Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to add encryption to my current tape backup scripts by piping the output through openssl, at the moment I have :

tar -czpvf /dev/nst0 /home /otherdir

so adding openssl gives this :

tar czpvf - /home /otherdir | openssl aes-256-cbc -e -salt -pass file:/my_passwd > /dev/nst0

which does not give any errors, however the only way I can find on the net to do a decrypt is :

dd if=/dev/nst0 conv=sync | openssl aes-256-cbc -d -salt -pass file:/my_passwd | tar xzpvf -

this gives the correct file listing but I get :

bad decrypt 8340:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:461:

every time.

What can I do to fix this?

share|improve this question
Have you tried using different tapes? – jftuga Nov 1 '11 at 15:55
@jftuga I have tried two different tapes so far. – Tim the Enchanter Nov 1 '11 at 16:13
up vote 2 down vote accepted

I think it might have to do with using a block cipher.

I get a similar error when I do:

$ tar czpvf - /test/directory |openssl aes-256-cbc -e -salt -pass pass:password | dd of=/tmp/foo.encrypted.tgz
$ dd if=/tmp/foo.encrypted.tgz conv=sync | openssl aes-256-cbc -d -salt -pass pass:password |tar xzpvf -

But when I use a streaming cipher like rc4, e.g.:

$ tar czpvf - /test/directory |openssl rc4 -e -salt -pass pass:fred | dd of=/tmp/foo.encrypted.tgz

I don't get that error.

share|improve this answer
Ah, if you're using a block cipher, try the "-nopad" option for openssl. There must be some sort of junk floating around as an artifact of how the tape stream is being chopped up into plain text blocks. – cjc Nov 1 '11 at 19:06
Thank you! It was the block cipher that caused it, both of your suggestions, to change to RC4 or add the -nopad option worked. It now decrypts with gzip only complaining about the tar padding tar and blocking, which is just a gzip tar annoyance. – Tim the Enchanter Nov 2 '11 at 13:00

Most of the time I've seen that kind of error message from OpenSSL is due wrong password. Can you temporarily try if replacing file:/my_passwd with pass:yourpassword at decrypt line proceeds OK? This, of course, would be a bad permanent solution but try this for debugging.

share|improve this answer
Thank you for the suggestion I get the same error message as with the file: option. – Tim the Enchanter Nov 1 '11 at 15:00

You need to pad the input to the block cipher. Try piping your tar to dd with a blocksize of 4k and the conv=sync option. This will pad the end of the data.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.