I used to use openssl aes-256-cbc, but the problem I have with this is when I try to decrypt in a different version of the distro it fails, as if it depends also on some internal key or something, instead of depending solely on the password. So I have to keep a different encrypted file for each version of the distro, which is annoying and bad.

Any suggestions?

1 Answer 1


You could use gpg -c file.txt, since GPG supports encrypting a file with a passphrase and symmetric encryption.

The issue with openssl is most likely either a version mismatch or you're simply not using the right command. You could pull down the most recent code for openssl command line utility off github and compile it from source on all the computers, so they all have the same version.

You could also try manually specifying the Key Derivation Function parameters for openssl, for example: openssl enc -aes-256-cbc -pbkdf2 -salt -iter 100000 -in archive.tar.gz -out encrypted.tar.gz.ossl, which might resolve the issue without compiling from source (I'm not sure, but a newer version might use a more secure KDF by default, which causes decryption errors unless you manually specify the proper arguments)

  • Thanks a lot! That was probably it: different default parameters I didn't even know existed. But I'm actually glad to see I can specify the iterations. Apr 5, 2021 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.