I have a simple des command line:

des -D -k "whatever" file.enc file.dec

des is version des(1) built with libdes v 4.01 - 13-Jan-1997 - eay

I would like to use openssl (version OpenSSL 0.9.8a 11 Oct 2005) instead but I cannot figure out the command line options. I think the closest (based on some random des man page) I have is

openssl enc -d -in file.enc -out file.dec -k "whatever" -iv 0 -des-cbc -nosalt

But no matter which command line options or algorithms I try, I keep getting the error:

5423:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:454:

Any ideas?

  • While openssl is a cryptographic tool, this doesn't seem as if it is quite on-topic here per our FAQ. It might be a better fit at one of our sister sites Server Fault or Super User. Moving the question should be taken care of automatically. – Scott Pack Aug 29 '12 at 17:45
  • It seems to me that the question is less about the tool and more about understanding the permutations of the algorithm that are preventing the tool from working. I think it's either us or crypto. I'm going to give it a day and see if a crypto bear has an answer for us here. – Jeff Ferland Aug 29 '12 at 18:19
  • When it comes to encryption, the openssl command line tool is very restricted in its input/output format, it expects a specific header. You'll probably have to either massage the ciphertext or use another tool. What format does this des utility use? Where is it from? – Gilles 'SO- stop being evil' Aug 29 '12 at 19:37
  • Thanks for the reply ,Gilles. I think it was standard on Unix for a while, but may not be any more. link Can you suggest another tool that might be more appropriate than openssl? – David Demner Aug 29 '12 at 21:26

It should be:

    [xxx@box ~]$ openssl enc -des-cbc  -k "whatever" -iv 0 -in file.enc -out file.dec
    [xxx@box ~]$ strings file.dec
    [xxx@box ~]$
| improve this answer | |
  • Hi John, I'm looking to decrypt the file - I think this command line re-encrypts the file. Any ideas on how to decrypt? – David Demner Sep 3 '12 at 10:57
  • then it should be: openssl enc -des-cbc -k "whatever" -iv 0 -d -in file.dec -out file.orig – John Santos Sep 10 '12 at 8:34
  • When I try that, I get "Bad magic number". – David Demner Sep 18 '12 at 14:03
  • What OS and OpenSSL version are you using? I've tried it with both Linux and AIX with two different openssl versions and both commands works fine. – John Santos Sep 21 '12 at 11:40
  • @JohnSantos Did you perchance use the -nosalt option? Removing it worked for me. – user43846 Apr 9 '14 at 13:06

By default the des program encodes the output as base64, so you need to decode that before passing to the decryption algorithm, OpenSSL provides the -a option to encode / decode base64.

The input to the DES decryption should start with the string “Salted__” if the input is base64 then this translates into “U2FsdGVkX18… “ at the beginning of the file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.