Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to encrypt a file using AES-256. How can I do that quickly and easily, and how can I - or someone else -decrypt it again?

share|improve this question
add comment

4 Answers

up vote 43 down vote accepted

If you want the encryption to be platform independent, you can use openssl:

  • Encryption:

    openssl aes-256-cbc -in attack-plan.txt -out message.enc

  • Decryption:

    openssl aes-256-cbc -d -in message.enc -out plain-text.txt

You can get openssl to base64-encode the message by using the -a switch on both encryption and decryption. This way, you can paste the ciphertext in an email message, for example. It'll look like this:

stefano:~$ openssl aes-256-cbc -in attack-plan.txt -a
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
U2FsdGVkX192dXI7yHGs/4Ed+xEC3ejXFINKO6Hufnc=

Note that you have a choice of ciphers and modes of operation. For normal use, I recommend aes 256 in CBC mode. These are the ciphers modes you have available (only counting AES):

aes-128-cbc ← this is okay
aes-128-ecb
aes-192-cbc
aes-192-ecb
aes-256-cbc ← this is recommended
aes-256-ecb

See also:

Please note:

OpenSSL will ask you for a password. This is not an encryption key, it is not limited to 32 bytes! If you're going to transfer files with someone else, your shared secret should be very strong. You can use this site to get a sense of how good your password is:

share|improve this answer
7  
openssl aes-256-cbc is shorter than openssl enc -aes-256-cbc and works too. The manual page for this is available by running man enc. Never use ecb for data that should not be tempered with, always use cbc. -salt is redundant since it's default. If you omit -out filename the output will be written to standard output which is useful if you just need to analyze data, but not write it to disk. THe next command shows the line cound for the plaintext: openssl aes-256-cbc -d -in filename | wc -l. (another use, reading a file: openssl aes-256-cbc -d -in filename | less) –  Lekensteyn Sep 9 '11 at 16:37
    
Thanks @Lekensteyn! I incorporated some of that into the answer. –  Stefano Palazzo Sep 10 '11 at 15:19
1  
I use almost exactly this in a script : /usr/bin/openssl enc -aes-256-cbc -a -salt -in $1 -out ${1}.enc with the reverse as you would expect. –  belacqua Sep 11 '11 at 0:29
add comment

7z (when the password option is used) uses a 256bit AES encryption (with SHA256 key stretching).

Install it (p7zip-full), right click on a file or directory you want to encrypt, and choose Compress, .7z and Other options /Password.

enter image description here

For decryption, right click on the .7z file and choose Extract here.

share|improve this answer
add comment

aescrypt

The linked website contains an open-source 256-bit aes encrypt/decrypt tool and is multiplatform - MacOs, Windows, Linux and others through Java.

Encrypt: aescrypt -e -p <password_message> <file>

Decrypt: aescrypt -d -p <password_message> <file>

You could backup and encrypt your home folder using the syntax:

tar -cvf - /home/<home_folder> | aescrypt -e -p <password_message> - > backup.tar.aes

ubuntu installation

Download and extract the source

make
sudo make install

other platforms

Download the binaries or source-code from the website.

share|improve this answer
add comment

download Truecrypt, make your own container or encrypt your files. works fine in windows and linux.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.