bad magic number on decrypt

Question

In April I encrypted a file using the command

openssl enc -aes-256-cbc -salt -pass file:<passwordfile> < infile > outfil

Now I want to decrypt it with

openssl enc -d -aes-256-cbc -salt -pass file:<passwordfile> -in outfil -out infile2

but I get bad magic number.

A file encrypted yesterday with the same parameters decrypts ok.

What could have happened? and is there anyway I can retrieve this archived file?

score 7 · Answer 1 · answered Nov 08 '17 at 14:41

7

If you encrypted with OpenSSL <=1.0.2 and you are decrypting with OpenSSL 1.1.0 then it is probably this:

https://www.openssl.org/docs/faq.html#USER3

The default hash used to generate the key from the password changed between 1.0.2 and 1.1.0. Try adding -md md5 onto your decryption command.

answered Nov 08 '17 at 14:41

Matt Caswell

311

1

thanks I was afraid it might be something like this We are in an unusual situtaion wanting to restore something this old. I will give this a try – KathyHH Nov 09 '17 at 15:09
1

A mismatch in defaulted pbe-hash (or specifying the wrong hash or just the wrong password) will cause garbage decrypt which for a CBC-mode cipher (as here) will almost always be detected as 06065064 'bad decrypt' -- but not 'bad magic number'. Only a damaged file, or one encrypted with -nosalt or a really ancient OpenSSL (before 0.9.6 at most) does that. – dave_thompson_085 Apr 28 '19 at 06:33

score 5 · Answer 2 · answered Jul 04 '22 at 23:04

5

Just for completeness: encrypting with -a params ( Perform base64 encoding/decoding (alias -base64) ) and decrypting without it, bad magic number given.

answered Jul 04 '22 at 23:04

Giuseppe Canale

151

This is the key! Thanks – Joaquin Iurchuk Apr 10 '23 at 15:06

score 3 · Answer 3 · answered Apr 27 '19 at 20:24

The general cause for this error is that the key computed by OpenSSL from the password is wrong, meaning not the same as the key that encrypted the data.

One reason when this error can show up, in a different situation than the original question, is if you are encrypting using another tool than OpenSSL, for example encrypting in Java, and decrypting using SSL.

See solution here for Java: https://stackoverflow.com/questions/22610761/aes-simple-encrypt-in-java-decrypt-with-openssl/55884564#55884564

score 2 · Answer 4 · edited Jul 02 '18 at 08:58

2

The command below gave me pain:

openssl aes-256-cbc -d -in hotmama.tar.bz2.enc -out hotmama.tar.bz2
enter aes-256-cbc decryption password:
bad magic number

And the below command solved it, and gave me pleasure:

openssl aes-256-cbc -md md5 -in hotmama.tar.bz2.enc -out hotmama.tar.bz2
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:

edited Jul 02 '18 at 08:58

Thomas

6,362

answered Dec 15 '17 at 18:16

daparic

286

13

In the second command, you are not decrypting (-d) ... – blueFast Aug 08 '18 at 08:01

bad magic number on decrypt

4 Answers4

Linked