hi i used this command to encrypt a folder "tar -cf tmpdata.tar ena && gzip tmpdata.tar && openssl aes-256-cbc -a -salt -iter 5 -in tmpdata.tar.gz -out ena.enc && rm -f tmpdata.tar.gz && rm -dir ena "
and this to decrypt it "openssl aes-256-cbc -d -a -iter 5 -in ena.enc -out tmpdata.tar.gz && tar -xzf tmpdata.tar.gyz && rm -f tmpdata.tar.gz"
but it tells me decrypt fail and this
"40B7F2EEFA7F0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:../providers/implementations/ciphers/ciphercommon_block.c:124:"
What can i do to decrypt the folder now ?
And its not from password because its the same key , but yesterday was working fine but today it happen
Related
I wanted to know how I can go about encrypting particular values in a properties file using openssl or gpg.
Most of the examples seem to consist of the below I have seen seem to encrypt the entire file. But I just wanted to use it to encrypt stored passwords.
To Encrypt
openssl enc -aes-256-cbc -in un_encrypted.data -out encrypted.data
To Decrypt
openssl enc -d -aes-256-cbc -in encrypted.data -out un_encrypted.data
You can easily use openssl to encrypt any string you want:
$ echo 12345678901 | openssl enc -e -base64 -aes-256-cbc -k MySecretPassword
U2FsdGVkX18z9p14y9XRhDdRBRoeJfIkdLQXQmGfKag=
In your case you could use a bash script like this:
encrypted=`grep "the.name.of.my.property" myFile.properties|cut -d'=' -f2|openssl enc -e -base64 -aes-256-cbc -k MySecretPassword`
sed "/the.name.of.my.property=/ s/=.*/=$encrypted/" myFile.properties > newFile.properties
This will produce a new file named newFile.properties with the encrypted field.
Using openssl-1.0.1g command line for simple file encryption/decryption, when I issue the commands
openssl enc -aes-256-cbc -k secret -in file.txt -out file.ssl
openssl enc -d -aes-256-cbc -k secret -in file.ssl
The contents of file.txt go to stdout as expected. However, when I issue the commands
openssl enc -aes-256-gcm -k secret -in file.txt -out file.ssl
openssl enc -d -aes-256-gcm -k secret -in file.ssl
The contents of file.txt go to stdout but the string "bad decrypt" goes to stderr.
Am I missing something or is there a bug in the openssl gcm implementation?
I have tried substituting "-pass pass:secret" for "-k secret" and get the same results.
I'll try to make this succinct as possible.
I want to be able to encrypt & decrypt simple strings using OpenSSL, which I have done before.
HOWEVER, the following conditions must be met:
Simple passphrase use (no keys)
No input/output files
No prompt for passphrase (specify via command-line options for either direction)
I'm 50% there. I can successfully perform ENCRYPTION via:
echo 'someTextIWantToEncrypt' | openssl enc -e -aes-256-cbc -nosalt -pass pass:mySecretPass
The output result is:
(??b}n??v???>??G??.?B??~?
OK, great. Now I want to DECRYPT that string. So I do:
echo -n '(??b}n??v???>??G??.?B??~?' | openssl enc -d -aes-256-cbc -pass pass:mySecretPass
or even as an alternative:
openssl enc -d -aes-256-cbc -pass pass:mySecretPass <<< '(??b}n??v???>??G??.?B??~?'
But I get this response:
bad magic number
Though I don't want to use input/output files, that method DOES work 100%:
# encrypt to file
echo -n 'someTextIWantToEncrypt' | openssl enc -e -nosalt -out test.txt -aes-256-cbc -pass pass:mySecretPass
# decrypt from file
openssl enc -d -nosalt -in test.txt -aes-256-cbc -pass pass:mySecretPass
# result of decryption (is successful):
someTextIWantToEncrypt
So ... how can I achieve the above decryption process without using input/output files whatsoever? I feel I am close, but missing some small detail.
Thanks in advance.
The problem is that encryption uses the entire ASCII character set, including unprintable characters. If you want to be able to cut and paste the encrypted data, you need to convert it to only printable characters. You can do this with the -base64 (or -a) option:
echo 'someTextIWantToEncrypt' | \
openssl enc -base64 -e -aes-256-cbc -nosalt -pass pass:mySecretPass
KPkBkGJ9bs4YHvh24xz7m9jTlYWm1LcIFcWR0DwY4PU=
Then decrypt it the same way:
echo "KPkBkGJ9bs4YHvh24xz7m9jTlYWm1LcIFcWR0DwY4PU=" | \
openssl enc -base64 -d -aes-256-cbc -nosalt -pass pass:mySecretPass
WARNING: If you're using openssl, I can only assume the confidentiality of the data, and therefore the password, is important to you. If that's the case, you should never supply a password on the command line, because it can be exposed to anyone with the privilege to run ps.
A better solution is to store the password in an environment variable and have openssl read it from there:
export passwd="mySecretPass"
echo "KPkBkGJ9bs4YHvh24xz7m9jTlYWm1LcIFcWR0DwY4PU=" | \
openssl enc -base64 -d -aes-256-cbc -nosalt -pass env:passwd
Decrypt
#!/bin/bash
clear
# encrypt to file
echo "enter choice "
echo "1-dakr"
echo "2-gakr"
read choice
case $choice in
1 )
echo "text?"
read text
echo "pass?"
read pass
echo -n '$text' | openssl enc -e -nosalt -out test.txt -aes-256-cbc -pass pass:$pass
;;
2 )
# decrypt from file
echo "pass?"
read pass
echo "path?"
read path
openssl enc -d -nosalt -in $path -aes-256-cbc -pass pass:$pass
;;
* )
echo "shcd"
;;
esac
Output of Decrypt is $text how to fix it?
I know this is old, but someone else just showed me this question. I have a TCL script that achieves this easily, and can just be modified to work with whatever shell you're using, it contains these lines:
if {[catch {set lines [exec echo -n $tte | openssl enc -$cipher -a -pbkdf2 -iter $iterations -pass pass:$fkey]} msg]} {
tk_messageBox -message $msg
return
}
Where $tte = text to encrypt, $cipher and $iterations are self explanatory, and $fkey is the password passed to openssl. Just add a -d switch to decrypt.
I don't know how could I measure the elapsed time in encryption using openssl.
I have downloaded openssl to my linux system with no problems and I can do encryption to different files but I don't know how to measure the time to see what encryption algorithm is more effecient.
Here is the command that I use to do the encryption:
OpenSSL> enc -des-cbc -salt -a -in "/usr/local/openssl/file1.txt" -out "/usr/local/openssl/file1_des.enc" -k "123456"
This is the other algorithm:
OpenSSL> enc -aes-128-cbc -salt -a -in "/usr/local/openssl/file2.txt" -out "/usr/local/openssl/file2_aes.enc" -k "123456"
Is there a way to measure the time of execution? I tried to open another terminal and execute the (time) but it didn't help. I also don't have that much of experice on using linux. However, I tried to do the same thing on Windows but still don't have a way to measure the time.
Hope you guys can help.
Thanks,
D
Eh, you mean like openssl speed?
On Linux, I entered this at the shell prompt:
time openssl enc -des-cbc -salt -a -in foo.txt -out foo_des.enc -k "123456"
and got the output:
real 0m0.214s
user 0m0.008s
sys 0m0.016s
That said, you'd get a more meaningful result if you introduced some sort of looping construct. At the very least, consider creating a text file with multiple openssl command lines:
opensslcmds.txt:
enc -des-cbc -salt -a -in foo.txt -out file1_des.enc -k 123456
enc -des-cbc -salt -a -in foo.txt -out file2_des.enc -k 123456
enc -des-cbc -salt -a -in foo.txt -out file3_des.enc -k 123456
(and so on)
and then run
time openssl < opensslcmds.txt
This is my code of my shell script when static.key contains my random key.
hexKey=$(cat static.key | hexdump -e '16/1 "%02x"')
echo $hexKey
hexIV="0"
echo $hexIV
openssl aes-128-cbc -e -in logo-1.ts -out logo-enc-1.ts -p -nosalt -K ${he-iv ${hexIV}
I get some error when running it.
(output:
non-hex digit
invalid hex iv value
: command not found
)
Maybe someone knows the problem. I'm on it for days now.
That error means that the value OpenSSL sees for the IV contains a non-hexadecimal character (i.e., something other than 0123456789abcdefABCDEF).
An AES128 key is 128/8 = 16 bytes, so you should have 32 characters for the key. An IV is 16 bytes, corresponding to the AES block size, and OpenSSL will covert a single "0" into 16 zero bytes for you. This is an example of a good command:
$ echo -n "hello" > in
$ openssl aes-128-cbc -e -in in -out out -p -nosalt \
-K 000102030405060708090a0b0c0d0e0f -iv 000102030405060708090a0b0c0d0e0f
$ cat out | hexdump -e '16/1 "%02x"'
8326dc340c564d49790650a59260fea0
Now replace the last character of the IV with a non-hex character, and see that you get the same error you're getting.
$ openssl aes-128-cbc -e -in in -out out -p -nosalt \
-K 000102030405060708090a0b0c0d0e0f -iv 000102030405060708090a0b0c0d0e0q
$ cat out | hexdump -e '16/1 "%02x"'
non-hex digit
invalid hex iv value
If what you've pasted is the real code you're running, the problem is obvious. First, what is -K ${he-iv ${hexIV} supposed to mean? Second, the argument -K is to give the key. You're missing -iv to give the IV. You're even missing a closing brace.
This will probably fix your problem assuming static.key has 16 bytes:
openssl aes-128-cbc -e -in logo-1.ts -out logo-enc-1.ts -p -nosalt -K $hexKey -iv $hexIV
As a last tip, if you're using bash, run your script with -x as the argument to bash and it will print every line it executes after it expands the variables so you can see exactly what it's doing:
$ /bin/bash -x my_script
+ hexKey=0
+ hexIV=0
+ openssl aes-128-cbc -e -in in -out out -p -nosalt -K 0 -iv 0
In the process of storing the key value in the bash shell, some trailing garbage got included (either a null or newline) which is being passed to openssl and causing it to complain about non hex characters.
To fix this for 128 bit / 32 ascii character hex keys and IVs, tell bash to pass ONLY the first 32 characters like this (for other key or iv lengths change the value from 32 to 1/4 the number of bits in the key or iv)
openssl aes-128-cbc -e -in logo-1.ts -out logo-enc-1.ts -p -nosalt -K ${hexKey:0:32} -iv ${hexIV:0:32}
To verify that the correct values are being passed, use openssl's 'print keys' -P option (note UPPER CASE "-P")
openssl aes-128-cbc -e -in logo-1.ts -out logo-enc-1.ts -p -nosalt -K ${hexKey:0:32} -iv ${hexIV:0:32} -P
I have been struggling with this, basically I found this solution:
Encrypt:
openssl aes-256-cbc -k “choose_password_to_encrypt” -in /path_to_your_file_to_encrypt/file_to_encrypt.extension_file -out /path_to_your_file_to_dencrypt/choose_name_file_after_decrypt.extension_file.enc -a
Decrypt:
openssl aes-256-cbc -k “password_chose_to_encrypt” -in /path_to_your_file_to_dencrypt/choose_name_file_after_decrypt.extension_file.enc -d -a -out /path_to_your_file_to_encrypt/file_to_encrypt.extension_file
I hope it can be useful