Is it possible to encrypt a file using both AES-256 cipher, password and keyfile using OpenSSL?

Question

Is it possible to encrypt a file using both AES-256 cipher, password and keyfile using OpenSSL?

I want to encrypt a file using OpenSSL.

After hours of testing I have found a command which may partially do what I want:

openssl enc -aes-256-cbc -salt -in input.txt -out output.txt

When I run the command above I am prompted for a password which is desirable in this scenario.

I am wondering if and how I can use the command above both with a password and a keyfile. I.e. a keyfile is used to encrypt the input.txt file and a password is also used. I have tested the -inkey flag already but it does not seem to work.

OS: Linux (custom)

Answer 1

Whatever you do, don't try specifying multiple -pass arguments as @mootmoot suggests in the comments. Only the latest applies, as can be trivially seen by:

echo test | openssl enc -aes-256-cbc -salt -pass file:key -pass pass:password | openssl enc -d -aes-256-cbc -salt -pass pass:password

Assuming you're trying to require both the password and the keyfile to decrypt, the easiest way would be to simply chain them, though this will result in a slight size increase:

$ echo test | openssl enc -aes-256-cbc -salt | openssl enc -aes-256-cbc -salt -pass file:key >testout
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:

$ <testout openssl enc -d -aes-256-cbc -salt -pass file:key | openssl enc -d -aes-256-cbc -salt
enter aes-256-cbc decryption password:
test

You should be aware though that the key derivation openssl enc uses is quite terrible. 0.9.8 defaults to MD5, and while it lets you select another hash, it only allows one round of hash(password || salt). 1.1.0 changes the default hash to SHA256, but it still only allows a single round, so the improvement is very minor.

I've also seen this quote from an openssl developer referenced a few times:

At the end of the day, OpenSSL is a *library*, not an end-user product, and enc(1) and friends are developer utilities and "demo" tools.

It's from 2009, so I don't know how much that's changed since then (I believe the cms utility is ok), but I would recommend avoiding enc if possible.