Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to achieve something like

tar -c directory | openssl foo > encrypted_tarfile.dat

I need the openssl tool to use public key encryption.

I found an earlier question about symmetric encryption at the command promt (sic!), which does not suffice. I did take a look in the openssl(1) man page and only found symmetric encryption. Does openssl really not support asymmetric encryption?

Basically many users are supposed to create their encrypted tar files and store them in a central location, but only few are allowed to read them.

share|improve this question

Use gpg --encrypt.

With "-r" you can pass the user ID.


man gpg
share|improve this answer
It appears DerMike is asking for how to do this via openssl, though? – Jeremy W. Sherman Dec 11 '13 at 15:27

OpenSSL's asymmetric encryption routines lie under the rsautl subcommand. (In recent versions of OpenSSL, this has been superseded by the pkeyutl command, but the arguments seem to be the same.)

Encrypt a tar file using someone's public key:

openssl rsautl -encrypt -inkey -pubin -in foo.tar -out foo.tar.enc

They can then decrypt the tar file using their private key:

openssl rsautl -decrypt -inkey Bob -in foo.tar.enc -out foo.tar

Do note that SSH and SSL use different key formats, so if you want to use an SSH key for the encryption/decryption, you can't just use ~/.ssh/ as-is.

share|improve this answer

In case you don't want to set gpg infrastructure, and just want to encrypt file using public/private key pair, the following tool could be of use: . You will need mono on linux to run it.

disclaimer: I wrote it

share|improve this answer

Here are 2 examples from man openssl:

Send encrypted mail using triple DES:

 openssl smime -encrypt -in in.txt -from \
        -to someone@somewhere -subject "Encrypted message" \
        -des3 user.pem -out mail.msg
Sign and encrypt mail:

 openssl smime -sign -in ml.txt -signer my.pem -text \
        | openssl smime -encrypt -out mail.msg \
        -from -to someone@somewhere \
        -subject "Signed and Encrypted message" -des3 user.pem

Some confusion comes from the fact that s/mime and des3 are mentioned. But in fact the following happens in the examples above:

  • A fresh random symmetric key is generated
  • The file is encrypted using the symmetric key
  • The symmetric key is encrypted using an asymmetric algorithm with a public key stored in user.pem
  • The encrypted symmetric key, the encrypted file and metadata are put into a standard container

The end result is that in.txt file is encrypted into mail.msg file so only the user having the private key matching user.pem public key can decrypt it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.