I'm trying to encrypt a file using DES in CBC mode but when I try to specify the key derivation function it tells me my command is wrong. It only fails when I try specify the KDF and works when I don't. This is the command i'm trying to use - openssl enc -des-cbc -pbkdf2 -in test.txt -out test.bin -pass pass:test

This command is taken directly from my reference so why does it not pick up the KDF? Is it because i'm using the wrong version of openssl (LibreSSL 2.6.4) or do I have to manually add pbkdf2? If so how do I?

  • 3
    $\begingroup$ You're actually asking about the commandline utility openssl, which is a very different thing from the OpenSSL (or derivative like LibreSSL) suite. OpenSSL library has included PBKDF2 for about 20 years, and has supported it for PKCS8 key files, although as ZT answers using it in commandline enc is very recent. Also to be clear even if you use PBKDF2 and a good password, anything encrypted this century in single-DES is easily broken. $\endgroup$ – dave_thompson_085 Apr 28 '19 at 1:57

LibreSSL enc docs: https://man.openbsd.org/openssl.1#ENC

OpenSSL enc docs for version 1.1.1 : https://www.openssl.org/docs/man1.1.1/man1/enc.html

Both support pbkdf2. I am kinda surprised LibreSSL still supports DES, I would not support it. Can you paste the exact error you're getting?


The changelog of libressl says pbkdf2 support was added in version 2.9.1 (latest current version).

Comparing the openssl 1.1.1 man page above with the openssl 1.1.0 enc man page, I see pbkdf2 support was added in version 1.1.1 (latest current stable version).

You're trying to use a very new feature.

| improve this answer | |
  • $\begingroup$ Hamish$ openssl enc -des-cbc -pbkdf2 -in ciphers.txt -out test.bin -pass pass:test usage: enc -ciphername [-AadePp] [-base64] [-bufsize number] [-debug] $\endgroup$ – Hamish Apr 28 '19 at 1:26
  • $\begingroup$ It basically just prints out the usage as if the command is malformed $\endgroup$ – Hamish Apr 28 '19 at 1:26
  • $\begingroup$ Output of openssl version -a? $\endgroup$ – Z.T. Apr 28 '19 at 1:27
  • $\begingroup$ LibreSSL 2.6.4 built on: date not available platform: information not available options: bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) blowfish(idx) compiler: information not available OPENSSLDIR: "/private/etc/ssl" $\endgroup$ – Hamish Apr 28 '19 at 1:29
  • $\begingroup$ I'm gonna try using a different distribution of openssl on vm fusion maybe that will change something. $\endgroup$ – Hamish Apr 28 '19 at 1:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.