2

How can I encrypt a large file with a public key so that no one other than who has the private key be able to decrypt it? I don't want to use GPG!

  • 1
    Why don't you want to use GPG? That sounds like “how do I cross the ocean? I want to use a car, not a boat or plane.” – Gilles Aug 28 '15 at 23:11
  • @Gilles I had used GPG before, but it doesn't work because my netbook (Asus EEE PC 701) is too slow. – wb9688 Aug 29 '15 at 8:02
  • 1
    You won't get better speed from openssl at the same security level. – Gilles Aug 29 '15 at 11:04
  • But OpenSSL works fine on my laptop. – wb9688 Aug 29 '15 at 13:00
4

This could be used to encrpyt a file mypic.png, given you already have a private/public keypair in ccbild-key.pem/ccbild-crt.pem. (You can find a guide to creating a keypair in this answer.)

# encrypt
openssl smime -encrypt -aes-256-cbc -binary -in mypic.png -outform DER -out mypic.png.der ccbild-crt.pem

# decrypt
openssl smime -decrypt -binary -in mypic.png.der -inform DER -out mypic.png -inkey ccbild-key.pem

Note that the settings may not reflect best practice in selection of crypto standard (in particular if you read this in the future), also it might not be a good choice performance-wise. (We only use it for sub-1M files in our application.)

  • That's AES-256 encryption, but it's good enough in my case. – wb9688 Aug 29 '15 at 8:01
2

Since you want to encrytpt a file - you can use GPG for this purpose.

Also, don't worry about the format of file - gpg can encrypt any file.

Short instructions:

  1. Ensure gpg-agent is running:

    gpg-agent -s --daemon --write-env-file --use-standard-socket

  2. Generate your key:

    gpg --gen-key

Select default ke, unless you know what you're doing, or are told otherwise by someone who does. If asked for keysize, enter 1024.(size in bits)

  1. When GPG will say that it will generate your key, start pressing keyboard randomly(just avoid combinations that send signals, like CTRL + Z, etc.

  2. You are ready to decrypt file. By default you use

    gpg -e -r user_id my_file

Replace user_id with email provided during key generation. Instructions based on Indiana University's article

  • 1
    The openssl binary is perfectly capable of encrypting files, computing hashes, etc. – Ulrich Schwarz Aug 28 '15 at 7:51
  • I've been mostly using gpg for this purpose, so I included instructions for that. Updated answer though. – MatthewRock Aug 28 '15 at 7:54
  • @UlrichSchwarz While it's more or less capable of doing it, it doesn't do it well. The openssl utility is a demo of the OpenSSL library, it isn't intended for serious work. It's difficult to figure out sane command line options, to do key management... Using GPG is the correct solution. – Gilles Aug 28 '15 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.