Is there an encryption tool that won't return an error?

lucmove · 03-08-2022, 08:30 AM

I could swear that a wrong password on decryption would cause openssl (command line) to just output garbage without any indication of a bad password. I thought that was great for thwarting brute force attacks. But I just tested it and it does return an error. Did they change the tool's behavior or is my memory wrong? More important, is there any encryption tool that will output garbage and give no other hints of a bad password? GPG also returns an error BTW.

TIA

wpeckham · 03-08-2022, 09:17 AM

Quote:

Originally Posted by lucmove

I could swear that a wrong password on decryption would cause openssl (command line) to just output garbage without any indication of a bad password. I thought that was great for thwarting brute force attacks. But I just tested it and it does return an error. Did they change the tool's behavior or is my memory wrong? More important, is there any encryption tool that will output garbage and give no other hints of a bad password? GPG also returns an error BTW.

TIA

Interesting question, but it occurs to me that such an encryption tool would be nearly worthless for the most common cases.
Your usage is atypical.
You might want to grab the code for a tool that can encrypt/decrypt and modify it to suppress error detection and error code return.

lucmove · 03-08-2022, 09:24 AM

It would not be nearly worthless. It would seriously make brute force more difficult.

Modifying an existing tool is the worthless option. It would only work as expected for me, who already has the password. An attacker would just use the unmodified tool.

Michael Uplawski · 03-08-2022, 03:25 PM

Quote:

Originally Posted by lucmove

It would not be nearly worthless. It would seriously make brute force more difficult.

Modifying an existing tool is the worthless option. It would only work as expected for me, who already has the password. An attacker would just use the unmodified tool.

Too much effort for a security issue that is created on the user side.

ondoho · 03-08-2022, 11:54 PM

I agree with the 2 other comments, however, why don't you show us the actual command(s)?
Maybe something did change.

lucmove · 03-09-2022, 01:18 PM

Quote:

Originally Posted by ondoho

I agree with the 2 other comments, however, why don't you show us the actual command(s)?
Maybe something did change.

Encryption:

Code:

$ openssl aes-256-cbc -a -e -salt -in file.txt -out encryptedfile.txt

Decryption:

Code:

$ openssl aes-256-cbc -a -d -in encryptedfile.txt -out decryptedfile.txt

ondoho · 03-10-2022, 01:10 AM

Quote:

Originally Posted by lucmove

Encryption:

Code:

$ openssl aes-256-cbc -a -e -salt -in file.txt -out encryptedfile.txt

Decryption:

Code:

$ openssl aes-256-cbc -a -d -in encryptedfile.txt -out decryptedfile.txt

Code:

$ openssl aes-256-cbc -a -d -in encryptedfile.txt -out decryptedfile.txt
enter aes-256-cbc decryption password:
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
bad decrypt
140049431397632:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:crypto/evp/evp_enc.c:610:

lucmove · 03-10-2022, 04:10 PM

What does that mean?