When you run the command openssl enc -ciphers a list of supported ciphers is printed. In more recent versions of the OpenSSL utility the ciphers -id-aes256-wrap, -id-aes256-wrap-pad, and -aes256-wrap appear in that list. I believe these are implementations of the AES Key Wrapping algorithms specified in RFC3394, and RFC5649. When I go to use them to wrap a 256 bit key though as follows I get an error...

openssl enc -id-aes256-wrap -in test.key -out test.key.wrp

Error setting cipher id-aes256-wrap
140403454670488:error:0607B0AA:digital envelope routines:EVP_CipherInit_ex:wrap mode not allowed:evp_enc.c:218:

When I searched for the error "wrap mode not allowed" I found this message board text discussing how some special flags need to be set. But the discussion is in relation to using the openssl library's C API. Is it possible to use these key wrapping ciphers from the openssl enc utility and if so how?

  • The question is off-topic, here. You would want to checkout crypto.stackexchange.com. – thecarpy Jun 15 '18 at 7:56
  • I'm voting to close this question as off-topic because it belongs to crypto.stackexchange.com – LinuxSecurityFreak Jun 15 '18 at 10:06
  • This is a question about using a Linux command line utility not about encryption. Questions like this are explicitly not appropriate for the crypto stack exchange . – Pete Jun 25 '18 at 1:01

Which version are you running ?

This https://github.com/openssl/openssl/issues/2485 turned to https://github.com/openssl/openssl/issues/2486

The problem is, it did not work in Feb 2017, unless your openssl version is newer than that and you are in luck, it might work ... but I cannot find an issue where it is reported as fixed so i doubt it even works in the latest and greatest.

In short, congratulations, you have found a bug - I suggest you report it. They have many bugs to squash, if nobody reports this then chances are low they will fix it (why fix a feature nobody uses or complained about).

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.