OpenSSL encryptor: deprecated key derivation used #949

jspeedz · 2019-09-05T09:09:05Z

What went wrong?

I'm getting deprecation warnings with openSSL encryption.

[2019/09/05 08:38:52][info] Using Encryptor::OpenSSL to encrypt the archive.
[2019/09/05 08:40:22][warn] Pipeline STDERR Messages:
[2019/09/05 08:40:22][warn] (Note: may be interleaved if multiple commands returned error messages)
[2019/09/05 08:40:22][warn]
[2019/09/05 08:40:22][warn] *** WARNING : deprecated key derivation used.
[2019/09/05 08:40:22][warn] Using -iter or -pbkdf2 would be better.

What steps did you follow?

backup perform --trigger config
Check the log output

How is your copy of backup configured?

Use config encryption step:

encrypt_with OpenSSL do |encryption|
encryption.password = 'Some password'
encryption.base64 = true
encryption.salt = true
end

Tell us about the computer that runs the backup gem

Operating system: Ubuntu 18.04.2 LTS
Backup 4.4.1
openssl version OpenSSL 1.1.1 11 Sep 2018

jenrzzz · 2020-02-21T23:45:42Z

This can be fixed with a monkeypatch in config.rb.

module OpenSSLFixDeprecatedKeyDerivation
  def options
    super + ' -pbkdf2'
  end
end

require 'backup/encryptor/open_ssl'
Backup::Encryptor::OpenSSL.prepend(OpenSSLFixDeprecatedKeyDerivation)

OpenSSL 1.1.1+ or LibreSSL 2.9.1+ will be required to decrypt, and you'll need to pass -pbkdf2:

openssl aes-256-cbc -d -md sha256 -pbkdf2

elthariel added Someone take a look at this! good first issue labels Dec 9, 2019

backup / backup Public

OpenSSL encryptor: deprecated key derivation used #949

OpenSSL encryptor: deprecated key derivation used #949

jspeedz commented Sep 5, 2019

jenrzzz commented Feb 21, 2020

backup / backup Public

OpenSSL encryptor: deprecated key derivation used #949

OpenSSL encryptor: deprecated key derivation used #949

Comments

jspeedz commented Sep 5, 2019

What went wrong?

What steps did you follow?

How is your copy of backup configured?

Tell us about the computer that runs the backup gem

jenrzzz commented Feb 21, 2020