How to pass string (not file) to openssl

openssl

I want to encrypt a bunch of strings using openssl. How do I pass plaintext in console to openssl (instead of specifying input file which has plaintext).

openssl man page has only these two options related to input/output:

-in <file>     input file
-out <file>    output file

Here is what I have tried so far:

This works fine,

openssl aes-256-cbc -a -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 -in plain.txt -out encrypted.txt

If I omit the -out parameter I get encrypted string in console,

openssl aes-256-cbc -a -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 -in plain.txt

But If I omit both -in and -out, I get an error – unknown option 'Encrypt ME',

openssl aes-256-cbc -a -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 "Encrypt ME"

Best Answer

Use this:

user@host:~$ echo "my string to encrypt" | openssl aes-256-cbc -e -a -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000
a7svR6j/uAz4kY9jvWbJaUR/d5QdH5ua/vztLN7u/FE=
user@host:~$ echo "a7svR6j/uAz4kY9jvWbJaUR/d5QdH5ua/vztLN7u/FE=" | openssl aes-256-cbc -d -a -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000
my string to encrypt

Or you could use command substitution:

user@host:~$ openssl aes-256-cbc -a -K 00000000000000000000000000000000 -iv \
00000000000000000000000000000000 -in <(echo "my string to encrypt") -out encrypted.txt

Related Solutions

Openssl passing a binary pass phrase as a argument

A passphrase specified by -pass is different from the actual key for encryption specified by -K. openssl processes a passphrase with hash functions to derive an actual key with specific bit length. So passphrases are usually short and memorable strings using only printable characters.

You can see actual keys, IVs, and salts by -P. Note that your key gets truncated to 128-bit key length with aes-128-ecb. Also note that -ecb mode is weak and not suitable for common use.

$ openssl aes-128-ecb -P -K 4D1D75237C31E7732030C69F209F23154418373335E049C4F567C7B6D422ABD0
salt=EA7B538100000000
key=4D1D75237C31E7732030C69F209F2315
$ openssl aes-256-cbc -P -pass pass:secret
salt=332A7608A01A609A
key=1B27C46F481CFA793C665EEFC3C5B6867735CD326840C598AA6EBCCA5829D066
iv =CE223BAEDAA625C02A397D3E1FCE8E75

According to the manual -K doesn't support file input. You might want to do something like this:

openssl aes-128-ecb -d -in encrypted_base64.txt -K $(hexdump -v -e '"%02X"' data_key_plaintext.bin) -base64

Openssl does not load engine from config file

Obviously, you are not loading the config file, to load an OpenSSL config file, you must specify the path through an environment variable :

export OPENSSL_CONF=/path/to/config

Then you can run

openssl engine pkcs11 -t -c

At least, the correct engine and module will be loaded. If you still have errors, you need to make a new post.

Best Answer

Related Solutions

Openssl passing a binary pass phrase as a argument

Openssl does not load engine from config file

Related Question