OpenSSL 1.0.1t does not decrypt with -bf if encrypted with OpenSSL version 1.1.0e

Question

I have encrypted a file with the same command line with two different openssl versions: 1.0.1t and 1.1.0e. Then I try to decode both with version 1.0.1t and I cannot decode the latter.

Can you please tell me why and where am I wrong? How can I encrypt and safely decrypt without changing the command line: openssl enc -d -a -bf -in <infile> -out <outfile> -pass pass:<password>?

If you would like to answer on more question: how can I make the cipher more resilient?

Here's how to reproduce the situation. On the host with openssl 1.0.1t:

user@101t$ openssl version OpenSSL 1.0.1t 3 May 2016 user@101t$ echo "pippo" > prova user@101t$ openssl enc -e -a -salt -bf -in "prova" -out "prova1.enc" -pass pass:pippo

On the host with openssl 1.1.0e:

user@110e$ openssl version OpenSSL 1.1.0e 16 Feb 2017 user@110e$ echo "pippo" > prova user@110e$ openssl enc -e -a -salt -bf -in "prova" -out "prova2.enc" -pass pass:pippo

Copy prova1.enc to the host with openssl 1.0.1t and then into it type:

user@101t$ openssl enc -d -a -bf -in prova1.enc -out x -pass pass:pippo user@101t$ openssl enc -d -a -bf -in prova2.enc -out x -pass pass:pippo bad decrypt 139637189576336:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:516:

Thanks in advance

Answer 1

The default digest used for generating the key from the password changed in OpenSSL 1.1.0. In versions prior to that md5 was used - which is now considered insecure. In OpenSSL 1.1.0 the default digest is sha256.

In order to decrypt a file in OpenSSL 1.0.1t generated by OpenSSL 1.1.0 you should add "-md sha256" to your command line arguments. If that is not possible then you can also force OpenSSL 1.1.0 to use md5 as its digest by adding "-md md5" to the encryption command line arguments. This is obviously insecure but should work.