openssl enc issues deprecation warnings #3

New issue

Closed

opened 2022-02-15 12:10:55 +01:00 by heiko · 1 comment

heiko commented

2022-02-15 12:10:55 +01:00

Owner

If the blocks are saved encrypted, we use openssl enc with a passphrase file. Newer OpenSSL implementations issue a warning that
-iter or -pbkdf2 should be used.

Just adding the wanted options doesn't help, as for decrypting we need to kow the value of -iter or -pbkdf2.

A possible workaround is a re-encryption of the whole backups. Maybe this isn't a workaround only, as it increases security, but it is quite demanding in terms of CPU and disk usage, I suppose.

If the blocks are saved encrypted, we use `openssl enc` with a passphrase file. Newer OpenSSL implementations issue a warning that `-iter` or `-pbkdf2` should be used. Just adding the wanted options doesn't help, as for decrypting we need to kow the value of `-iter` or `-pbkdf2`. A possible workaround is a re-encryption of the whole backups. Maybe this isn't a workaround only, as it increases security, but it is quite demanding in terms of CPU and disk usage, I suppose.

heiko self-assigned this

2022-02-15 12:10:56 +01:00

heiko referenced this issue from a commit

2022-02-20 22:43:44 +01:00

Introduce .2 for "-aes-128-cbc -pdkdf2" (closes #3)

heiko closed this issue

2022-02-20 22:43:44 +01:00

heiko referenced this issue from a commit

2022-02-20 22:47:34 +01:00

Introduce .2 for "-aes-128-cbc -pdkdf2" (closes #3)

heiko commented

2022-02-21 13:03:13 +01:00

Author

Owner

New backups are now created using the .2 extension and using OpenSSL options that avoid the warning.

We should think about a way to re-encrypt existing backups.

New backups are now created using the `.2` extension and using OpenSSL options that avoid the warning. We should think about a way to re-encrypt existing backups.

heiko added a new dependency

2022-02-21 13:03:28 +01:00

#4 provide tool for re-encryption