary attacks on the password and to attack stream cipher encrypted data.

 

The reason for this is that without the salt the same password always generates the same encryption key.

 

When the salt is being used the first eight bytes of the encrypted data are reserved for the salt: it is generated at random when encrypting a file and read from the encrypted file when it is decrypted.

HowTo: Decrypt a File

$ openssl enc -aes-256-cbc -d -in file.txt.enc -out file.txt
OptionsDescription
-d Decrypts data
-in Specifies the data to decrypt
-out Specifies the file to put the decrypted data in

Base64 Encode & Decode

 

Base64 encoding is a standard method for converting 8-bit binary information into a limited subset of ASCII characters.

 

It is needed for safe transport through e-mail systems, and other systems that are not 8-bit safe.

By default the encrypted file is in a binary format.

If you are going to send it by email, IRC, etc. you have to save encrypted file in Base64-encode.

Cool Tip: Want to keep safe your private data? Create a password protected ZIP file from the Linux command line. Really easy! Read more →

To encrypt file in Base64-encode, you should add -a option:

$ openssl enc -aes-256-cbc -salt -a -in file.txt -out file.txt.enc
OptionDescription
-a Tells OpenSSL that the encrypted data is in Base64-ensode

Option -a should also be added while decryption:

$ openssl enc -aes-256-cbc -d -a -in file.txt.enc -out file.txt

Non Interactive Encrypt & Decrypt

Warning: Since the password is visible, this form should only be used where security is not important.

By default a user is prompted to enter the password.

If you are creating a BASH script, you may want to set the password in non interactive way, using -k option.

Cool Tip: Need to improve security of the Linux system? Encrypt DNS traffic and get the protection from DNS spoofing! Read more →

Public key cryptography was invented just for such cases.

Encrypt a file using a supplied password:

$ openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc -k PASS

Decrypt a file using a supplied password:

$ openssl enc -aes-256-cbc -d -in file.txt.enc -out file.txt -k PASS
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
logrotate Log Rotate Configuration
Viewed 1082 times since Sun, Jan 12, 2020
SPRAWDZONA KONFIGURACJA RSYSLOG I LOGROTATE, JAKO ZEWNĘTRZNEGO SERWERA SYSLOG
Viewed 1891 times since Fri, Nov 30, 2018
Cron YUM How to use yum-cron to automatically update RHEL/CentOS Linux
Viewed 735 times since Fri, Oct 26, 2018
RHEL: Create a local RPM repository
Viewed 1637 times since Sun, May 27, 2018
List usernames instead of uids with the ps command for long usernames
Viewed 807 times since Wed, Jul 25, 2018
Build a simple RPM that packages a single file
Viewed 1551 times since Sat, Jun 2, 2018
Fałszujemy rozpoznania skanerów #2
Viewed 1353 times since Mon, May 21, 2018
20 Linux YUM (Yellowdog Updater, Modified) Commands for Package Management YUM
Viewed 9555 times since Thu, Oct 25, 2018
Linux Health Check Commands
Viewed 838 times since Fri, Jun 8, 2018
Linux - How to shutdown or reboot
Viewed 711 times since Fri, Jun 8, 2018