I wonder why this does not work on Linux?

gpg --cipher-algo AES256 -c -o test.zip.enc test.zip 
Enter passphrase:

openssl enc -AES-256-CBC -d -in test.zip.enc -out test.zip
enter aes-256-cbc decryption password:
bad magic number

To give a context, I have an application where I encrypt a file on Linux with GnuPG and I want Mac users to be able to decrypt it without need to install additional software (OpenSSL comes pre-installed on OS X).

  • Why don't you encrypt with openssl?
    – A. Hersean
    Nov 29, 2016 at 9:00
  • Sure, I just wondered if there was a quick solution without modifying application code and bumped into the above problem.
    – xtrb8433
    Nov 29, 2016 at 9:16

4 Answers 4


OpenSSL implements the X.509 standard, while GnuPG implements OpenPGP. While both use mostly the same cryptographic algorithms with lots of overlap, both protocols have their own file formats and minor differences, especially in the mode of operation for symmetric encryption.

Both OpenSSL and GnuPG are available for pretty much all operating systems, while GnuPG is only shipped by default with most Linux distributions, but OpenSSL is readily available for pretty much all unixoid operating systems.

If you insist on using GnuPG, also have a look at GnuPG's gpgsm component which is an implementation of X.509 compatible to OpenSSL (but cannot use OpenPGP keys because of the different formats, thus requires an X.509 key).


OpenPGP (GPG) and OpenSSL use different encryption formats for (slightly) different uses. Those formats are not interchangeable. In particular, OpenSSL cannot parse OpenPGP encrypted data.

I would recommend using the same software on both Linux and OS X.


OpenSSL & GPG have different implementations of same algorithms, so with current versions, aren't compatible eg. different magic bits (until someone comes up with an intermediate software that translates between the two eg. translator or virtual machine).

This issue arises in every new technology/industry (cf. NTSC & PAL, MacOS & Windows, Diesel vs Petrol), and may even remain unsolved.

OpenSSL also comes pre-installed with most flavors of Linux eg. CentOS, Ubuntu, Red Hat & Arch Linux, so to solve your problem, encrypt with OpenSSL for your "Mac users to be able to decrypt it without need to install additional software".

Another solution would be to send files over https (TLS) implemented for similar algorithms by web browsers (if your reason for encryption is secure transport of files).


On the most known Linux distributions, openssl is already loaded after fresh installation.

I have the same problem when writing books because I primary use Linux for composing the texts and MacOSX for ebook publication. Because Linux is my usual OS, I have gpg keys only on Linux, so I use OpenSSL that I found installed on both OS after installation.

In my script, used by both OSes I use:

to encrypt:

openssl des3 -salt -in MyBook.tar -out MyBook.tar.encrypt

to decrypt:

openssl des3 -d -salt -in MyBook.tar.encrypt -out MyBook.tar
  • Please upgrade your cryptography to the 21st century. There's no way to encrypt a message in a way that isn't broken with the openssl command line tool. Use PGP/GPG instead: it's exactly designed for that. Mar 17, 2018 at 11:59
  • @Gilles'SO-stopbeingevil': that was an exaggeration. OpenSSL commandline does CMS and SMIME which aren't broken. Commandline enc can use a raw key from e.g. E-S ECDH + hash and random IV both of which commandline can also do, which aren't broken. Only password-based enc using lame EVP_BytesToKey with super-lame iter=1 was broken -- and that was fixed adequately if not excellently by adding PBKDF2 in 1.1.1, which was in beta when you commented in 2018 and released soon after. Oct 8, 2020 at 1:00
  • @dave_thompson_085 It's still a command line interface that requires you to move the key around, and that happily lets you select broken parameters such as DES and ECB. Even now that the cryptographic primitive isn't stupid, the interface is still stupid. Oct 8, 2020 at 9:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .