I refer to https://www.openssl.org/docs/manmaster/apps/enc.html and see that the only parameter for key derivation which I can set explicitly (not considering the obvious -S for setting salt) is -md which is MD to be used for key derivation algorithm.

Now the question is: what are other implicit parameters for KDF when using OpenSSL in cmd mode? In particular, does it use PBKDF2? And if so - the most important question: what is the default value for number of KDF iterations? I can't find those values.

I am using OpenSSL cmd utility to encrypt plaintexts. The result is decrypted using another crypto library. I need to test password-based encryption in particular.

To make it more clear: I want to save generated salts and passwords, then decrypt ciphertexts with another crypto library which does use PBKDF2 with HMAC_SHAxxx algorithms and gives the opportunity to set number of KDF rounds as well. So I want to have a possibility to derive exactly same keys from passwords and salts as OpenSSL cmd utility does.

Finally, maybe the idea to rely on cmd utility is somewhat bad considering my task. If so, I want to hear your opinion on this, too.

I've got OpenSSL 0.9.8zh 14 Jan 2016 (OS X).


OpenSSL uses EVP_BytesToKey, an algorithm proprietary to OpenSSL, with a salt and an iteration count set to 1. The algorithm is secure; the iteration count of 1 of course is not secure (for passwords with an average strength). Implementations for other languages/runtimes can be found by searching for it by name.

This page (on nabble.com) explains a bit about accessing PBKDF2 from the command line. It also shows that OpenSSL CLI isn't always taken that seriously; it is mainly a cryptographic library that can also be used from the command line.

It is possible to find code to include the iteration count in the CLI in the answers to this question on the security site (not reviewed by me). That code is however specific to private keys encrypted using the PKCS#8 standard.

It could well be that PGP is more suited for end-to-end password encryption (I haven't reviewed it for a while). It was certainly more specifically created for it.

  • $\begingroup$ Well I've checked that example provided by one of nabble.com users and made a command-line utility which uses PKCS5_PBKDF2_HMAC(). Not as easy as I wanted it to be but the stuff is done. Thanks for info. $\endgroup$ – A gee Jun 13 '16 at 20:02
  • $\begingroup$ @Agee I can imagine that's not the way you want things to go, but I'm glad you have got it done. I remember my first assignment at work where I manually re-implemented applet signing because we wanted to use a hardware module to sign - which we didn't get to work with Java. We've all been there I suppose :) $\endgroup$ – Maarten Bodewes Jun 13 '16 at 20:55

For full explanation, see Is there a standard for OpenSSL-interoperable AES encryption? .

Short answer: what openssl enc (without -K for raw) uses is not PBKDF2; it is almost PBKDF1, with iteration count 1. This imposes almost no cost on attacker trials, so unless your passwords are strong enough to be keys by themselves you should avoid it if you can.

In C or C-like code you can just call EVP_BytesToKey; see https://stackoverflow.com/questions/9488919/openssl-password-to-key/ for some example code, or just read the declaration on the manpage. For Java there is a translation in https://stackoverflow.com/questions/11783062/how-to-decrypt-file-in-java-encrypted-with-openssl-command-using-aes but if you can use third-party cryptoproviders, http://www.BouncyCastle.org has SecretKeyFactory OpenSSLPBKDF plus prebuilt Cipher's PBEwithMD5and{128,192,256}bitAES-CBC-OPENSSL.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.