3

I recently updated my computer to 64 bit Debian testing. Since then, decryption of files that were encrypted with openssl on 32 bit Debian does not work anymore.

I used to encrypt files like so:

$ openssl des3 -in bla.txt -out bla.txt.des3

and decrypt like this:

$ openssl des3 -d -in bla.txt.des3 -out bla.txt

This still works if I chroot into a backup of the old 32 bit Debian testing installation. On the 64 bit install, I get the following error:

$ openssl des3 -d -in bla.txt.des3 -out bla.txt
enter des-ede3-cbc decryption password:
bad decrypt
140219224302720:error:06065064:digital envelope outines:EVP_DecryptFinal_ex:bad decrypt:crypto/evp/evp_enc.c:529:

Which is the correct way to invoke openssl on the 64 bit Debian testing system to decode the files?

EDIT version information:

old (32-bit in chroot):

$ openssl version
OpenSSL 1.0.2j  26 Sep 2016
$ dpkg -l | grep ssl
ii  libssl1.0.2:i386                                            1.0.2j-1                             i386         Secure Sockets Layer toolkit - shared libraries
ii  openssl                                                     1.0.2j-1                             i386         Secure Sockets Layer toolkit - cryptographic utility
ii  ssl-cert                                                    1.0.38                               all          simple debconf wrapper for OpenSSL
$ ldd /usr/bin/openssl
  linux-gate.so.1 (0xf7729000)
  libssl.so.1.0.2 => /usr/lib/i386-linux-gnu/libssl.so.1.0.2 (0xf769c000)
  libcrypto.so.1.0.2 => /usr/lib/i386-linux-gnu/libcrypto.so.1.0.2 (0xf7498000)
  libdl.so.2 => /lib/i386-linux-gnu/libdl.so.2 (0xf7493000)
  libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf72dc000)
  /lib/ld-linux.so.2 (0x5663b000)

new (64-bit):

$ openssl version
OpenSSL 1.1.0c  10 Nov 2016
$ dpkg -l | grep ssl
ii  libssl1.0.2:amd64                                           1.0.2j-4                          amd64        Secure Sockets Layer toolkit - shared libraries
ii  libssl1.1:amd64                                             1.1.0c-2                          amd64        Secure Sockets Layer toolkit - shared libraries
ii  openssl                                                     1.1.0c-2                          amd64        Secure Sockets Layer toolkit - cryptographic utility
ii  ssl-cert                                                    1.0.38                            all          simple debconf wrapper for OpenSSL
$ ldd /usr/bin/openssl 
linux-vdso.so.1 (0x00007ffe63c76000)
libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f9b74487000)
libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f9b73ff6000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f9b73df2000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f9b73bd5000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f9b73837000)
/lib64/ld-linux-x86-64.so.2 (0x000055a182164000)
  • 32-bit and 64-bit is not really useful. What is the old version of Debian and OpenSSL; and what is the new version of of Debian and OpenSSL? – jww Jan 10 '17 at 18:47
  • I added what I hope is the relevant information. – hochl Jan 13 '17 at 14:21
2

That is because the default for the message digest has changed from md5 to sha-256 in OpenSSL 1.1.0. Decrypting stuff using the old digest remains possible, if you make it explicit:

openssl des3 -d -in bla.txt.des3 -out bla.txt -md md5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.