Make Money

System-wide security solutions such as SELinux, AppArmor, Bastille and grsecurity can, in most cases, make your Linux desktop more than reasonably secure. But there are still cases where file or directory encryption is necessary. Here are some tools that can help you when you need to move files outside of your home computer, carry personal data around with you on a pendrive, or send email messages containing sensitive information. Most of these tools are command-line only, but they are so simple that even the most CLI-challenged newbie should be able to use them with little effort. All are highly portable, small in size, and have few or no library dependencies.

Bcrypt

I always carry Bcrypt on my pendrive. It's a basic application that's dead simple to use. Once installed, all you need to do is type bcrypt at the command prompt, followed by the file(s) you want to encrypt. Bcrypt will ask you to supply a password. That's it. Upon encryption, Bcrypt adds the extension .bfe to the file. The same command is used to decrypt the file; it checks the extension of the file to see if it needs to be encrypted or decrypted.

Bcrypt uses the Blowfish algorithm. Passphrases, as usual, must be between 8 and 56 characters, and are hashed internally to a 448-bit key for added security. By default, when encrypting a file, the original will be deleted and overwritten three times, to foil any recovery attempts. You can increase or decrease that number.

Its lack of flexibility and options might make this program an improbable first choice in one's encryption arsenal, but its simplicity is a virtue. According to the project's Web site, Bcrypt compiles on Linux and *BSD, and there's also a Windows version; but the site hasn't been updated, it seems, for years.

Ncrypt

Ncrypt is another simple file encryptor/decryptor. You can choose to work with one of the three algorithms that made it as the final candidates for AES (Advanced Encryption Standard): Rijndael, Twofish, and Serpent. The developers have paid special attention to password-generation security: among other things, when a plaintext password is created for encrypting a file, it's converted to a SHA-1 hash, and immediately wiped from memory. The hash is then used to make a key, and is also wiped from memory.

Ncrypt has versions available for Unix and Windows. Using it is straightforward: issue the ncrypt command at the command prompt, with options specifying the encryption algorithm, whether you want to encrypt, decrypt, or wipe a file, and the input and output files. The original file is wiped from the disk; Ncrypt also has a useful wipe-only function that allows you to securely delete any file.

Pad

Pad differs from Bcrypt and Ncrypt in that it uses one-time pad encryption. A file is broken into two or more separate "pads," "each indistinguishable from white noise." The two files, apparently just filled with harmless random data, can then be reassembled whenever the user wishes to.

OTP has a lot of history behind it. It is said to be, theoretically, the only really unbreakable encryption method there is. But it has several practical weaknesses: each pad can only be used once, pads must be generated with truly random data (a much more difficult task than it seems), and it is susceptible to man-in-the-middle attacks. As such, it isn't recommended for general day-to-day encryption tasks. However, there is a public field of action where it can prove valuable: free speech enforcement. For instance, if someone wants to freely distribute a file that might land him in trouble with authorities, he can break the file with Pad, store the two (or more) parts on different systems, and tell users where to get them and how to reassemble the original file.

GnuPG

For most folks, GnuPG will be the obvious choice for open source file encryption. Some distros even come with it pre-installed. Quoting its FAQ, "GnuPG stands for GNU Privacy Guard and is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC 2440. As such, it is aimed to be compatible with PGP from NAI, Inc."

To encrypt files, Bcrypt, Ncrypt, and many other encryption programs use symmetrical ciphers. GnuPG, like PGP, uses public key ciphers, although it supports symmetrical encryption as well. Public key encryption makes it easier to encrypt and sign multiple files on a regular basis, and exchange them with other users, among other advantages. For a good overview of what symmetrical and public key ciphers are and how they work, consult chapter 2 of the GnuPG Handbook, and section 7.1 of its FAQ

GnuPG can be used exclusively as a command-line tool; it has a wealth of features and can satisfy even demanding users. But it also has some very good front ends available. The one I use is KGpg, which integrates with KDE, making some of my routine encryption tasks much easier. For instance, the other tools I've mentioned can encrypt files, but not directories. You can encrypt all the files inside a directory, or create a .tar.gz or .zip file containing the contents of the directory, and then encrypt it. With KGpg, I just double-click on a folder and tell the program to archive and encrypt it in one go. KGpg also allows you to create a "shredder" on the desktop that securely deletes any file that you drop on it (but not directories). It's very handy, although I advise you to read the authors' security note about shredding. KGpg's ease of use is excellent; the learning curve will be short even for computer-challenged users.

GnuPG's development pace is steady, and it supports many operating systems. It compiles on most Unices, and Gpg4Win provides a port for Windows. Support for mail encryption on Unix systems is also solid: consult section 4.15 of the GnuPG FAQ for a list of mail clients that provide integration with GnuPG (sadly, you'll notice that full support for the OpenPGP standard in Windows is scarce). For more email tools, check project Aegypten

For more information about encryption, two good starting points are the corresponding Wikipedia article and the Cryptography FAQ.
Article written By Rui Lopes

Labels: linux, security