Whatever you do, don't try specifying multiple
-pass arguments as @mootmoot suggests in the comments. Only the latest applies, as can be trivially seen by:
echo test | openssl enc -aes-256-cbc -salt -pass file:key -pass pass:password | openssl enc -d -aes-256-cbc -salt -pass pass:password
Assuming you're trying to require both the password and the keyfile to decrypt, the easiest way would be to simply chain them, though this will result in a slight size increase:
$ echo test | openssl enc -aes-256-cbc -salt | openssl enc -aes-256-cbc -salt -pass file:key >testout
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
$ <testout openssl enc -d -aes-256-cbc -salt -pass file:key | openssl enc -d -aes-256-cbc -salt
enter aes-256-cbc decryption password:
You should be aware though that the key derivation
openssl enc uses is quite terrible. 0.9.8 defaults to MD5, and while it lets you select another hash, it only allows one round of
hash(password || salt). 1.1.0 changes the default hash to SHA256, but it still only allows a single round, so the improvement is very minor.
I've also seen this quote from an openssl developer referenced a few times:
At the end of the day, OpenSSL is a *library*, not an end-user product,
and enc(1) and friends are developer utilities and "demo" tools.
It's from 2009, so I don't know how much that's changed since then (I believe the
cms utility is ok), but I would recommend avoiding
enc if possible.