1

I used to use openssl aes-256-cbc, but the problem I have with this is when I try to decrypt in a different version of the distro it fails, as if it depends also on some internal key or something, instead of depending solely on the password. So I have to keep a different encrypted file for each version of the distro, which is annoying and bad.

Any suggestions?

ChocoDeveloper
  • 201
  • 1
  • 6
  • 2
    I’m voting to close this question because software recommendations belong on SuperUser, not here. – SAI Peregrinus Apr 05 '21 at 13:35
  • 2
    That said, I'd recommend age for such use. https://age-encryption.org – SAI Peregrinus Apr 05 '21 at 13:35
  • 2
    @SAIPeregrinus I asked the question in SuperUser and it's already closed for being offtopic. You guys are really something special. – ChocoDeveloper Apr 05 '21 at 15:32
  • 2
    I've seen what happened over there, @ChocoDeveloper. That is absolutely brilliant, and classic Stack Exchange material. LOL. – gd1 Apr 05 '21 at 16:33
  • 1
    That's why I commented with my recommendation. I figure they might be jerks about it. :( – SAI Peregrinus Apr 05 '21 at 20:40
  • 1
    openssl enc with the same arguments (except for -e/-d and excluding -pbkdf2 or -iter in 1.1.1), and assuming no password/phrase character encodes differently, should be compatible across platforms EXCEPT between versions 1.1.0 up and those below, and those can be fixed with -md $hash. For (long) details see (my) https://crypto.stackexchange.com/questions/3298/is-there-a-standard-for-openssl-interoperable-aes-encryption/#35614 . That said, openssl enc is weak, and there are alternatives like gpg. – dave_thompson_085 Apr 06 '21 at 00:42
  • have you considered LUKS/2 and cryptsetup? this gives you stronger password-based KDFs, (addressing one of @dave_thompson_085 's concerns) and relative portability, but with a smaller header as a tradeoff // cryptsetup --type=luks2 --pbkdf=argon2id --pbkdf-memory=1048576 --pbkdf-parallel=4 --pbkdf-force-iterations=8 --hash=sha384 --luks2-metadata-size=16k --luks2-keyslots-size=$((512*1024)) --master-key-file=trial_master_key --uuid=12345678-abcd-1234-abcd-0123456789ab luksFormat /dev/new_luks_partition1 .. I read somewhere that you can also perform cryptsetup on a loopback device. – brynk Apr 08 '21 at 20:48
  • also, instead of using openssl to produce the output, you might consider using it to secure a random key that you'd used previously to encrypt a file (eg, with 7z) see openssl pkeyutl -derive – brynk Apr 08 '21 at 21:03
  • and, off topic, you will most likely have Libsodium, and probably even python3 installed, which allows for using Pysodium to secure the file/output with crypto boxes – brynk Apr 08 '21 at 21:15

0 Answers0