1
$\begingroup$

I'm trying to encrypt a file using DES in CBC mode but when I try to specify the key derivation function it tells me my command is wrong. It only fails when I try specify the KDF and works when I don't. This is the command i'm trying to use - openssl enc -des-cbc -pbkdf2 -in test.txt -out test.bin -pass pass:test

This command is taken directly from my reference so why does it not pick up the KDF? Is it because i'm using the wrong version of openssl (LibreSSL 2.6.4) or do I have to manually add pbkdf2? If so how do I?

Improve this question
$\endgroup$
1
  • 3
    $\begingroup$ You're actually asking about the commandline utility openssl, which is a very different thing from the OpenSSL (or derivative like LibreSSL) suite. OpenSSL library has included PBKDF2 for about 20 years, and has supported it for PKCS8 key files, although as ZT answers using it in commandline enc is very recent. Also to be clear even if you use PBKDF2 and a good password, anything encrypted this century in single-DES is easily broken. $\endgroup$
    – dave_thompson_085
    Apr 28, 2019 at 1:57

1 Answer 1

Reset to default
3
$\begingroup$

LibreSSL enc docs: https://man.openbsd.org/openssl.1#ENC

OpenSSL enc docs for version 1.1.1 : https://www.openssl.org/docs/man1.1.1/man1/enc.html

Both support pbkdf2. I am kinda surprised LibreSSL still supports DES, I would not support it. Can you paste the exact error you're getting?

Edit:

The changelog of libressl says pbkdf2 support was added in version 2.9.1 (latest current version).

Comparing the openssl 1.1.1 man page above with the openssl 1.1.0 enc man page, I see pbkdf2 support was added in version 1.1.1 (latest current stable version).

You're trying to use a very new feature.

Improve this answer
$\endgroup$
7
  • $\begingroup$ Hamish$ openssl enc -des-cbc -pbkdf2 -in ciphers.txt -out test.bin -pass pass:test usage: enc -ciphername [-AadePp] [-base64] [-bufsize number] [-debug] $\endgroup$
    – Hamish
    Apr 28, 2019 at 1:26
  • $\begingroup$ It basically just prints out the usage as if the command is malformed $\endgroup$
    – Hamish
    Apr 28, 2019 at 1:26
  • $\begingroup$ Output of openssl version -a? $\endgroup$
    – Z.T.
    Apr 28, 2019 at 1:27
  • $\begingroup$ LibreSSL 2.6.4 built on: date not available platform: information not available options: bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) blowfish(idx) compiler: information not available OPENSSLDIR: "/private/etc/ssl" $\endgroup$
    – Hamish
    Apr 28, 2019 at 1:29
  • $\begingroup$ I'm gonna try using a different distribution of openssl on vm fusion maybe that will change something. $\endgroup$
    – Hamish
    Apr 28, 2019 at 1:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.