Whatever you do, don't try specifying multiple -pass
arguments as @mootmoot suggests in the comments. Only the latest applies, as can be trivially seen by:
echo test | openssl enc -aes-256-cbc -salt -pass file:key -pass pass:password | openssl enc -d -aes-256-cbc -salt -pass pass:password
Assuming you're trying to require both the password and the keyfile to decrypt, the easiest way would be to simply chain them, though this will result in a slight size increase:
$ echo test | openssl enc -aes-256-cbc -salt | openssl enc -aes-256-cbc -salt -pass file:key >testout
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
$ <testout openssl enc -d -aes-256-cbc -salt -pass file:key | openssl enc -d -aes-256-cbc -salt
enter aes-256-cbc decryption password:
test
You should be aware though that the key derivation openssl enc
uses is quite terrible. 0.9.8 defaults to MD5, and while it lets you select another hash, it only allows one round of hash(password || salt)
. 1.1.0 changes the default hash to SHA256, but it still only allows a single round, so the improvement is very minor.
I've also seen this quote from an openssl developer referenced a few times:
At the end of the day, OpenSSL is a *library*, not an end-user product,
and enc(1) and friends are developer utilities and "demo" tools.
It's from 2009, so I don't know how much that's changed since then (I believe the cms
utility is ok), but I would recommend avoiding enc
if possible.
-pass file:your_keyfilename -pass:yourpassword
superuser.com/questions/724986/…openssl enc -aes-256-cbc -salt -in input.txt -out output.txt -pass file:user.key -pass pass:password
openssl enc -aes-256-cbc -salt -in qq.html -out qq.enc -pass file:user.key -pass stdin
;-)