Latest update.

doc/man1/openssl-enc.pod

@@ -6,39 +6,42 @@ openssl-enc - symmetric cipher routines
 
 =head1 SYNOPSIS
 
-B<openssl enc -I<cipher>>
+B<openssl> B<enc>|I<cipher>
+[B<-I<cipher>>]
 [B<-help>]
 [B<-ciphers>]
-[B<-in filename>]
-[B<-out filename>]
-[B<-pass arg>]
+[B<-in> I<filename>]
+[B<-out> I<filename>]
+[B<-pass> I<arg>]
 [B<-e>]
 [B<-d>]
 [B<-a>]
 [B<-base64>]
 [B<-A>]
-[B<-k password>]
-[B<-kfile filename>]
-[B<-K key>]
-[B<-iv IV>]
-[B<-S salt>]
+[B<-k> I<password>]
+[B<-kfile> I<filename>]
+[B<-K> I<key>]
+[B<-iv> I<IV>]
+[B<-S> I<salt>]
 [B<-salt>]
 [B<-nosalt>]
 [B<-z>]
-[B<-md digest>]
-[B<-iter count>]
+[B<-md> I<digest>]
+[B<-iter> I<count>]
 [B<-pbkdf2>]
 [B<-p>]
 [B<-P>]
-[B<-bufsize number>]
+[B<-bufsize> I<number>]
 [B<-nopad>]
 [B<-debug>]
 [B<-none>]
-[B<-rand file...>]
-[B<-writerand file>]
-[B<-engine id>]
+[B<-rand> I<files>]
+[B<-writerand> I<file>]
+[B<-engine> I<id>]
 
-B<openssl> I<[cipher]> [B<...>]
+=for openssl ifdef z engine
+
+B<openssl> I<cipher> [B<...>]
 
 =head1 DESCRIPTION
 
@@ -59,18 +62,18 @@ Print out a usage message.
 
 List all supported ciphers.
 
-=item B<-in filename>
+=item B<-in> I<filename>
 
 The input filename, standard input by default.
 
-=item B<-out filename>
+=item B<-out> I<filename>
 
 The output filename, standard output by default.
 
-=item B<-pass arg>
+=item B<-pass> I<arg>
 
-The password source. For more information about the format of B<arg>
-see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)>.
+The password source. For more information about the format of I<arg>
+see L<openssl(1)/Pass Phrase Options>.
 
 =item B<-e>
 
@@ -94,23 +97,23 @@ Same as B<-a>
 
 If the B<-a> option is set then base64 process the data on one line.
 
-=item B<-k password>
+=item B<-k> I<password>
 
 The password to derive the key from. This is for compatibility with previous
 versions of OpenSSL. Superseded by the B<-pass> argument.
 
-=item B<-kfile filename>
+=item B<-kfile> I<filename>
 
-Read the password to derive the key from the first line of B<filename>.
+Read the password to derive the key from the first line of I<filename>.
 This is for compatibility with previous versions of OpenSSL. Superseded by
 the B<-pass> argument.
 
-=item B<-md digest>
+=item B<-md> I<digest>
 
 Use the specified digest to create the key from the passphrase.
 The default algorithm is sha-256.
 
-=item B<-iter count>
+=item B<-iter> I<count>
 
 Use a given number of iterations on the password in deriving the encryption key.
 High values increase the time required to brute-force the resulting file.
@@ -131,11 +134,11 @@ OpenSSL.
 Use salt (randomly generated or provide with B<-S> option) when
 encrypting, this is the default.
 
-=item B<-S salt>
+=item B<-S> I<salt>
 
 The actual salt to use: this must be represented as a string of hex digits.
 
-=item B<-K key>
+=item B<-K> I<key>
 
 The actual key to use: this must be represented as a string comprised only
 of hex digits. If only the key is specified, the IV must additionally specified
@@ -144,7 +147,7 @@ key given with the B<-K> option will be used and the IV generated from the
 password will be taken. It does not make much sense to specify both key
 and password.
 
-=item B<-iv IV>
+=item B<-iv> I<IV>
 
 The actual IV to use: this must be represented as a string comprised only
 of hex digits. When only the key is specified using the B<-K> option, the
@@ -160,7 +163,7 @@ Print out the key and IV used.
 Print out the key and IV used then immediately exit: don't do any encryption
 or decryption.
 
-=item B<-bufsize number>
+=item B<-bufsize> I<number>
 
 Set the buffer size for I/O.
 
@@ -182,28 +185,19 @@ or zlib-dynamic option.
 
 Use NULL cipher (no encryption or decryption of input).
 
-=item B<-rand file...>
+=item B<-rand> I<files>, B<-writerand> I<file>
 
-A file or files containing random data used to seed the random number
-generator.
-Multiple files can be specified separated by an OS-dependent character.
-The separator is B<;> for MS-Windows, B<,> for OpenVMS, and B<:> for
-all others.
-
-=item [B<-writerand file>]
-
-Writes random data to the specified I<file> upon exit.
-This can be used with a subsequent B<-rand> flag.
+See L<openssl(1)/Random State Options> for more information.
 
 =back
 
 =head1 NOTES
 
-The program can be called either as B<openssl cipher> or
-B<openssl enc -cipher>. The first form doesn't work with
+The program can be called either as C<openssl I<cipher>> or
+C<openssl enc -I<cipher>>. The first form doesn't work with
 engine-provided ciphers, because this form is processed before the
 configuration file is read and any ENGINEs loaded.
-Use the B<list> command to get a list of supported ciphers.
+Use the L<openssl-list(1)> command to get a list of supported ciphers.
 
 Engines which provide entirely new encryption algorithms (such as the ccgost
 engine which provides gost89 algorithm) should be configured in the
@@ -248,27 +242,26 @@ Blowfish and RC5 algorithms use a 128 bit key.
 
 Note that some of these ciphers can be disabled at compile time
 and some are available only if an appropriate engine is configured
-in the configuration file. The output of the B<enc> command run with
-the B<-ciphers> option (that is B<openssl enc -ciphers>) produces a
-list of ciphers, supported by your version of OpenSSL, including
+in the configuration file. The output when invoking this command
+with the B<-ciphers> option (that is C<openssl enc -ciphers>) is
+a list of ciphers, supported by your version of OpenSSL, including
 ones provided by configured engines.
 
-The B<enc> program does not support authenticated encryption modes
+This command does not support authenticated encryption modes
 like CCM and GCM, and will not support such modes in the future.
-The B<enc> interface by necessity must begin streaming output (e.g.,
-to standard output when B<-out> is not used) before the authentication
-tag could be validated, leading to the usage of B<enc> in pipelines
-that begin processing untrusted data and are not capable of rolling
-back upon authentication failure.  The AEAD modes currently in common
-use also suffer from catastrophic failure of confidentiality and/or
-integrity upon reuse of key/iv/nonce, and since B<enc> places the
+This is due to having to begin streaming output (e.g., to standard output
+when B<-out> is not used) before the authentication tag could be validated.
+When this command is used in a pipeline, the receiveing end will not be
+able to roll back upon authentication failure.  The AEAD modes currently in
+common use also suffer from catastrophic failure of confidentiality and/or
+integrity upon reuse of key/iv/nonce, and since B<openssl enc> places the
 entire burden of key/iv/nonce management upon the user, the risk of
 exposing AEAD modes is too great to allow.  These key/iv/nonce
-management issues also affect other modes currently exposed in B<enc>,
+management issues also affect other modes currently exposed in this command,
 but the failure modes are less extreme in these cases, and the
 functionality cannot be removed with a stable release branch.
 For bulk encryption of data, whether using authenticated encryption
-modes or other modes, L<cms(1)> is recommended, as it provides a
+modes or other modes, L<openssl-cms(1)> is recommended, as it provides a
 standard data format and performs the needed key/iv/nonce management.
 
 
@@ -410,7 +403,7 @@ Base64 decode a file then decrypt it using a password supplied in a file:
 
 The B<-A> option when used with large files doesn't work properly.
 
-The B<enc> program only supports a fixed number of algorithms with
+The B<openssl enc> command only supports a fixed number of algorithms with
 certain parameters. So if, for example, you want to use RC2 with a
 76 bit key or RC4 with an 84 bit key you can't use this program.