openssl-enc - symmetric cipher routines
openssl enc|cipher [-cipher] [-help] [-list] [-ciphers] [-in filename] [-out filename] [-pass arg] [-e] [-d] [-a] [-base64] [-A] [-k password] [-kfile filename] [-K key] [-iv IV] [-S salt] [-salt] [-nosalt] [-z] [-md digest] [-iter count] [-pbkdf2] [-p] [-P] [-bufsize number] [-nopad] [-v] [-debug] [-none] [-engine id] [-rand files] [-writerand file]
openssl cipher [...]
The symmetric cipher commands allow data to be encrypted or decrypted using various block and stream ciphers using keys based on passwords or explicitly provided. Base64 encoding or decoding can also be performed either by itself or in addition to the encryption or decryption.
Print out a usage message.
List all supported ciphers.
Alias of -list to display all supported ciphers.
The input filename, standard input by default.
The output filename, standard output by default.
The password source. For more information about the format of arg see -e
Encrypt the input data: this is the default. Decrypt the input data. Base64 process the data. This means that if encryption is taking place the data is base64 encoded after encryption. If decryption is set then the input data is base64 decoded before being decrypted. Same as -a If the -a option is set then base64 process the data on one line. The password to derive the key from. This is for compatibility with previous versions of OpenSSL. Superseded by the -pass argument. Read the password to derive the key from the first line of filename. This is for compatibility with previous versions of OpenSSL. Superseded by the -pass argument. Use the specified digest to create the key from the passphrase. The default algorithm is sha-256. Use a given number of iterations on the password in deriving the encryption key. High values increase the time required to brute-force the resulting file. This option enables the use of PBKDF2 algorithm to derive the key. Use PBKDF2 algorithm with default iteration count unless otherwise specified. Don't use a salt in the key derivation routines. This option SHOULD NOT be used except for test purposes or compatibility with ancient versions of OpenSSL. Use salt (randomly generated or provide with -S option) when encrypting, this is the default. The actual salt to use: this must be represented as a string of hex digits. The actual key to use: this must be represented as a string comprised only of hex digits. If only the key is specified, the IV must additionally specified using the -iv option. When both a key and a password are specified, the key given with the -K option will be used and the IV generated from the password will be taken. It does not make much sense to specify both key and password. The actual IV to use: this must be represented as a string comprised only of hex digits. When only the key is specified using the -K option, the IV must explicitly be defined. When a password is being specified using one of the other options, the IV is generated from this password. Print out the key and IV used. Print out the key and IV used then immediately exit: don't do any encryption or decryption. Set the buffer size for I/O. Disable standard block padding. Verbose print; display some statistics about I/O and buffer sizes. Debug the BIOs used for I/O. Compress or decompress clear text using zlib before encryption or after decryption. This option exists only if OpenSSL with compiled with zlib or zlib-dynamic option. Use NULL cipher (no encryption or decryption of input). See -engine id
See NOTES
The program can be called either as Note that some of these ciphers can be disabled at compile time and some are available only if an appropriate engine is configured in the configuration file. The output when invoking this command with the -ciphers option (that is This command does not support authenticated encryption modes like CCM and GCM, and will not support such modes in the future. This is due to having to begin streaming output (e.g., to standard output when -out is not used) before the authentication tag could be validated. When this command is used in a pipeline, the receiving end will not be able to roll back upon authentication failure. The AEAD modes currently in common use also suffer from catastrophic failure of confidentiality and/or integrity upon reuse of key/iv/nonce, and since openssl enc places the entire burden of key/iv/nonce management upon the user, the risk of exposing AEAD modes is too great to allow. These key/iv/nonce management issues also affect other modes currently exposed in this command, but the failure modes are less extreme in these cases, and the functionality cannot be removed with a stable release branch. For bulk encryption of data, whether using authenticated encryption modes or other modes, EXAMPLES
Just base64 encode a binary file: Decode the same file Encrypt a file using AES-128 using a prompted password and PBKDF2 key derivation: Decrypt a file using a supplied password: Encrypt a file then base64 encode it (so it can be sent via mail for example) using AES-256 in CTR mode and PBKDF2 key derivation: Base64 decode a file then decrypt it using a password supplied in a file: The -A option when used with large files doesn't work properly. The openssl enc command only supports a fixed number of algorithms with certain parameters. So if, for example, you want to use RC2 with a 76 bit key or RC4 with an 84 bit key you can't use this program. The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0. The -list option was added in OpenSSL 1.1.1e. The -ciphers option was deprecated in OpenSSL 3.0. Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.openssl cipher or openssl enc -cipher. The first form doesn't work with engine-provided ciphers, because this form is processed before the configuration file is read and any ENGINEs loaded. Use the SUPPORTED CIPHERS
openssl enc -ciphers) is a list of ciphers, supported by your version of OpenSSL, including ones provided by configured engines. openssl base64 -in file.bin -out file.b64 openssl base64 -d -in file.b64 -out file.bin openssl enc -aes128 -pbkdf2 -in file.txt -out file.aes128 openssl enc -aes128 -pbkdf2 -d -in file.aes128 -out file.txt \
-pass pass:<password> openssl enc -aes-256-ctr -pbkdf2 -a -in file.txt -out file.aes256 openssl enc -aes-256-ctr -pbkdf2 -d -a -in file.aes256 -out file.txt \
-pass file:<passfile>BUGS
HISTORY
COPYRIGHT