I have an old shell script, created by a person that is not in the company anymore, to encrypt and decrypt our access password. The old script is basically this:

if [ ! -f $PFILE ] || [[ "$NEW_FILE" == "true" ]]; then
    rm -rf $PFILE
    echo "PASSWORD=notset" >> $PFILE
if [ -n "$PASSWORD" ]; then
    echo "changing PASSWORD"
    P=`echo ${PASSWORD} | openssl enc -aes-128-cbc -a -salt -pass pass:${SECRET}`
    sed -i "/PASSWORD=/ s|=.*|=${P}|" ${PFILE}

And to decrypt the script basically did this:

PASSWORD=$(sed -n 's|^PASSWORD=||p' $PFILE)
password=`echo $PASSWORD | openssl enc -aes-128-cbc -a -d -salt -pass pass:${SECRET}`

But now when I run this, I get the error:

*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.

I created a test script to try this new version and it looks like this:

P=`echo 'rawpassword' | openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 1000 -salt -pass pass:'secret'`    
echo "P = " $P    
U= `echo P | openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 1000 -d -salt -pass pass:'secret'`    
echo "U = " $U

Seems like it's working to encrypt, but I'm doing something wrong during the decryption, as it's printing an empty string and giving me the error:

error reading input file

What am I doing wrong during the decryption?

  • An warning is not an error. would redirecting openssl to stderr on the old script work? as in openssl .... 2> /dev/null – Rui F Ribeiro Jun 17 at 15:03
  • remove the space after equal sign U= – user4556274 Jun 17 at 15:50
  • @user4556274, removing the space still gives the same error. – Alexander Rumanovsk Jun 17 at 15:56
  • @RuiFRibeiro, this is what openssl gives me when I decrypt the passwords: ▒▒z~ u1׬▒▒▒▒[▒ i ▒(▒xގ▒Zy▒K▒2▒ – Alexander Rumanovsk Jun 17 at 15:59
  • You want U=`echo $P ... instead of U= `echo P ... – ottomeister Jun 17 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.