51

When I encrypt or decrypt a file I get:

*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.


I do not understand what this means, and how I should change my procedure.

Thus far, I encrypted with:

openssl des3 <input >output.des3

and decrypt with:

openssl des3 -d <input.des3 >output

OS: Ubuntu 18.10

$ openssl version
OpenSSL 1.1.1  11 Sep 2018
6
  • 1
    3DES as an encryption method is being retired. The warning is just suggesting you use another method, maybe refer to crypto.stackexchange.com/questions/51629/… for more details.
    – guiverc
    Nov 17, 2018 at 0:05
  • 1
    That error happens for any kind of ciphers. You need to add -pbkdf2 to both encrypt and decrypt commands. Dec 30, 2018 at 16:58
  • Sorry, but could you please give an example of how to add -pbkdf2 to the commands? I don't understand how it should be added. Jan 1, 2019 at 20:18
  • 1
    In your example, you just need to do openssl des3 -e -pbkdf2 < input > output.des3 and openssl des3 -d -pbkdf2 < input.des3 > output. I also happen to agree with the first comment that you should use a different block cipher instead of 3DES (DES is from 1977), an easy way to do that is just to swap in aes256 where you currently have des3 in those commands, to use AES (256-bit AES meets current security standards).
    – joelhardi
    Jan 3, 2019 at 5:05
  • 1
    What gets me is they added a nice option, but then do not tell you what the default iteration count is, or how to make proper use of it!
    – anthony
    Feb 6, 2020 at 6:31

2 Answers 2

39

Comparing the Synopsys of the two main and recent versions of OpenSSL, let me quote the man pages.

OpenSSL 1.1.0

openssl enc -ciphername [-help] [-ciphers] [-in filename] [-out filename] [-pass arg] [-e] [-d] [-a/-base64] [-A] [-k password] [-kfile filename] [-K key] [-iv IV] [-S salt] [-salt] [-nosalt] [-z] [-md digest] [-p] [-P] [-bufsize number] [-nopad] [-debug] [-none] [-engine id]

OpenSSL 1.1.1

openssl enc -cipher [-help] [-ciphers] [-in filename] [-out filename] [-pass arg] [-e] [-d] [-a] [-base64] [-A] [-k password] [-kfile filename] [-K key] [-iv IV] [-S salt] [-salt] [-nosalt] [-z] [-md digest] [-iter count] [-pbkdf2] [-p] [-P] [-bufsize number] [-nopad] [-debug] [-none] [-rand file...] [-writerand file] [-engine id]

There obviously are some greater differences, namely considering this question, there are these two switches missing in the 1.1.0:

  • pbkdf2

  • iter


You have basically two options now. Either ignore the warning or adjust your encryption command to something like:

openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 1000000 -salt -in InputFilePath -out OutputFilePath

Where these switches:

  • -aes-256-cbc is what you should use for maximum protection or the 128-bit version; the 3DES (Triple DES) got abandoned some time ago, see Triple DES has been deprecated by NIST in 2017, while AES gets accelerated by all modern CPUs by a lot; you can simply verify if your CPU has the AES-NI instruction set for example using grep aes /proc/cpuinfo; win, win

  • -md sha512 is a bit the faster variant of SHA-2 functions family compared to SHA-256 while it might be a bit more secure; win, win, but that likely changes with the new SHA instruction set in modern CPUs

  • -pbkdf2: use PBKDF2 (Password-Based Key Derivation Function 2) algorithm

  • -iter 1000000 is overriding the default count of iterations (which is 10000) for the password, quoting the man page:

    Use a given number of iterations on the password in deriving the encryption key. High values increase the time required to brute-force the resulting file. This option enables the use of PBKDF2 algorithm to derive the key.


The default value of iterations is not documented, but specified in apps/enc.c file like this:

case OPT_PBKDF2:
    pbkdf2 = 1;
    if (iter == 0)
        iter = 10000;
    break;

Decryption is issued simply by adding -d switch to the end of the original command-line.

1
  • 1
    These commands were helpful for me: openssl enc -base64 -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 -e -in plaintext.txt -out encrypted.txt and openssl enc -base64 -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 -d -in encrypted.txt -out decrypted.txt. But I'm worried about vulnerabilities: stackoverflow.com/a/16056298/470749
    – Ryan
    Mar 7, 2023 at 21:58
6

The other answer is essentially correct. though other things have changed around these versions (v1.1.0 and v1.1.1) that is good to be aware of.

First the default password hashing digest has changed, going from md5 to sha512

And second the addition the "-pbkdf2" "-iter" which has been needed for a long time. However the default iteration count is far too low, and should be set as high as possible without becoming too annoying. Big enough to take 1 to 2 seconds is generally acceptable for both encrypting and decrypting, but makes it very very difficult for brute forced password guessing.

The problem is now we have all these new options and defaults, as well as different digests and cyphers, you need to remember all these options do you can decrypt the encrypted file. That is whatever options was decided on to encrypt must be used to decrypt. However openssl only stores some 'file magic' (EG "Salted__" at the start of the file), and the random "salt" that was used, with the encrypted file. It leaves it up to you to remember everything else!

Aespipe is a old program that got around this by saving some of this information as a extra header to the encrypted data, but it is now becomming dated, and its format does not allow for the new options, or for easy expansion.

As a alternative I have been creating a new script "keepout" as a wrapper around "openssl enc" to save those extra options that is needed to remember how to decrypt that specific file, even as newer options, cyphers, or larger iterations are used when encrypting. Basically it saves the openssl option needed with the data.

https://antofthy.gitlab.io/software/#keepout

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .