Encrypting Files

7-Zip

7-Zip is an open source tool for creating archives, compressing them, and encrypting them (much like zip). It has several algorithms for data compression:

• LZMA – Default; an improved and optimized version of the LZ77 algorithm.
• LZMA2 – An improved version of LZMA.
• PPMD – Dmitry Shkarin’s PPMdH with small changes.
• PCJ – A converter for 32-bit x86 executables.
• PCJ2 – A converter for 32-bit x86 executables.
• Bzip2 – The standard BWT algorithm.
• Deflate – The standard LZ77-based algorithm.

7-Zip also supports AES-256 for encryption and can encrypt file names and directory names.

Using 7-Zip is pretty easy and is very similar to using zip. Here, I encrypt the simple text file hpc_001.html:

[laytonjb@home4 TEMP]$ ls -s
total 7288
 196 hpc_001.html  7092 MFS2007.pdf
[laytonjb@home4 TEMP]$ 7z a -p hpc_001.html.7z hpc_001.html
 
7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,1 CPU)
Scanning
 
Creating archive hpc_001.html.7z
 
 
Enter password (will not be echoed) :
Verify password (will not be echoed) :
Compressing  hpc_001.html      
 
 
Everything is Ok
[laytonjb@home4 TEMP]$ ls -s
total 7308
 196 hpc_001.html    20 hpc_001.html.7z  7092 MFS2007.pdf

The options I used are: a, create archive, and -p, set password. By just specifying -p, 7-Zip (p7zip, the command-line version of 7-Zip) will prompt for the passphrase so that it won’t be copied into the shell history. However, you can input the passphrase on the command line.

A key point to note is that p7zip leaves the original file in place and creates a copy with a .7z extension. This might seem subtle, but it can be important. I like leaving the original file alone because if the encryption process goes sideways, I still have it available. I also like to decrypt the file and do a diff between the original file and the decrypted file. It might seem pointless to do this, but I like to make sure that the encryption and decryption processes worked correctly, AND I remember my passphrase.

To decrypt the file, you just use the -e (extract) option:

[laytonjb@home4 TEMP]$ 7z e hpc_001.html.7z 
 
7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,1 CPU)
 
Processing archive: hpc_001.html.7z
 
 
Enter password (will not be echoed) :
Extracting  hpc_001.html
 
Everything is Ok
 
Size:       198510
Compressed: 18945

As you can tell, p7zip gives you some detail about the decryption of the file. Also don’t forget that as part of the extraction, p7zip also uncompresses the file.

OpenSSL

SSL and its successor TLS were protocols developed to provide communication security over a network using cryptography. You are probably most familiar with the protocol in web browsers for websites beginning with https. You can take advantage of the encryption in SSL or TLS to encrypt your data.

The most common implementation of SSL is OpenSSL, an open-source community project for a full-featured toolkit implement of SSL and TLS, as well as general-purpose cryptography. It was subject of the infamous Heartbleed vulnerability that primarily affected the communication encryption aspect of OpenSSL. The cryptography library aspect of OpenSSL is still extremely useful.

OpenSSL has a number of ciphers, cryptographic hash functions, and public key encryption algorithms.

• Ciphers
  • AES
  • Blowfish
  • Camellia
  • SEED
  • CAST-128
  • DES
  • IDEA
  • RC2
  • RC4
  • RC5
  • Triple DES
  • GOST 28147-89
• Cryptographic hash functions
  • MD5
  • MD4
  • MD2
  • SHA-1
  • SHA-2
  • RIPEMD-160
  • MDC-2
  • GOST R 34.11-94
• Public-key cryptography
  • RSA
  • DSA
  • Diffie–Hellman key exchange
  • Elliptic curve
  • GOST R 34.10-2001

OpenSSL really focuses on encryption and decryption and not compression. Consequently, you shouldn’t expect the encrypted file to be smaller than the original file.

Using OpenSSL requires a few more arguments than the typical encryption tool:

[laytonjb@home4 TEMP]$ ls -s
total 7288
 196 hpc_001.html  7092 MFS2007.pdf
[laytonjb@home4 TEMP]$ openssl aes-256-cbc -salt -in hpc_001.html -out hpc_001.html.enc
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
[laytonjb@home4 TEMP]$ ls -s
total 7484
 196 hpc_001.html   196 hpc_001.html.enc  7092 MFS2007.pdf

The first option I use is aes-256-cbc, which tells OpenSSL to use the 256-bit key with OpenSSL, along with the AES cipher. The -in option specifies the input file, and -out specifies the output (encrypted) file.

The option -salt is added to the command line because it can be very important for improving security. Classically, a salt is a random bit of data that is used as an additional input to a one-way function that hashes the passphrase. It protects against dictionary attacks and against precomputed rainbow table attacks. The reason is that without the salt, the same password always generates the same encryption key. When the salt is used with OpenSSL, the first 8 bytes of the encrypted data are reserved for the salt (i.e., the random bit of data). When the file is decrypted, the salt is read from the encrypted file and used for decryption.

Notice that OpenSSL does not echo the passphrase, so it can’t be captured in the shell history. Also, notice that OpenSSL doesn’t have a standard file extension. I chose .enc to show that the file is encrypted.

As I mentioned earlier, OpenSSL is just an encryption tool. It doesn’t do file compression. Consequently, the file size of the encrypted text file in the previous example is roughly the same as the original text file. OpenSSL can operate on a compressed file as well, but in a step that is done separately:

[laytonjb@home4 TEMP]$ openssl aes-256-cbc -salt -in hpc_001.html.gz \
-out hpc_001.html.gz.enc
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
[laytonjb@home4 TEMP]$ ls -s
total 7336
 196 hpc_001.html.enc    24 hpc_001.html.gz    24 hpc_001.html.gz.enc
7092 MFS2007.pdf

In this case, I used gzip to compress the file before using OpenSSL. Otherwise the process is the same. Notice the size difference between the encrypted compressed file, and the encrypted but uncompressed file.

Decrypting a file is also fairly easy using the -d option on the command line:

[laytonjb@home4 TEMP]$ openssl aes-256-cbc -d -in hpc_001.html.enc -out hpc_001.html.2
enter aes-256-cbc decryption password:
[laytonjb@home4 TEMP]$> ls -s
total 7680
 196 hpc_001.html   196 hpc_001.html.2   196 hpc_001.html.enc
7092 MFS2007.pdf