Deriving a key from a password on the command line

Producing an encryption key from a password on the command line can be done using the openssl kdf subcommand. This is a new subcommand that was added in OpenSSL 3.0. You can read its documentation on the openssl-kdf man page:

$ man openssl-kdf

Before deriving the key, let’s generate 128-bit salt:

$ openssl rand -hex 16
cf0e0acf943629ecffea41c87bab94d4

Now we can derive a 256-bit key suitable for symmetric encryption. Let’s use the Scrypt KDF. OWASP recommended brute-force-resistant settings and the password SuperPa$$w0rd:

$ openssl kdf \
  -keylen 32 \
  -kdfopt 'pass:SuperPa$$w0rd' \
  -kdfopt hexsalt:cf0e0acf943629ecffea41c87bab94d4 \
  -kdfopt n:65536 -kdfopt r:8 -kdfopt p:1 \
  SCRYPT
D0:3D:31:A1:A2:2A:F6:68:99:B3:02:22:60:3B:D7:21:5B:15:5B:80:2B:85:33:36:E6:3B:AB:F9:EE:8F:FE:C7

Note that the command-line argument containing the password...