What is a more secure way for passing passwords to OpenSSL?

Question

With OpenSSL, there are two ways in bash to use an environment variable as a password:
pass:"${var}" and env:var.

I am wondering which method provides the most security, as the man page makes it seem like ps can read the password when passed as pass:"${var}", and that it might also be possible with env:var.

Relevant section of the OpenSSL man page:

Pass Phrase Arguments

Several commands accept password arguments, typically using -passin and -passout for input and output passwords respectively. These allow the password to be obtained from a variety of sources. Both of these options take a single argument whose format is described below. If no password argument is given and a password is required then the user is prompted to enter one: this will typically be read from the current terminal with echoing turned off.

pass:password

the actual password is password. Since the password is visible to utilities (like 'ps' under Unix) this form should only be used where security is not important.

env:var

obtain the password from the environment variable var. Since the environment of other processes is visible on certain platforms (e.g. ps under certain Unix OSes) this option should be used with caution.

Answer 1

The man page is pretty explicit on the matter, you should use the env:var method.

The man page is correct, all command line parameters are visible via ps to all users on the system.

alice$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:16384 -aes-128-cbc -pass pass:123456

evil$ ps aux|grep openssl                                                                                                                               
alice      17594  115  0.0  17108  4424 pts/6    R+   11:02   0:03 openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:16384 -aes-128-cbc -pass pass:123456

If you use an environment variable, another user (except root) will only be able to see the name of that variable but no its content.

alice$ OPENSSLPW=123456
alice$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:16384 -aes-128-cbc -pass env:OPENSSLPW

evil$ ps aux|grep openssl                                                                                                                               
alice      17713  115  0.0  17108  4424 pts/6    R+   11:02   0:03 openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:16384 -aes-128-cbc -pass env:OPENSSLPW