I'm trying to encrypt a file using DES in CBC mode but when I try to specify the key derivation function it tells me my command is wrong. It only fails when I try specify the KDF and works when I don't. This is the command i'm trying to use - openssl enc -des-cbc -pbkdf2 -in test.txt -out test.bin -pass pass:test

This command is taken directly from my reference so why does it not pick up the KDF? Is it because i'm using the wrong version of openssl (LibreSSL 2.6.4) or do I have to manually add pbkdf2? If so how do I?


closed as off-topic by Squeamish Ossifrage, kelalaka, Maarten Bodewes Apr 28 at 23:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm, protocol or side-channel (mitigation) works, you should look into asking on Stack Overflow instead." – Squeamish Ossifrage, kelalaka, Maarten Bodewes
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    $\begingroup$ You're actually asking about the commandline utility openssl, which is a very different thing from the OpenSSL (or derivative like LibreSSL) suite. OpenSSL library has included PBKDF2 for about 20 years, and has supported it for PKCS8 key files, although as ZT answers using it in commandline enc is very recent. Also to be clear even if you use PBKDF2 and a good password, anything encrypted this century in single-DES is easily broken. $\endgroup$ – dave_thompson_085 Apr 28 at 1:57

LibreSSL enc docs: https://man.openbsd.org/openssl.1#ENC

OpenSSL enc docs for version 1.1.1 : https://www.openssl.org/docs/man1.1.1/man1/enc.html

Both support pbkdf2. I am kinda surprised LibreSSL still supports DES, I would not support it. Can you paste the exact error you're getting?


The changelog of libressl says pbkdf2 support was added in version 2.9.1 (latest current version).

Comparing the openssl 1.1.1 man page above with the openssl 1.1.0 enc man page, I see pbkdf2 support was added in version 1.1.1 (latest current stable version).

You're trying to use a very new feature.

  • $\begingroup$ Hamish$ openssl enc -des-cbc -pbkdf2 -in ciphers.txt -out test.bin -pass pass:test usage: enc -ciphername [-AadePp] [-base64] [-bufsize number] [-debug] $\endgroup$ – Hamish Apr 28 at 1:26
  • $\begingroup$ It basically just prints out the usage as if the command is malformed $\endgroup$ – Hamish Apr 28 at 1:26
  • $\begingroup$ Output of openssl version -a? $\endgroup$ – Z.T. Apr 28 at 1:27
  • $\begingroup$ LibreSSL 2.6.4 built on: date not available platform: information not available options: bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) blowfish(idx) compiler: information not available OPENSSLDIR: "/private/etc/ssl" $\endgroup$ – Hamish Apr 28 at 1:29
  • $\begingroup$ I'm gonna try using a different distribution of openssl on vm fusion maybe that will change something. $\endgroup$ – Hamish Apr 28 at 1:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.