I would like to encrypt files using a key file instead of a password. What I would do is:

1) Generate X random bits using openssl rand X > mykey

2) openssl enc -aes-256-cbc -in secretfile -out secretfile.enc -k mykey

Is this secure? How many bits should the key file should be?

  • 1
    If you want a password file (NOT a key) use -kfile or -pass file: with text in the file (most simply opensssl rand -hex) per the man pages openssl.org/docs/manmaster/apps/enc.html openssl.org/docs/manmaster/apps/openssl.html . Given enc's moderate stretching about 90 bits of entropy should be enough but you can do more if you like. If you really want a key in a file, commandline openssl doesn't do that, you'll have to write a program or wrap it in something like a perl or python script, and an aes-256 key must be 256 bits exactly. – dave_thompson_085 Dec 18 '15 at 23:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.