When using openssl or libressl to encrypt or decrypt data with AES, I typically specify -iter 1000000 -pbkdf2 to explicity force the key derivation method.

However I'm currently dealing with a remote system that has an older openssl version (openssl version says OpenSSL 1.0.2k-fips 26 Jan 2017) and it doesn't support the -iter or -pbkdf2 parameters.

If I encrypt a plaintext file on the old machine like this:

openssl enc -aes-256-cbc -salt -md sha512 -pass file:MySecretKey -in plain.txt -out cipher.bin

I can decrypt the result on newer systems like so:

libressl enc -d -aes-256-cbc -md sha512 -pass file:MySecretKey -in cipher.bin

The latter gives me a warning though:

*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.

However it does output the correct plaintext result.

I'm wondering, if not PBKDF2, what kind of key derivation method is used by the old openssl?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.