Ah, in that case I think `-aes-256-gcm` is probably your best option (which isn't available with regular old OpenSSL).