encrypt tape files with openssl and tar

Question

I am trying to add encryption to my current tape backup scripts by piping the output through openssl, at the moment I have :

tar -czpvf /dev/nst0 /home /otherdir

so adding openssl gives this :

tar czpvf - /home /otherdir | openssl aes-256-cbc -e -salt -pass file:/my_passwd > /dev/nst0

which does not give any errors, however the only way I can find on the net to do a decrypt is :

dd if=/dev/nst0 conv=sync | openssl aes-256-cbc -d -salt -pass file:/my_passwd | tar xzpvf -

this gives the correct file listing but I get :

bad decrypt 8340:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:461:

every time.

What can I do to fix this?

Answer 1

I think it might have to do with using a block cipher.

I get a similar error when I do:

$ tar czpvf - /test/directory |openssl aes-256-cbc -e -salt -pass pass:password | dd of=/tmp/foo.encrypted.tgz
$ dd if=/tmp/foo.encrypted.tgz conv=sync | openssl aes-256-cbc -d -salt -pass pass:password |tar xzpvf -

But when I use a streaming cipher like rc4, e.g.:

$ tar czpvf - /test/directory |openssl rc4 -e -salt -pass pass:fred | dd of=/tmp/foo.encrypted.tgz

I don't get that error.

Answer 2

Most of the time I've seen that kind of error message from OpenSSL is due wrong password. Can you temporarily try if replacing file:/my_passwd with pass:yourpassword at decrypt line proceeds OK? This, of course, would be a bad permanent solution but try this for debugging.