3

I have a php document repository application running on windows apache, this application will aes-encrypt any uploaded document with the following command:

echo MyPass34 | openssl.exe aes-256-cbc -pass stdin -salt -in somefile.pdf -out somefile.pdf

and also decrypt them when they are downloaded, with the following command:

echo MyPass34 | openssl.exe aes-256-cbc -pass stdin -d -in somefile.pdf -out decriptedfile.pdf

the application has been working fine so far, people are uploading and downloading their files while they are kept encrypted on the server, the problem now is this application has been moved to an apache linux server, and now the files that where encrypted on windows are not correctly decrypted on linux.

Why is this? Is there a possible tweak to the decryption command so it correctly decrypt that files again?

PS: New files that are encrypted on linux are correctly decrypted, same as in windows, is the encoded-on-windows decoded-on-linux case that is failing.

Nelson
  • 49,283
  • 8
  • 68
  • 81

1 Answers1

6

I found the solution :-), the problem is the windows echo command adds three characters to the end of password, that are space,CR and LF characters, and the linux echo command seems to not feed those characters and so the openssl command is not receiving the same password used to encrypt.

The solution was to add those three characters to the password in Linux, that is possible because the echo command has escape sequences to insert hexadecimal values.So, following my example, the correct decrypt command that is now working for me in linux is:

echo $'MyPass34\x20\x0d\x0a' | /usr/bin/openssl aes-256-cbc -pass stdin -d -in somefile.pdf -out decriptedfile.pdf

Hope this can help someone!

Nelson
  • 49,283
  • 8
  • 68
  • 81
  • You can use `-k 'MyPass34'` to directly specify the passphrase the openssl, rather than using a pipe. – caf Jan 21 '11 at 05:40
  • 1
    Don't forget that on Linux, it is possible to view the parameters of any process with the "ps" command. It's better to put the password somewhere that doesn't require it to EVER be on the command line, or in any visible location. – Julie in Austin May 07 '12 at 12:24