1

When you run the command openssl enc -ciphers a list of supported ciphers is printed. In more recent versions of the OpenSSL utility the ciphers -id-aes256-wrap, -id-aes256-wrap-pad, and -aes256-wrap appear in that list. I believe these are implementations of the AES Key Wrapping algorithms specified in RFC3394, and RFC5649. When I go to use them to wrap a 256 bit key though as follows I get an error...

openssl enc -id-aes256-wrap -in test.key -out test.key.wrp

Error setting cipher id-aes256-wrap
140403454670488:error:0607B0AA:digital envelope routines:EVP_CipherInit_ex:wrap mode not allowed:evp_enc.c:218:

When I searched for the error "wrap mode not allowed" I found this message board text discussing how some special flags need to be set. But the discussion is in relation to using the openssl library's C API. Is it possible to use these key wrapping ciphers from the openssl enc utility and if so how?

3
  • The question is off-topic, here. You would want to checkout crypto.stackexchange.com.
    – thecarpy
    Commented Jun 15, 2018 at 7:56
  • I'm voting to close this question as off-topic because it belongs to crypto.stackexchange.com Commented Jun 15, 2018 at 10:06
  • This is a question about using a Linux command line utility not about encryption. Questions like this are explicitly not appropriate for the crypto stack exchange .
    – Pete
    Commented Jun 25, 2018 at 1:01

1 Answer 1

1

Which version are you running ?

This https://github.com/openssl/openssl/issues/2485 turned to https://github.com/openssl/openssl/issues/2486

The problem is, it did not work in Feb 2017, unless your openssl version is newer than that and you are in luck, it might work ... but I cannot find an issue where it is reported as fixed so i doubt it even works in the latest and greatest.

In short, congratulations, you have found a bug - I suggest you report it. They have many bugs to squash, if nobody reports this then chances are low they will fix it (why fix a feature nobody uses or complained about).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .