Package: crytto
filecrypt - OpenSSL file encryptionAuthorM. MassenzioVersion   0.7.2
Updated   2020-04-30
Codebitbucket.orgoverviewUses OpenSSL library to encrypt a file using a private/public key pair
and a one-time secret.A full description of the process can be foundhere.See also thisblog
entryfor more details.installationInstall directly from PyPi:pip install cryttoPlease note thepackage name(filecryptwas conflicting with the
existingFileCryptpackage name, andcryptowas already taken).This requires OpenSSL to be installed on your machine:sudo apt-get install opensslAlternatively, clone the project from github and follow the instructions
below:git clone git@bitbucket.org:marco/filecrypt.gitOnce cloned, you can try out functionality by packaging it as a
self-contained executable: use thepackage.shscript to generate afilecrypt.pyzself-extracting executable in thedist/folder and
then you can encrypt/decrpyt files (see theconfigurationsection first).```shell script # To encrypt ./filecrypt.pyz -o test.enc
/path/to/my_plaintext.txtTo decrypt:./filecrypt.pyz -d -o /path/to/whatever.txt test.enc ```Once all dependencies are installed:pip install -r requirements.txttests can be run via:./run_tests.shSee both therun_testsandpackagescripts for examples of how to
use encryption/decryption.configurationThis uses a YAML file to describe the configuration; by default it
assumes it is in/etc/filecrypt/conf.ymlbut its location can be
specified using the-fflag.The structure of theconf.ymlfile is as follows:keys:
     private: sample.pem
     public: sample.pub
     secrets: .

store: keys.csv

##
# Any option below is optional and can be omitted.
#
# Where to store the encrypted file; the folder MUST already exist and the user
# have write permissions.  Defaults to the current directory; can be overridden
# using --out on the command line.
#
#out: /data/store/file

# Whether to securely delete the original plaintext file; by default it is kept.
# It can be overridden by using `--keep` when running `filecrypt`.  True by default.
shred: true

# Optional logging configuration - mostly useful to
# diagnose issues.  Default is WARN level.
logging:
   format: "%(asctime)s [%(levelname)-5s] %(message)s"
   level: WARNTheprivate/publickeys are a key-pair generated using theopenssl genrsacommand; the encryption key used to actually encrypt
the file will be created in thesecretsfolder, and afterward
encrypted using thepublickey and stored in the location provided.The name will bepass-key-nnnn.enc, wherennnnwill be a random
value between1000and9999, that has not been already used for a
file in that folder.The name of the secret passphrase can also be defined by the user, using
the--secretoption (it will be left unmodified):if it does not exist a random secure one will be created, used for
encryption, then encrypted and saved with the given path, while the
plain-text temporary version securely destroyed; ORif it is the name of an already existing file, it will be decrypted,
used to encrypt the file, then leftunchangedon disk.NOTEwe recommend NOT to re-use encryption passphrases, but always
generate a new secret.NOTEit is currently not possible to specify a plain-text
passphrase: we always assume that the given file has been encrypted
using theprivatekey.Thestorefile is a CSV list of:"Original archive","Encryption key","Encrypted archive"
201511_data.tar.gz,/opt/store/pass-key-001.enc,201511_data.tar.gz.enca new line will be appended at the end; any comments will be left
unchanged.usagekeypair generationWe do not provide the means to generate them (this will be done at a
later stage), but for now they can be generated using:openssl genrsa -out ./key.pem 2048
openssl rsa -in key.pem -out key.pub -outform PEM -pubouttheir path can then be specified in theconf.yamlfile.encryptionAlways use the--helpoption to see the most up-to-date options
available; anyway, the basic usage is:filecrypt my_secret.txtwhich will create amy_secret.txt.encfile in the current directory,
unless a different one has been specified using theoutoption in/etc/filecrypt/conf.yml.A completely random and cryptographically secure key will have been
created; used; and then encrypted to thesecretslocation, its full
path stored in the CSV keystore named in thestoreoption of the YAML
configuration file.Finally, the plaintext version of this key will have been safely
destroyed.A more elaborate one (see the example configuration inexamples/example_conf.yaml):filecrypt --conf example_conf.yaml -s secret-key.enc plaintext.txtwill create an encrypted copy of the file to be stored as/data/store/plaintext.txt.enc; the original filewill notbe
securely destroyed (usingshred); and the encryption key name and
location (the current directory, andsecret-key.enc) to be stored in
thekeys.csvfile:# Fragment of example_conf.yaml
...
store: keys.csv
out: /data/store
shred: falseSpecifying the encryption destinationBy default, the encrypted filename has the same name as the plaintext
file, with the.encextension appended; and it is saved to either the
current directory or theoutlocation specified in the configuration
YAML.By using the--out(-o) option, it is possible to specify the
location of the output encrypted file, either absolute, or relative to
the current directory:filecrypt -o mysecret.ser my_secret.docor:filecrypt -o secret/files/mysecret.ser my_secret.docRegardless of the means of specifying the input/outpup files, the full
path to both files willalwaysbe used in the CSV keystore,
regardless of whether a relative or absolute path was specified on the
command line.IMPORTANT>We recommend testing your configuration and command-line
options on test files:shrederases files in aterminalway that isnotrecoverable: if you mess up,you will lose data. > >You
have been warned.decryptionTo decrypt a file that has been encrypted using this utility, use the-dflag:decrypt -o example_conf.yaml -d plaintext.txtIf the encryption key (--secretor-s) is not specified, then the
application will try and locate the plaintext file in the keystore
specified in theconf.yamlusing thestorekey:store: keys.csv
...and derive the location of the encryption key from the entry, if one is
found.Please note thatonly the filename is used to lookup the keyand so
twoencryptedfilenames in different directories but with the same
name will be assumed to have been encrypted with the samepassphrase.Thepassphrasefile, is stored with its full path: if you move the
keys, or rename any of the folder in their path, you will have to update
thekeystore(or use the-sflag when decrypting).As with encryption, the--outflag can be used to specify the output
file; otherwise, the current directory will be used.The encrypted file will be left untouched: the--keepflagmaybe
used, but will have no effect and the value of theshred:option will
be ignored.As the encrypted file is already cryptographically secure a simplerm my_secret.doc.encwill be sufficient to guarantee privacy.sharing filesAs of0.5.x,cryttosupports encrypting a file using solely a Public
Key, and then the resulting ecnrypted file can be securely decrypted by
the owner of the Secret Key.The main use case is to enable Alice to send Bob an encrypted file, once
Bob has given her a copy of his Public key; call the latterbob.puband the file to sharemy_secret.txt, then Alice can execute:filecrypt --send --key bob.pub --out my-secret.ser my_secret.txtafter encryption, in the current directory there will be the following
two new files:my-secret.ser
pass-key-000854.encthe former is the encrypted contents ofmy_secret.txtand the latter
the encrypted passphrase (leaving out the--outargument would have
made the encrypted file's namemy_secret.txt.enc).Those files can be both sent to Bob or, even better, provided to him
separately for added security; either way, upon receiving them, Bob can
run the following (we assume thebob.pubwas the private half of the
configured key pair that he keeps in hisconfiguration
file):filecrypt -s pass-key-000854.enc --out alice_secret.txt -d my-secret.ser(again, leaving out the--outis useful when using the defaults, as
themy_secret.txt.encwould have turned back intomy_secret.txt--
in this case, the plaintext decrypted file would have been calledmy-secret.ser.out).referencesadetailed
HOW-TOwith the steps to encrypt a file manually;the originalAsk
Ubuntupost;OpenSSL;Ubuntu guide to
OpenSSL.