Terminal labUnit 5 · Topic 5.3
AES encryption with OpenSSL
Encrypt and decrypt a file with AES using OpenSSL.
New to this? Read the topic first: 5.3 Protecting Stored Data with Cryptography.
Simulation · Symmetric encryption [5.3.A.2, 5.3.B.2, 5.3.B.4]
AES lab: one key locks and unlocks
A hospital lab encrypts a file with the Advanced Encryption Standard (AES), a symmetric block cipher: the same key encrypts and decrypts. This is a real OpenSSL session: the output below is what the commands produce (error details trimmed).
lab@hospital-ws:~$ cat results.csv Lab samples move to freezer B at 14:00 lab@hospital-ws:~$ openssl enc -aes-128-cbc -e -in results.csv -k tulip-river-42 -out results.csv.enc *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better. lab@hospital-ws:~$ ls -l results.csv* -rw-r--r-- 1 lab lab 39 Nov 9 14:02 results.csv -rw-r--r-- 1 lab lab 64 Nov 9 14:02 results.csv.enc lab@hospital-ws:~$ xxd results.csv.enc 00000000: 5361 6c74 6564 5f5f a3f1 9c07 e25b 6d48 Salted__.....[mH 00000010: 156f d425 3a45 a213 9b8f b3e9 715a a6d2 .o.%:E......qZ.. 00000020: 348a eb67 4a98 1e56 ac9a a2dc a2f4 03ce 4..gJ..V........ 00000030: ccd0 7cd5 f67e 96ce 29de 9087 8b39 1a14 ..|..~..)....9..lab@hospital-ws:~$ rm results.csv # a colleague tries the wrong password lab@hospital-ws:~$ openssl enc -aes-128-cbc -d -in results.csv.enc -k tulip-river-43 -out check.csv *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better. bad decrypt ...:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:... # the same password as for encrypting lab@hospital-ws:~$ openssl enc -aes-128-cbc -d -in results.csv.enc -k tulip-river-42 -out results.csv *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better. lab@hospital-ws:~$ cat results.csv Lab samples move to freezer B at 14:00
Salted__ and an 8-byte random salt (highlighted), then 3 blocks of 16 bytes, because AES encrypts in 128-bit blocks and pads the last one. One character off in the password and decryption fails. The warning is real too: recent OpenSSL versions recommend adding -pbkdf2.Build the OpenSSL command
lab@hospital-ws:~$ openssl enc -aes-128-cbc -e -in results.csv -k password -out results.csv.enc
To decrypt, use the same cipher, the same password and -d: openssl enc -aes-128-cbc -d -in results.csv.enc -k password -out results.csv
Try it yourself
# press Encrypt Go to the topic: 5.3 Protecting Stored Data with Cryptography