Solid, command-line file encryption tool?

[tranglos]

Tangentially related to mouser's ongoing search for an online backup solution. I'm trying the plain old ftp way, and for that I need an encryption utility with these features:

• Command-line operation (GUI is ok but optional; this will run from a batch file)
• Has to work with individual files; bonus points for storing multiple files in a single archive, but this is optional
• No asymmetric (public key) cryptography, so no gnupg. I want to decrypt with just the passphrase and not worry about losing the private key or having it with me at all times.
• Must use a known-good cipher with a reasonable key size. I don't care if three-letter agencies can crack it, but it has to be reasonably secure and use a well-known, solid encryption algorithm. No trade-secret, teenage wonder or homebrew solutions.
• Preferably a mature project, not something that just appeared last week.
• Must either be open source or come from a vendor I can trust. A small, independent vendor is preferable to a big corp, which will sacrifice security for profit and politics every time. (PGP is now owned by Symantec, yech!) Think TrueCrypt quality.
• Commercial apps OK, as long as they satisfy all of the above.

I think that's it. Haven't looked at crypto apps in a long time, so I've no idea what's out there now.

[Eóin]

Perhaps 7zip? It has a command line interface and meets your other requirements too I believe

[tranglos]

Perhaps 7zip? It has a command line interface and meets your other requirements too I believe

Not only that, but it can encrypt headers in the compressed file, so unlike in zip files, you can't see the filenames inside the archive without decrypting. I like it, so thanks for confirming my so-far favorable impression.

What it does not have is a switch to compress each file into a separate archive. I need that to minimize the amount of data to upload, since my outgoing bandwidth sucks. Still, the best candidate I've seen so far. I wonder if the authors are susceptible to bugging for new features :-)

[Innuendo]

My Google Fu turned up this thread dealing with using WinRAR from the command line to create a separate archive for each file:

http://forums.techguy.org/all-other-software/697666-winrar-command-line-separate-archives.html

All you would need to do is edit the provided batch file provided to tailor it to your desired encryption requirements. I don't think you can anything more mature & proven than WinRAR. The world's largest file transfer network (Usenet) depends on RAR files.

[Ath]

What it does not have is a switch to compress each file into a separate archive.

You could do some smart batch scripting for that if needed?

[tranglos]

What it does not have is a switch to compress each file into a separate archive.

You could do some smart batch scripting for that if needed?

Certainly. It's just much simpler to use a single command with a switch and a filemask than a shell FOR loop :-)

[Ath]

It's just much simpler to use a single command with a switch and ...

That means a feature request is on it's way?

[AbteriX]

I have known a few but never used, and forgot them all at the moment.

One i still have in my collection is this, maybe it is from interest?
Can only say it have worked with some small test files... but nothing more.

Code: (generic)

MySecret Blowfish Encryption Utility

Version 3.1.1 Released 9 June 2007.

TO INSTALL

    1. Copy the file MYSECRET.EXE into a directory on your PC's path,
       e.g. C:\Windows or C:\WINNT
    2. That's it!
    
SYNTAX

Usage: MySecret [OPTIONS] [-p password] [[-i] infile [[-o] outfile]]
OPTIONS:
-?|-h display this Help
-e|-d force Encrypt/Decrypt
-n do Not ask to confirm password
-w Warn before overwriting existing outfile
-2 use v2.0 algorithm (no compression)
-@ use stdin/stdout pipes if in/outfile not given
-L display licence conditions
EXAMPLES:
MySecret                (=clipboard-mode, prompts for password)
MySecret -p "my pass phrase"
MySecret infile outfile (=file-mode)
MySecret -@ infile      (output to stdout)
MySecret -@ -o outfile  (input from stdin)
MySecret -@             (input from stdin/output to stdout)
For more information go to <http://www.di-mgt.com.au/mysecret.html>

The encrypted file is BASE64 encoded

Code: (generic)

-----BEGIN MYSECRET-----
TVn8AJd6uSAqarO1xZh78NUQWMXXfNb+F0K0yYmijYjf//JOmY8ecQUCJmh9
b1hIVJKjdUad8FtsdjGGsAJ5whHh71ajI492oIH/OeHBM+LyMRS8qB80EqPa
FQ6VxgXsOmV3B7LBKYyVKRcUL+Czwwj9PQL/dbFVcumqK/ppaU3pfTVVfzbU
urKDVtqVMcBxbEe8F4LRC7K23PB7l1M3aO/oZaRxCiPznmFj9HiSnenHiajc
InDb7n5F1v40Abx8XyL9a6yRhRWHbEWMvDJYc1UjEqu3wp+oJccdTpSERBfT

There is even an script to use it from XYplorer;

Code: (javascript)

/*
===================================================================================
INSTRUCTIONS
 Download the latest version of MySecret.zip (47 kB) from http://www.di-mgt.com.au/mysecret.html
 Unzip the MySecret.zip into an folder, e.g. into "<xypath>\Tools\MySecret\..."
 Save this script e.g. as "MySecret.xys" into "<xypath>\Scripts\..." folder
USING
 Select one file
 Launch this script, e.g. from menu "Scripting > Load Script File... > MySecret.xys"
 From the dialog choose "Encrypt" [or "Decrypt"]
 The resulting output is encrypted and encoded using base64 encoding, ready to mail it.
===================================================================================
*/


"Encrypt"
 // creates an new, encrypted file with additional 'mys' extension:
 $pas1 = Input("MySecret EnCrypt","Enter your password for ""<curname>"":");
 $pass = Input('Confirm','Re-type your password:');
 end ("$pas1" != "$pass"), "Password did not match";
  run "<xypath>\Tools\MySecret\MySecret.exe -w -e -p $pass -i ""<curitem>"" -o ""<curitem>.mys""";
//=============================== 


  
"Decrypt"
 // creates an new, decrypted file and removes the 'mys' extension:
 $pass = Input("MySecret DeCrypt","Enter your password for ""<curname>"":");
  run "<xypath>\Tools\MySecret\MySecret.exe -d -w -p $pass -i ""<curitem>"" -o ""<curpath>\<curbase>""";
//===============================




"Readme"
 sub "_readme";
//===============================



-

"Edit this &script : edit"
   self $ScriptFile, file;
   OpenWith "<xypath>\Tools\NotePad2\Notepad2.exe", ,$ScriptFile;
//===============================   



"_readme"
 text <<<TEXT
MySecret Blowfish Encryption Utility
Version 3.1.1 Released 9 June 2007.

Works fine for file size till ~5MB. 
Decodeing an file with e.g. 25MB takes a few minutes.

TO INSTALL
    1. Copy the file MYSECRET.EXE into a directory on your PC's path,
       e.g. C:\Windows or C:\WINNT
    2. That's it!
    
SYNTAX
Usage: MySecret [OPTIONS] [-p password] [[-i] infile [[-o] outfile]]
OPTIONS:
-?|-h display this Help
-e|-d force Encrypt/Decrypt
-n do Not ask to confirm password
-w Warn before overwriting existing outfile
-2 use v2.0 algorithm (no compression)
-@ use stdin/stdout pipes if in/outfile not given
-L display licence conditions
EXAMPLES:
MySecret                (=clipboard-mode, prompts for password)
MySecret -p "my pass phrase"
MySecret infile outfile (=file-mode)
MySecret -@ infile      (output to stdout)
MySecret -@ -o outfile  (input from stdin)
MySecret -@             (input from stdin/output to stdout)
For more information go to <http://www.di-mgt.com.au/mysecret.html>

TERMS AND CONDITIONS

MySecret is copyright (C) 2002-7 DI Management Services Pty Ltd, all rights
reserved. MySecret is freeware. Install and use entirely at your own risk.

Read more at http://www.di-mgt.com.au/mysecret.html

TEXT;
//===============================<EOF> 

[criss]

Hi,

I use this:
http://www.di-mgt.com.au/mysecret.html

and from time to time:
7z commandline

Then there are:
http://code.google.com/p/shacrypt/
http://code.google.com/p/dnfileencryptor/
...

[tranglos]

Thanks, everyone! Will try out the suggestions.