27

When I encrypt or decrypt a file I get *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better.

I do not understand what this means, how i should change the my procedures. Could you help me? I encrypt with openssl des3 <input >output.des3 and decrypt with openssl des3 -d <input.des3 >output

About the environment

Ubuntu 18.10

~$ openssl version OpenSSL 1.1.1 11 Sep 2018

Improve this question
  • 1
    3DES as an encryption method is being retired. The warning is just suggesting you use another method, maybe refer to crypto.stackexchange.com/questions/51629/… for more details. – guiverc Nov 17 '18 at 0:05
  • 1
    That error happens for any kind of ciphers. You need to add -pbkdf2 to both encrypt and decrypt commands. – Daniele Dellafiore Dec 30 '18 at 16:58
  • Sorry, but could you please give an example of how to add -pbkdf2 to the commands? I don't understand how it should be added. – Tommy Pollák Jan 1 '19 at 20:18
  • 1
    In your example, you just need to do openssl des3 -e -pbkdf2 < input > output.des3 and openssl des3 -d -pbkdf2 < input.des3 > output. I also happen to agree with the first comment that you should use a different block cipher instead of 3DES (DES is from 1977), an easy way to do that is just to swap in aes256 where you currently have des3 in those commands, to use AES (256-bit AES meets current security standards). – joelhardi Jan 3 '19 at 5:05
  • Thanks! Now it works and without warnings using aes256. So the question is answered. – Tommy Pollák Jan 4 '19 at 13:08
17

Comparing the Synopsys of the two main and recent versions of OpenSSL, let me quote the man pages.

OpenSSL 1.1.0

openssl enc -ciphername [-help] [-ciphers] [-in filename] [-out filename] [-pass arg] [-e] [-d] [-a/-base64] [-A] [-k password] [-kfile filename] [-K key] [-iv IV] [-S salt] [-salt] [-nosalt] [-z] [-md digest] [-p] [-P] [-bufsize number] [-nopad] [-debug] [-none] [-engine id]

OpenSSL 1.1.1

openssl enc -cipher [-help] [-ciphers] [-in filename] [-out filename] [-pass arg] [-e] [-d] [-a] [-base64] [-A] [-k password] [-kfile filename] [-K key] [-iv IV] [-S salt] [-salt] [-nosalt] [-z] [-md digest] [-iter count] [-pbkdf2] [-p] [-P] [-bufsize number] [-nopad] [-debug] [-none] [-rand file...] [-writerand file] [-engine id]

There obviously are some greater differences, namely considering this question, there are these two switches missing in the 1.1.0:

  • pbkdf2

  • iter

You have basically two options now. Either ignore the warning or adjust your encryption command to something like:

openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 -salt -in InputFilePath -out OutputFilePath

Where these switches:

  • -aes-256-cbc is what you should use for maximum protection or the 128-bit version, the 3DES (Triple DES) got abandoned some time ago, see Triple DES has been deprecated by NIST in 2017, while AES gets accelerated by all modern CPUs by a lot; you can simply verify if your CPU has the AES-NI instruction set for example using grep aes /proc/cpuinfo; win, win

  • -md sha512 is the faster variant of SHA-2 functions family compared to SHA-256 while it might be a bit more secure; win, win

  • -pbkdf2: use PBKDF2 (Password-Based Key Derivation Function 2) algorithm

  • -iter 100000 is overriding the default count of iterations for the password, quoting the man page:

    Use a given number of iterations on the password in deriving the encryption key. High values increase the time required to brute-force the resulting file. This option enables the use of PBKDF2 algorithm to derive the key.

Improve this answer
  • 2
    Then, how to decrypt it when use openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 1000 -salt -in InputFilePath -out OutputFilePath。 – Ferris Jun 24 '19 at 10:44
  • 2
    By simply adding -d to the command: openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 1000 -salt -d -in InputFilePath – Eduard Itrich Sep 26 '19 at 6:16
  • 2
    I'm pretty sure there are a few issues with this suggestion. As per en.wikipedia.org/wiki/Key_derivation_function you want the slowest variant of key derivation algorithm. In other words don't use sha512 As per en.wikipedia.org/wiki/PBKDF2 in the year 2000 the recommended minimum number of iterations was 1000, but the parameter is intended to be increased over time as CPU speeds increase - so I'd recommend somewhere between 10,000 and 100,000 iterations rather than 1000. – oskarpearson Nov 4 '19 at 10:01
  • @oskarpearson True, I've read it just now. Updating answer. – LinuxSecurityFreak Dec 5 '19 at 11:47
  • @oskarpearson What hash do you recommend then? – anthony Feb 6 '20 at 6:37
2

The other answer is essentially correct. though other things have changed around these versions (v1.1.0 and v1.1.1) that is good to be aware of.

First the default password hashing digest has changed, going from md5 to sha512

And second the addition the "-pbkdf2" "-iter" which has been needed for a long time. However the default iteration count is far too low, and should be set as high as possible without becoming too annoying. Big enough to take 1 to 2 seconds is generally acceptable for both encrypting and decrypting, but makes it very very difficult for brute forced password guessing.

The problem is now we have all these new options and defaults, as well as different digests and cyphers, you need to remember all these options do you can decrypt the encrypted file. That is whatever options was decided on to encrypt must be used to decrypt. However openssl only stores some 'file magic' (EG "Salted__" at the start of the file), and the random "salt" that was used, with the encrypted file. It leaves it up to you to remember everything else!

Aespipe is a old program that got around this by saving some of this information as a extra header to the encrypted data, but it is now becomming dated, and its format does not allow for the new options, or for easy expansion.

As a alternative I have been creating a new script "keepout" as a wrapper around "openssl enc" to save those extra options that is needed to remember how to decrypt that specific file, even as newer options, cyphers, or larger iterations are used when encrypting. Basically it saves the openssl option needed with the data.

https://antofthy.gitlab.io/software/#keepout

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.