Our great sponsors
-
age
A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
-
WorkOS
The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
I like the fact that your script is simple, and uses a ubiquitous library! But I do have a few suggestions:
1. You may be using an older version of openssl, but with modern versions, add the `-pbkdf2` option for much saner key derivation.
2. With modern versions of openssl, the `-salt` option is on by default, so you don't need to specify it explicitly (and you almost certainly want this option on, versus not using a salt or generating one yourself).
3. Since no AEAD modes are available with this tool, CTR mode (the `-aes-256-ctr` option) might be the best mode to use with AES (see https://security.stackexchange.com/questions/27776/block-cha...).
4. Alternatively, you might prefer to use ChaCha20 (the `-chacha20` option) over AES (see https://crypto.stackexchange.com/questions/34455/whats-the-a...).
So I would suggest this for the encryption command (instead of `openssl enc -aes-256-cbc -salt -a`):
> openssl enc -chacha20 -pbkdf2 -a
Also, instead of using openssl, you might prefer to use `age`, as it uses modern crypto best practices by default (see https://age-encryption.org/). With it, you could substitute this encryption command for the above:
> age -p -a