Web lists-archives.com

Re: Looking for advice on tools (or libraries) for unsupervised, bulk symmetric encryption/decryption of files

On 10/01/2019 03:05, Kynn Jones wrote:
The only encryption tool I have used for encrypting files on my hard drive
is gpg2, which I have used for small, interactive encryption tasks
(half-dozen files, at most).
Therefore, my initial attempt was to use gpg2 for this new bulk-encryption
task, but I found myself constantly fighting with it, and finally had to
recognize that I was trying to use gpg2 for something it is not primarily
designed for.  (I am also a bit concerned with gpg2's future stability.
AFAICT, It's design has varied significantly over the years, and as a
result there's a lot of confusion on its use.  That has been my experience,
in any case.)

I use a pipe with gpg2 as one component for symmetric encryption:

gpg --batch --symmetric --cipher-algo AES256 --s2k-digest-algo SHA512 --compress-algo none --passphrase-file $PASSPHRASE_FILE

My pipe input is usually a tar file gzipped with pigz for parallel compression, hence the "--compress-algo none". I then add another "pigz -0" wrapper to get a cryptographically weak checksum to allow testing for media failures without the passphrase. I like tar because it preserves file metadata and filesystem structure and is a very stable format. Other formats may be better for random access.

Recently I used gpg2 to decrypt files that were encrypted over 15 years ago; note that these were much smaller files and a simpler invocation of gpg1 (the then default cipher was CAST5 IIRC). The gpg file format seems well-documented and stable. Regular decryption tests are prudent to catch problems after gpg upgrade. Yes, the new interactive predilections of gpg2 were a pain at first when compared to gpg1, but "--batch" and "--passphrase-file" seem sufficient for batch symmetric encryption, if you do not mind your passphrase being in plain text on your filesystem.

Kind regards,

Ben Caradoc-Davies <ben@xxxxxxxxxxxx>
Transient Software Limited <https://transient.nz/>
New Zealand