Secure file encryption with OpenSSL and a little trick?

Question

I try to really securely encrypt a file with OpenSSL. I´m new to OpenSSL and just read here, that it´s not very secure due to it´s behavior in generating salt & IV, and storing it within the encrypted file.

I use a Server, where OpenSSL is the only tool available for file encryption (currently I have V1.0.1t).

Let´s say, I use a password with 256 or more bytes of random data, including all kind of special chars and aes-256-cbc for encryption.

I know, the md5 of password + salt is stored in the first 32 bytes of the enrypted file now. Quite weak so far...

What if I use a little trick and read out that first 32 bytes and store them in a different location (DB, etc.). Then overwrite them in the file with random data... Later for decrypting I put the original bytes back into the file, prior to decrypting.

As far as I understand, this would be a huge increase of security, as long as no one gets access to the stored fragments.

Is this correct? What do you think?

Answer 1

I know, the md5 of password + salt is stored in the first 32 bytes of the enrypted file now.

This is not true. It will only write the 8 byte salt and nothing derived from the password (not MD5, not something else) as you claim. Instead the salt and the password will be used together to derive the encryption key using MD5, but the user needs to provide the password for decryption so that the encryption key can be again derived from the (given) password and the stored salt.

The problem with enc is instead that MD5 is a weak key derivation function because it is too fast and thus simpler passwords can be brute forced. See also openssl enc uses md5 to hash the password and the salt.

If you really need to use enc use a hard password so that brute forcing will not be successful.

Let´s say, I use a password with 256 or more bytes of random data,...

Yes, this is probably hard enough: 2048 bits of random data can be well considered impossible to be brute-forced, commonly even 128 or 256 bits (16 or 32 random binary bytes or about 22..44 random alpha-numeric characters) are considered sufficient.