OpenSSL AES 256-bit Key Management I am using C and OpenSSL to encrypt files. After experimenting with the OpenSSL command line utility, it makes you enter a passphrase that can be any length, but uses that to create a 256-bit key.

How many passwords or keys does aes use &amp; how does it use them? If you can make your passphrase as long or as short as you want, what is the point of having a 256-bit encryption?
AES is a block cipher, a cryptographic primitive. It has no involvement with key derivation or anything of that nature. The three standard key sizes are 128 bit, 192 bit, and 256 bit. How you get those keys is beyond the purview of AES, which is concerned only with encryption. As I said, it is a cryptographic primitive, meaning it is meant to be used in a larger system (usually). In fact, "AES" itself can't encrypt more than one block of data; to do that, you need to use a block cipher mode of operation. I'd recommend, for non-authenticated schemes, either CTR or CBC, not ECB. But in general, you probably want one of the authenticated modes (AEAD), like GCM, OCB, EAX, or CCM. 

So, the fact that OpenSSL lets you use a passphrase is entirely unrelated to AES. Typically, I would recommend against using passphrases for encryption, as they are notoriously low-entropy and vulnerable to simple guessing. OpenSSL does use a salt by default, which improves things, but the algorithm it uses is "somewhat" questionable. The default hash function used in it is MD5, and it only uses just a few rounds by default. So, if possible, I would very highly recommend you generate a real key instead of using a passphrase. And, like your question implies, if the adversary knows your file is encrypted with a passphrase, it makes using a larger key sort of moot.

Just remember that AES was designed as a block cipher, so the whole passphrase business is really separate from it. Anyway, if you are interested in the practical differences in AES-128, AES-192, and AES-256, there are several good questions on this site with good answers:


What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
What is the effect of the different AES key lengths?
Is AES-256 a post-quantum secure cipher or not?