Using key file as password with OpenSSL

Question

I got an assignment to decrypt a binary file which is encrypted using aes. I have a 32 byte binary file which is a key for decryption. I know how to decrypt if the key is a passphrase by using

openssl enc -d -aes-256-cbc -in file.out

In this case, the key is a binary file. How do I use it?

Solution

Add -pass file:nameofkeyfile to the OpenSSL command line. This causes OpenSSL to read the password/passphrase from the named file, but otherwise proceed normally.

For more details, see the man page for openssl(1) (man 1 openssl) and particularly its section "PASS PHRASE ARGUMENTS", and the man page for enc(1) (man 1 enc).

If the key file actually holds the encryption key (not something from which to derive the encryption key), then you want to use -K instead. For that, you need something like:

-K $(hexdump -v -e '/1 "%02X"' < nameofkeyfile)

in the OpenSSL command line instead of -pass. hexdump is used to transform the key file to the pure hexadecimal representation that OpenSSL wants.

Comments

[forest]

-1 If the keyfile contains a newline, then this will break. The file will only be read up to the first newline.

[Juan]

Note that OpenSSL does not "want" hex input. It expects the passphrase encoded in a particular way (e.g., it accepts valid UTF-8 characters). I was misled by this answer. Converting to hex is not necessarily bad, but strictly speaking not what openssl wants. See the passphrase-encoding(7) man page (which may not have existed in 2013 with older versions of openssl).

[Juan]

By the way, the comment from @forest (not applicable after the answer was edited to add the hexdump) is a hint to other failures. Specifically, binary represenation of the passphrase is not a valid encoding and not a good choice for a passphrase. Here's an example where a 0x00 byte caused someone issues: alexander-stoyan.blogspot.com/2013/08/…