You should never use OpenSSL's command line utility for general purpose encryption. It is actually designed only as a test of the library's internal encryption routines. Because of this, there are a few problems inherent in using it when real confidentiality and integrity are needed:
- You will be vulnerable to malleability attacks, as CBC mode is unauthenticated. This can allow your files to be modified in certain predictable ways without knowing the encryption key.
- No integrity checking means decryption with the wrong key can succeed, despite outputting corrupted gibberish. Utilities designed for file encryption will tell you if the key is wrong.
- The default hash used to derive the master key is MD5, which is far from ideal. It is possible to change the hash, for example with
-md sha512, but it still will not use key stretching.
- New versions may not be able to decrypt previously encrypted files by default. When the default hash value was changed from MD5 to SHA-512, it required an explicit
-md md5 to work again.
- Both the key and IV are derived from your input password. Using the same password to encrypt multiple files will result in IV re-use. This is bad for CBC mode, and fatal for CTR mode.
- It is not well tested. For many versions of OpenSSL,
enc using GCM mode encryption worked, but decryption did not. This might even still be the case.
This is not unique to the
enc command. The OpenSSL command line utility has other gotchas when one attempts to use it for anything other than testing the library. Another example is the
s_client command, used for connecting to a server over SSL or TLS, which does not validate the certificate of the target. Overall, you should not use the OpenSSL utility. Just use GnuPG:
The only time I would ever use OpenSSL directly is if I needed to encrypt something with a completely random key or a specific raw key and IV and did not care about message integrity. For example, writing a pseudorandom stream seeded by the kernel to stdout can be done with:
openssl aes-128-ctr -nosalt -k $(xxd -l16 -c16 -ps /dev/urandom) -in /dev/zero
Likewise, decrypting a blob of plain encrypted data when you know both the raw key and the raw IV in hexadecimal (bypassing the need for
-md for key derivation) could be done with:
openssl aes-128-cbc -d -nosalt -K $hex_key -iv $hex_iv -in infile -out outfile
But for general-purpose file encryption? Just use GnuPG.