ezcrypt

A tool for strong encryption of arbitrary files.

Principles

Encryption is done in four layers. At each level a different cipher is used, and each level has its own encyrption key and its own initialization vector (IV). The different ciphers are:

1. AES, CBC, 256-bit key (outermost level)
2. ChaCha, 20 rounds, 256-bit key
3. Twofish, CBC, 256-bit key
4. Serpent, CBC, 256-bit key (innermost level)

The key at each level is generated from a combination of the user supplied passphrase and a per-level 256-bit salt. This is done using a custom compute intensive key derivation function called ZKDF.

The salt and the IV for each encryption level is generated from system level entropy (i.e. highly random data), and is different for each run of ezcrypt. Thus encrypting the same file twice will result in two different ciphertexts (even if the same passphrase is used).

Note that the encrypted file does not contain any header or other identification metadata. This is by design.

Features

Easy to use

• Plain and simple encryption/decryption of any file with a passphrase.
• No cryptographic keys required.
• Familiar CLI interface, similar to gzip.
• Fully self contained without any dependencies on 3rd party crypto components.

Resistant against cryptanalytic attacks

• High cost key-derivation function, making brute-force passphrase attacks impractical.
  • Configurable cost, up to several minutes per passphrase-to-key derivation on a 5 GHz CPU core.
  • Cache hard algorithm, making GPU implementations inefficient.
  • Strong salt, making precomputed rainbow table attacks impractical.
• Strong encryption, making brute-force key attacks impractical.
  • Four levels of encryption, each with a 256-bit key.
  • The total effective key space is 2¹⁰²⁴.
• The decryption algorithm does not know nor report whether the passphrase was correct or not.
  • Decryption always produces a result (with an incorrect passphrase the result will be garbage).
  • An attacker has to inspect the decrypted message and heuristically determine if it is correct.

Free, open source and public domain

All code is free and unencumbered software released into the public domain, including the cryptographic algorithms.

For more information, see unlicense.org.

Building

mkdir out && cd out
cmake -G Ninja -DCMAKE_BUILD_TYPE=Release ../src
ninja

The resulting executable file is out/ezcrypt.

Testing

To run the unit tests:

CTEST_OUTPUT_ON_FAILURE=ON ninja test

Installing

After building:

sudo ninja install

Example usage

Encrypt a file

Encrypt the file myfile, with the passphrase provided via a terminal prompt. The output file is called myfile.z (the original file is kept):

$ ezcrypt myfile
Enter passphrase:
Again:

Decrypt a file

Decrypt the file myfile.z, with the passphrase provided via a terminal prompt. The output file is called myfile (the original file is kept):

$ ezcrypt -d myfile.z
Enter passphrase:

Decrypt and print a file

Decrypt the file myfile.z to stdout, with the passphrase provided via the environment variable $SECRET:

$ ezcrypt --show -E SECRET myfile.z

Encrypt & decrypt via pipes

$ echo "Hello world!" | ezcrypt -E SECRET | ezcrypt -d -E SECRET
Hello world!

Edit an encrypted text file

Edit the plaintext contents of the encrypted file myfile.z, using the default text editor (e.g. $EDITOR or notepad.exe):

$ ezcrypt --edit myfile.z

Note: If the plaintext is not modified by the editor, myfile.z remains unmodified. This is useful if you accidentally use the wrong passphrase (you will notice right away since the plaintext will appear as garbage), in which case you can juse exit the editor.