Encrypting Files

Crypt Replacements

The *nix of yore came with a command named crypt that could be used for encrypting data. However, its level of security wasn’t very good, so it disappeared from the scene. Even if you can find the source for it, several tools break the encryption, so it should be avoided at all costs. However, the popularity of Crypt was already in place, and some older scripts used it. Today you have the choice of several replacements for Crypt.

Ccrypt

Ccrypt is based on the Rijndael block cipher. The same cipher is the basis of the AES specification. Internally ccrypt takes the specified password, which can be of any length, and hashes the key to 256 bits. As with almost all ciphers, the longer the password, the better the security.

Ccrypt is not symmetric, which means you have to specify whether you are encrypting a file or decrypting it. If you want to encrypt a file, you typically use the command ccrypt:

[laytonjb@home4 TEMP]$ ls -s
total 7288
 196 hpc_001.html  7092 MFS2007.pdf
[laytonjb@home4 TEMP]$ ccrypt hpc_001.html
Enter encryption key: 
Enter encryption key: (repeat) 
[laytonjb@home4 TEMP]$ ls -s
total 7288
 196 hpc_001.html.cpt  7092 MFS2007.pdf

Notice that the encrypted file size is about the same size as the unencrypted file for this text example.

One thing you should pay particular attention to is that ccrypt encrypts the file but does not leave the original file in place. I worry about this because if a problem crops up during the encryption process, the file may be corrupted.

The final thing to notice is that ccrypt does not echo the passphrase to stdout, so the shell history cannot capture it.

To decrypt the file, you can run the following command:

[laytonjb@home4 TEMP]$ ccrypt -d hpc_001.html.cpt 
Enter decryption key: 
[laytonjb@home4 TEMP]$ ls -s
total 7288
 196 hpc_001.html  7092 MFS2007.pdf

The -d option just means “decrypt.”

Bcrypt

Another encryption option is bcrypt. Bcrypt uses the blowfish encryption algorithm with passphrases of between 8 and 56 characters. It also uses an internal 448-bit hashed key. The blowfish algorithm itself seems to provide a good level of encryption if you don’t use weak keys (use longer passwords), but the bcrypt code itself hasn’t been updated in a while. However, various versions of Bcrypt exist for many operating systems, including Linux, *nix, Windows, OS X, and others.

Encrypting a file using bcrypt is very simple:

[laytonjb@home4 TEMP]$ bcrypt hpc_001.html 
Encryption key:
Again:
[laytonjb@home4 TEMP]$ ls -s
total 7116
  24 hpc_001.html.bfe  7092 MFS2007.pdf

Notice that the encryption process did not leave the original file in place, but it reduced the size of the encrypted file relative to the original file size.

You should also note that Bcrypt does not echo the passphrase to stdout. This means the shell history will not capture it (always a good thing).

Decrypting is also very similar:

[laytonjb@home4 TEMP]$ bcrypt hpc_001.html.bfe 
Encryption key:
[laytonjb@home4 TEMP]$ ls -s
total 7288
 196 hpc_001.html  7092 MFS2007.pdf

Bcrypt is a symmetric cipher because it can detect whether the file is encrypted and then decrypts; hence, there is no need for a decrypt option.

MCrypt

Another replacement option for crypt is mcrypt. It has a very large number of cryptography algorithms. A few of which include:

• Blowfish
• DES
• Loki
• Mars
• Rijndael (up to 256 block size)
• Twofish
• Triple DES

It has a number of modes of encryption that provide additional capability beyond just a straight block cipher. You can read about that at an on-line MCrypt man page.

Using mcrypt is very similar to the other Crypt replacement tools:

[laytonjb@home4 TEMP]$ ls -s
total 7288
 196 hpc_001.html  7092 MFS2007.pdf
[laytonjb@home4 TEMP]$ mcrypt hpc_001.html
Enter the passphrase (maximum of 512 characters)
Please use a combination of upper and lower case letters and numbers.
Enter passphrase: 
Enter passphrase: 
 
File hpc_001.html was encrypted.
[laytonjb@home4 TEMP]$ ls -s
total 7484
 196 hpc_001.html   196 hpc_001.html.nc  7092 MFS2007.pdf

In contrast to ccrypt and bcrypt, mcrypt creates an encrypted file that is different from the original file; however, the encrypted text file is basically the same size as the unencrypted file.

Also note that like the other Crypt tools, MCrypt does not echo the passphrase to stdout.

Summary

I didn’t want this article to be just a survey of command-line tools for encrypting files, but I think it’s important to compare the tools with one another so you can see the various features (or quirks) and how they might affect your workflow and your security. It’s not a complete list of all tools available. For example, I didn’t cover the ability of Vim to encrypt files while editing them. Nor did I cover commercial tools – only open-source. However, I hope I have covered the tools that illustrate the various capabilities.

As I mentioned earlier, I’m not a security expert, but I do take security seriously. In examining command-line tools that encrypt and decrypt tools I’ve developed a few general principles I follow.

• Passphrase length: The length of the passphrase is very important. Try to make it as long as you can because a long length makes it more difficult to crack. One suggestion I have is to take a long-ish sentence or quote or movie line that you can remember and use that as your passphrase. You can also take two shorter phrases and combine them into a single phrase.
• Passphrase variety: If your data is important to you, I would recommend using several different passphrases and rotating them. You don’t have to have a large number of passphrases, but you shouldn’t use the same passphrase all of the time. By having different passphrases, if one of them happens to be cracked, then you won’t lose all of your data.
• Character combinations: As with passwords, I would also suggest you use a combination of uppercase, lowercase, numbers, and special characters in your passphrase. Some rules of thumb are floating around the web that you should not use groups of words followed by a short group of numbers such as “111” because some cracking tools look for these patterns. However, don’t complicate your passphrases to the point you will easily forget them.
• Practice: Before you start encrypting files on a regular basis as part of a process, practice with your passphrases. Make sure you can remember what the passphrase is so that you won’t lose any data.
• Keys: Consider using keys rather than passphrases to make life a bit easier. You can also put the keys on a simple USB stick, encrypt them, and put them in a safe location (or lock them up). In the case of GPG, you should also use 64-bit key IDs.
• Echo passphrase: If possible, do not put the passphrase on the command line because the shell history will pick it up. If someone can gain access to the history file, they will have your passphrase. Also make sure that the encryption tool does not echo the passphrase to stdout.
• Large hash key: Use a cipher with the longest possible hash key for the best encryption. In general, the longer the hash key, the more difficult it will be to decrypt a file. I tend to like 256 bits, but I would like to go larger. However, just be aware that the larger the key, the more CPU, and possibly memory, it will take to encrypt the file.
• What to encrypt: What files you encrypt or not is completely up to you. Personally, I like to use command-line encryption rather than encrypted filesystems because I don’t want nor need to encrypt everything. For example I’m not going to encrypt my desktop background pictures since I don’t view them as sensitive in any way. However, I will encrypt special tax information or email I consider sensitive and personal. Just please don’t encrypt your cat pictures.

Notice in this list that I didn’t mention anything about data compression. It’s really your choice if you want to encrypt a file as well as compress it using tools such as zip or p7zip, or to use compression tools before and separate from encrypting the file. I like to compress my files before encrypting them so I can save as much space as possible. I will also use tar as often as possible to collect the files into a single archive.

In my opinion, encryption can be a very important tool to protect your privacy. Think about making encryption a part of your everyday processes.