I need to encrypt and decrypt a password using bash script. For that, I'm using openssl.

The decryption is needed because I'm moving the password between hosts.

The weird thing is it looks like the encryption has an expiration time.

To encrypt (not on bash script):

echo P@$$word| openssl enc -aes-128-cbc -a -salt -pass pass:pass_key

to decrypt (on bash script):

dec_password=$(echo -n $1 | openssl enc -aes-128-cbc -a -d -salt -pass pass:pass_key)

if I'm doing the encryption and then running the script it works perfectly.
However, if I'm doing the encryption and in the next day running the script for decryption it fails with the error:

error reading input file

Not sure if time is related but that's the only variable that changed.

Any ideas? Thanks

  • 2
    You need a newline at the end of the string, i.e remove the -n from echo. As an aside also you should quote your strings as currently 'P@$$word' will contain your pid when $$ is expanded.
    – 123
    Feb 19 '18 at 10:09

The error you have after waiting some time to decrypt the password, and you mentioning it seems the method "has an expiration time" is because the random generated salt varies over time. (e.g. it will be different every day)

When encrypting, the 1st characters of the encrypted password are the salt used when encrypting with a salt; you should use the same salt for decrypting.

Be aware that if trying to encrypt without salt, in MacOS/ older? openssl versions you have to use the -nosaltkeyword; openssl generates and uses a salt by default.

So to encrypt without salt, you need to do:

echo P@$$word| openssl enc -aes-128-cbc -a -nosalt -pass pass:pass_key

However, when storing passwords, it is bad practice decrypting them to compare them with candidate passwords; later on for comparing scripts you do not decrypt them:

what you do to compare passwords is encrypting a password to check with the same salt (if using salt), and compare the encrypted strings to see if they match.

If it is for forwarding passwords between systems and not storing them, using salt is not so essential, however keep in mind it helps keeping it more secure.

However in case you have strong security needs about encryption strenght, OpenSSL is known for having a weak encryption strength and GnuPG is stronger than openSSL for encrypting.

  • 1
    The first 8 chars of the encrypted file before 'armoring' (base64) are the constant Salted__, the second 8 bytes (frequently not characters) are the salt, and it is used automatically on decryption, you don't need to and can't specify it. This operation enc is indeed very weak especially without salt; OpenSSL has many other crypto functions that are not weak, but are not easily used to encrypt a password, which you should avoid doing anyway. And -salt is the default for all versions of OpenSSL since at least 2000. May 5 '18 at 4:08
$ echo P@$$word

$ echo 'P@$$word'

Always remember to quote strings. Also, double quote variable expansions such as $1:

$ ls

$ variable="a*"

$ echo $variable

$ echo "$variable"

Also, for comparing passwords, you should compare the encrypted passwords, not the decrypted ones. If a salt is used, the same salt should be used as was used to encrypt the original password. OpenSSL stores this in the first eight bytes of the encrypted data.

  • I think the argument to the first echo isn't what you intended ;)
    – marcelm
    Feb 19 '18 at 18:05
  • Salt is second 8 bytes, before 'armoring' (base64), which puts it in most of chars 11 to 22 IINM. May 5 '18 at 4:10
  • @dave_thompson_085 Sorry, I based that on the openssl manual which says "When the salt is being used the first eight bytes of the encrypted data are reserved for the salt". It's possible that it later gets displaced by base64, I'm not sure.
    – Kusalananda
    May 5 '18 at 5:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.