*** warning : deprecated key derivation used. using -iter or -pbkdf2 would be better.

Explanation

The warning you are seeing indicates that the key derivation method being used is deprecated. A key derivation function (KDF) is used to derive a cryptographic key from a password or passphrase. The function should be designed to be computationally expensive and increase the time needed to perform a brute-force attack on the generated key.

In the warning message, there are two suggestions for better alternatives: -iter and -pbkdf2. Let’s explain each one in detail:

-iter

The “-iter” option refers to the number of iterations performed during the key derivation process. Increasing the number of iterations makes the key derivation slower and more secure. It adds computational burden for both legitimate users and potential attackers.

Here’s an example of using “-iter” option with a value of 10000 in a Python script:

    
      import hashlib

      password = "my_password"
      salt = "random_salt"
      iterations = 10000

      # Key derivation using hashlib.pbkdf2_hmac() with 10000 iterations
      key = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt.encode('utf-8'), iterations)
    
  

-pbkdf2

The “-pbkdf2” option suggests using the PBKDF2 (Password-Based Key Derivation Function 2) algorithm. PBKDF2 is a widely-used key derivation function that applies a pseudorandom function, such as a cryptographic hash, to the input password along with a salt and repeats the process multiple times to produce a derived key. It is considered more secure than some older key derivation functions.

Here’s an example of using “-pbkdf2” option with PBKDF2-SHA256 in the command line:

    
      openssl enc -aes-256-cbc -pbkdf2 -iter 10000 -in input.txt -out output.enc