Introduction

Altap Salamander: Plugins: Encrypt & Decrypt: Introduction

Getting Started with Encrypt & Decrypt Plugin

With the Encrypt & Decrypt plugin you can easily encrypt your files. Moreover you can shred (wipe) files and directories and clean (shred) disk free space.

To encrypt means to convert from readable file using password or key file to unreadable file (encrypted file). Reverse process is decrypting, you need the same password or key file to get back the original readable file. Encrypted files are useful for storing sensitive data or for sending sensitive data using insecure channels.

To shred means to irreversibly delete. When you only delete a file, only reference to its data is deleted and the data itself remains on disk until another file's data overwrites it. You can use Undelete utility (e.g. the Undelete plugin) to recover deleted file. If you want to prevent undeleting of file, you need to shred it. Moreover shredding overwrites file data on disk many times with special patterns to make even advanced recovering of file data very difficult if not impossible (surely impossible for common undelete utilities).

See How It Works for list of used algorithms and principles.

See Archiver and Menu Extension sections in Using Plugins for a description of basic work with plugin archiver and menu extension.

This plugin uses the Crypto++ 4.1 library.

© 2001-2019 ALTAP. All rights reserved.


How It Works

Page Content

Encryption
Introduction
Encrypted Archives
Practically Strong Random Numbers
Supported Encryption Algorithms
Key Files
Passwords
Supported Hash Algorithms
Cipher Modes
Shredding Files and Cleaning Disk Free Space
Shredding Methods
Network and SSD Drives

Encryption

Introduction

To encrypt means to convert from a readable file using a password or key file to an unreadable file (encrypted file). The reverse process is decrypting, you need the same password or key file to get back the original readable file. Encrypted files are useful for storing sensitive data or for sending sensitive data using insecure channels.

Decrypting without the password or key file is possible using brute force attack (it tries all possible variants), but it's too expensive (rather unreal) because of used key sizes (128 bits and more). Another possibility is to find successful attack against the used encryption algorithm, but this should be also very very improbable (many genius cryptographers are still trying). The easiest way how to decrypt such archive is to steal your password or your key file (with password).

Encrypted Archives

The core of the encryption process is an encryption algorithm. It encrypts a block of data (typically 64 or 128 bits) using a binary key (its size is 128 bits or more). The binary key for all files in an encrypted archive is generated as a practically strong random number (such number should be found only by a brute force attack) when you create an archive.

This randomly generated binary key is encrypted using a binary key produced from user's password or key file and stored in the encrypted archive. This enables you to change a password or key file for an encrypted archive without decrypting and encrypting of the whole archive.

See the Cipher Modes section below for two variants of splitting a file to blocks required by encryption algorithm.

All files in an encrypted archive can be also compressed using Deflate algorithm (used also in ZIP compression). The resulting archives are smaller, so transferring or storing of such encrypted archives is easier. Compressing of an encrypted archive is not efficient, if you want to use another compression (more efficient), you need to compress files before encrypting.

You can also add a comment to an encrypted archive. It's not encrypted, so it is readable without having the password of key file. All other data (also filenames) are encrypted.

Practically Strong Random Numbers

Each encrypted archive has the binary key generated as a practically strong random number. It means that no one can calculate this number. To obtain such random numbers, the plugin needs to collect unpredictable values to seed the random number generator. It collects system information, structure of heap allocations, coordinates and times of your mouse pointer moves, and values and times of your key presses.

Supported Encryption Algorithms

  • AES (Advanced Encryption Standard) with 128-bit block size, key sizes: 128, 192, and 256 bits, first published in 1998: it is also known as Rijndael, a block cipher adopted as an encryption standard by the US government, developed by two Belgian cryptographers: Joan Daemen and Vincent Rijmen,
  • Blowfish with 64-bit block size, key size 448 bits, first published in 1993: designed by Bruce Schneier,
  • TrippleDES with 64-bit block size, key size 168 bits (192 bits including parity), first published in 1978: based on using DES (Data Encryption Standard) three times, it solves the DES problem of too small key size (56 bits key can be broken using brute force attack in less than 24 hours today).

Key Files

The key file contains 2048 bits generated as a practically strong random number (such number should be found only by a brute force attack). When you encrypt some files using this key, required part of these random bits (e.g. 128 bits) is used as a binary key for an encryption algorithm. The advantage of using key files is that it is practically impossible to guess such random number. The disadvantage is that you need to store this key in a secret place (anyone can decrypt your archives using this key). To suppress this disadvantage, you can protect your key file with a password (your key file is internally encrypted using a password). The suitable place for storing key files is e.g. USB stick (still in your pocket, like other keys). In all cases, make the backup of your key files and place it to some secure place, because if you lost these keys, files in encrypted archives are lost.

Passwords

If you decide to use a password (usually weaker protection than key files), we recommend to use multi-line password (the maximal password size is 10240 characters) or password with numbers, special characters, etc. All password characters are used, we use a hash algorithm to convert your password to a binary key used by an encryption algorithm.

See the Password Strength article in Wikipedia.

Supported Hash Algorithms

  • SHA-1 and SHA-2 (Secure Hash Algorithm), first published in 1995 and 2004: designed by the National Security Agency (NSA) and published as a US government standard,
  • HAVAL, first published in 1992: invented by Yuliang Zheng, Josef Pieprzyk, and Jennifer Seberry.

Cipher Modes

All supported encryption algorithms work with blocks of data with fixed size (64 or 128 bits). The plugin must split data to such blocks. It supports two modes: ECB (Electronic Codebook) and CBC (Cipher Block Chaining). In ECB mode, data is padded out to a multiple of the block size, broken into blocks, each of which is encrypted independently. In CBC mode, prior to encryption, each block of data is XOR-ed with the encrypted prior block. It means that CBC is more secure than ECB because it effectively scrambles data prior to each encryption step. The disadvantage of CBC is that the encryption of a data block becomes dependent on all the blocks prior to it.

Shredding Files and Cleaning Disk Free Space

When you delete a file, only reference to its data is deleted and the data itself remains on disk until another file's data overwrites it. You can use Undelete utility (e.g. the Undelete plugin) to recover deleted file. If you want to prevent undeleting of files, you need to shred them. It makes recovering of deleted files very difficult if not impossible (surely impossible for common undelete utilities).

If you want to be sure that all your deleted files (also temporary files created by applications) are irreversibly deleted, you should clean all disk free space. It makes recovering of any deleted files impossible at least for common undelete utilities.

Shredding Methods

  • Gutmann algorithm, 26 passes: this is the most secure (and slowest) method. It overwrites file data with carefully selected patterns, each of which addresses different disk encoding scheme (MFM, RLL, etc.). The method also uses several random passes. It should not be possible to recover the original data.
  • DOD (Department of Defense) 5220.22-M, 3 passes: the file data will be overwritten with zeros, then with the character 0xFF, and finally with random characters. This method is faster, but less secure, and there are chances hardware data recovery may succeed.
  • Random Overwrite, custom number of passes (only 1 pass by default): this is the fastest and least secure method, which simply overwrites file data with random characters. It still prevents the data to be recovered by software means, however, using special hardware, the original data can be traced. (Note: this is the only method suitable for compressed drives.)
  • Zeros Overwrite, 1 pass: Please DON'T use this method if you are looking for shredding. This method is included only for special purpose: filling free disk space with zeros. Such disk can be compressed very well during image backup. Available only in Clean Disk Free Space command.

Network and SSD Drives

  • It is not technically possible to shred files or free space on network and SSD drives. When you try to perform shredding operation on such drives, warning message will be displayed. Please don't use such drives for storing sensitive data you may need to shred.


Encrypting Files and Directories

You can encrypt files and directories using a password or key file. It produces encrypted archive file. All files are moreover compressed (ZIP compression) to obtain smaller resulting archive.

To encrypt files and directories:

  1. Select the files and directories which you want to add to an encrypted archive.
  2. Open the Pack dialog box for Encrypt packer:
    Menu: Plugins/Encrypt & Decrypt/Encrypt...
    Shortcut key: Ctrl+Shift+E
  3. Enter the name of the encrypted archive.
  4. If you want to shred (irreversible delete) packed files and directories, check the Delete files from disk after packing to archive box in the Pack dialog box. Shredder will use the algorithm chosen in the Shred Files dialog box.
  5. Choose the OK button to open the Create Encrypted Archive dialog box.
  6. Select if you want to use a key file or password for decrypting the archive. See How It Works for details on passwords and key files. You can choose if you want to see the password (if you are sure that no one else can see it on your screen) or if it should be hidden (in this case you need to type the password again to confirm it), see the Hide typing of passwords box.
  7. If you want to, you can enter a comment to the archive. It is stored as a plain text (it is not encrypted).
  8. Choose the Change button in Encryption row to set the encryption algorithm, password hash algorithm, level of compression, and cipher mode in the Encryption dialog box. We recommend to use AES-256, SHA-2, Deflate-9, and CBC.
  9. To create secure archive the plugin needs to collect unpredictable values to seed the random number generator. See the indicator on the bottom of dialog, if it's not yet full, move mouse pointer randomly or press any keys until it's full.
  10. Choose the OK button to start encrypting.

See Also

Create Encrypted Archive dialog box


Creating Key File

Use this command to create a key file. See How It Works for details on key files.

To create a key file:

  1. Open the Create Key dialog box:
    Menu: Plugins/Encrypt & Decrypt/Create a Key...
  2. To create a key file the plugin needs to collect unpredictable values to seed the random number generator. See the indicator on the top of the dialog, move the mouse pointer randomly or press any keys until it's full.
  3. If you want to protect the key with password (it's recommended), check the Use an additional password to protect the key box and enter (and confirm) your password.
  4. If you want to, you can enter a comment to the key. It is stored as a plain text (it is not encrypted).
  5. Choose the OK button to open the Save Key dialog.
  6. Enter the filename for the key.
  7. Choose the Save button to write the key to specified filename.

See Also

Create Key dialog box


Working with Encrypted Archive

You can open encrypted archive in panel (see Archiver section in Using Plugins). You will be prompted for archive password or key. When you enter this password or key, the archive is decrypted (unlocked) and you can do all common operations in it (open, view, edit, copy, move, and delete files, etc.).

Security Issues

The View, Edit, and Open commands unpack focused file from archive to temporary directory. The associated viewer, editor, or other application works with this temporary copy of file from archive. When you close it, the temporary copy is deleted. This is a security problem because anyone can simply undelete this copy from the temporary directory. To avoid this problem, the plugin can shred (irreversibly delete) this copy.

Another security problem is that editors (and sometimes also viewers) create some auxiliary files beside this copy. E.g. when editor saves a new version of your file, it first creates a new file with a temporary name, then deletes the original file (or renames it to some BAK version), and finally renames that temporary file to original file name. Such auxiliary files cannot be shredded by the plugin because it does not even know about them. To bypass this problem, the plugin allows you to change temporary directory for temporary copies of files from encrypted archives to some suitable place. E.g. your USB stick (you can keep it on some secure place), or some small FAT partition which can be periodically shredded, see Cleaning Disk Free Space. NTFS partitions are not suitable for this directory because they have problem with shredding small files (smaller than around 1024 bytes), see Show warning "Shredding problem with small files on NTFS" on the Shredding tab in the Configuration dialog for details.

See the Temporary Files tab in the Configuration dialog for details on how to configure the plugin in this respect.

See Also

Encrypting Files and Directories
Decrypting Archive


Decrypting Archive

Use this command to decrypt files and directories from an encrypted archive.

To decrypt an archive:

  1. Focus the encrypted archive in panel.
  2. Open the Unpack dialog box:
    Menu: Plugins/Encrypt & Decrypt/Decrypt...
    Menu: Files/Unpack...
    Shortcut key: Alt+F9 or Alt+F6
  3. Specify the target path.
  4. Choose the OK button to start decrypting (unpacking).
  5. Enter a password or key file to decrypt the archive.

See Also

Working with Encrypted Archive


Changing Archive Password or Key

Use this command to change the password or key file for the encrypted archive.

To change archive password or key:

  1. Focus the encrypted archive in panel.
  2. Open the Open Encrypted Archive dialog box:
    Menu: Plugins/Encrypt & Decrypt/Change Archive Password or Key...
  3. Specify the old archive password or key file.
  4. Choose the OK button to decrypt the archive and open the Change Password or Key dialog box.
  5. Enter (and confirm) new password or specify new key file. It does not matter if the archive was protected by a password or key file.
  6. Choose the OK button to use the new password or key file.


Changing Key Password

Use this command to change the password for the key file.

To change key file password:

  1. Focus the key file in panel.
  2. Open the Change Key Password dialog box:
    Menu: Plugins/Encrypt & Decrypt/Change Key Password...
  3. Specify the old key file password (if any).
  4. Choose if you want to protect key file by password or not. If yes, check the Use a password to protect the key box and enter (and confirm) new password.
  5. Choose the OK button.


Changing Archive or Key Comment

Using this command you can change the comment of encrypted archive or key file.

To change archive or key comment:

  1. Focus the encrypted archive or key file in panel.
  2. Open the Change Comment dialog box:
    Menu: Plugins/Encrypt & Decrypt/Change Archive or Key Comment...
  3. Change the displayed comment (no password or key file is needed).
  4. Choose the OK button.


Shredding Files and Directories

When you delete a file, only reference to its data is deleted and the data itself remains on disk until another file's data overwrites it. You can use Undelete utility (e.g. the Undelete plugin) to recover deleted file. If you want to prevent undeleting of files, you need to shred them. It makes recovering of deleted files very difficult if not impossible (surely impossible for common undelete utilities).

To shred files and directories:

  1. Select the files and directories which you want to shred (irreversibly delete).
  2. Open the Shred Files dialog box:
    Menu: Plugins/Encrypt & Decrypt/Shred Files...
    Shortcut key: Ctrl+Shift+S
  3. Select a shredding method and number of passes. See the Shredding Methods section in How It Works for details.
  4. Choose the OK button to start shredding.

See Also

Shred Files dialog box


Cleaning Disk Free Space

When you delete a file, only reference to its data is deleted and the data itself remains on disk until another file's data overwrites it. If you want to clean all disk free space, use this command. It makes recovering of deleted files very difficult if not impossible (surely impossible for common undelete utilities).

To clean disk free space:

  1. Change the directory in panel to the drive where you want to clean disk free space.
  2. Open the Clean Free Space dialog box:
    Menu: Plugins/Encrypt & Decrypt/Clean Disk Free Space...
  3. Select a shredding method and number of passes. See the Shredding Methods section in How It Works for details.
  4. Choose the OK button to start cleaning.

See Also

Clean Free Space dialog box


Encryption

Select the algorithms for encryption and password hashing, level of compression, and cipher mode on this tab. See Configuring Plugins for general information about configuration.

Options

Encryption algorithm, key size
Select the preferred algorithm for encryption. See How It Works for description of available algorithms.
Password hash algorithm
Select the preferred algorithm for password hashing. The plugin uses selected hash algorithm to convert a password to a binary key used by encryption algorithm. See How It Works for description of available algorithms.
Compression
Choose the level of ZIP compression (Deflate algorithm) here. Deflate 0 means no compression (fast), Deflate 9 means the highest compression (slowest).
Cipher mode
The plugin supports two modes: ECB (Electronic Codebook) and CBC (Cipher Block Chaining). CBC is more secure. ECB is more resistent to errors in encrypted data. See How It Works for details on ECB and CBC.


Shredding

Set options for shredding on this tab.

Options

Clean cluster tips when cleaning free space
When checked, the cluster tips are cleaned in Cleaning Disk Free Space. The cluster tip is a free space between the end of file and the end of disk space allocated for the file (the allocated size is always a multiple of the cluster size). If you do not clean cluster tips, you take the risk that some fragment of sensitive data previously stored in this cluster is available in it. Cleaning cluster tips means that all existing files will be padded out to a multiple of the cluster size. And this padded space will be shredded. Finally the file will be shrunk back to its original size.
Clean FAT directory entries
When checked, the plugin cleans the file names in directories on FAT drives in Cleaning Disk Free Space. Note: cleaning file names in directories on exFAT drives is not supported.
Enable cleaning of the swap file each time Windows shuts down
Almost any piece of memory used by any program can be swapped to the paging file. So any sensitive data (e.g. passwords) can be written to the paging file. If the disk with the paging file is attached to another computer, the paging file is normally accessible. So anyone can read this sensitive data from it. If you check this option, it specifies that inactive pages in the paging file are filled with zeros when the system stops. Warning: enabling this option can degrade the performance of your computer.
Show warning "Shredding problem with small files on NTFS"
When checked and you shred file smaller than 1024 bytes from NTFS drive, the plugin shows the following warning. On NTFS, small files (under around 1024 bytes) are stored directly in the MFT (Master File Table), which makes it problematic to shred them properly without direct disk access since MFT is a system file and all changes to it are logged to a special file, which is not accessible to applications. We recommend that you clean free space on this disk too, to overwrite the remnants of the logging file. To avoid this problem, we also recommend using a FAT32 volume for all sensitive files.


Temporary Files

You can enable and set up shredding of temporary copies of files from encrypted archives on this tab. See the Security Issues section in Working with Encrypted Archive for details.

Options

Enable automatic shredding of temporary files
When checked, temporary copies are shredded. Otherwise they are only deleted, so they can be easily undeleted by anyone (it means access to your sensitive data without any password or key file).
Temporary files directory
Temporary copies of files from encrypted archives are placed to this directory. Suitable place for this directory is e.g. your USB stick (you can keep it on some secure place), or some small FAT partition which can be periodically shredded (see Cleaning Disk Free Space). NTFS partitions are not suitable for this directory because they have problem with shredding small files (smaller than around 1024 bytes), see Show warning "Shredding problem with small files on NTFS" on the Shredding tab in the Configuration dialog.
Shredding method, Number of passes
Select the shredding method and number of its passes for shredding of temporary copies of files from encrypted archives. See the Shredding Methods section in How It Works for details.


Create Encrypted Archive dialog box

Altap Salamander: Plugins: Encrypt & Decrypt: Dialog Boxes

Create Encrypted Archive

Use this dialog to set up parameters for creation of encrypted archive.

Options

Use key file
When checked, the files will be encrypted using a key file. Otherwise they will be encrypted using a password. See How It Works for details on passwords and key files.
Enter the password for key file
If you want to use the key file and it is protected by a password, you can enter this password here. See Use key file for details.
Enter a password
If you want to use the password, enter it here. See Use key file for details.
Type the password again to confirm
If you want to use the password and hide typing of it, enter the same password here again for confirmation (entering the password twice should recover any typing error). See Use key file and Hide typing of passwords for details.
Hide typing of passwords
When checked, you will type the passwords invisibly (same color of text and its background). No one can read such passwords from your screen, unfortunately neither you, so to avoid typing errors you need to type the same password again (the plugin compares both passwords and warns if they are different). When not checked, typing of passwords is visible, so you can check them against typing errors. Use this only when you are sure that no one else can read passwords from your screen.
Archive comment (optional)
Archive comment is stored as plain text (not encrypted), so anyone can read it from encrypted archive.
Encryption: Change
You can see here the chosen encryption algorithm, password hash algorithm, level of compression, and cipher mode. If you want to change any of them, click the Change button. See How It Works for details.
Indicator of collected unpredictable values
To create secure archive the plugin needs to collect unpredictable values to seed the random number generator. If the indicator is not full, move mouse pointer randomly or press any keys until it's full. See How It Works for details.

See Also

Encrypting Files and Directories


Create Key dialog box

Altap Salamander: Plugins: Encrypt & Decrypt: Dialog Boxes

Create Key

Use this dialog to create a key file. See How It Works for details on key files.

Options

Indicator of collected unpredictable values
To create the key file the plugin needs to collect unpredictable values to seed the random number generator. If the indicator is not full, move mouse pointer randomly or press any keys until it's full.
Use an additional password to protect the key
When checked, the key file will be protected (encrypted) by chosen password. We recommend it whenever your key file is stored on media which is not kept in a secret place (e.g. your fixed disk is not considered to be a secret place).
Enter a password
Type the password for protecting of key file here.
Again to confirm
Type the password for protecting of key file again to detect possible typing errors.
Hide typing of passwords
When checked, you will type the passwords invisibly (same color of text and its background). No one can read such passwords from your screen, unfortunately neither you, so to avoid typing errors you need to type the same password again (the plugin compares both passwords and warns if they are different). When not checked, typing of passwords is visible, so you can check them against typing errors. Use this only when you are sure that no one else can read passwords from your screen.
Key comment (optional)
Key comment is stored as plain text (not encrypted), so anyone can read it from key file.

See Also

Creating Key File


Encryption dialog box

Altap Salamander: Plugins: Encrypt & Decrypt: Dialog Boxes

Encryption

Select the algorithms for encryption and password hashing, level of compression, and cipher mode in this dialog. You can preset these values on the Encryption tab in the Configuration dialog.

Options

Encryption algorithm, key size
Select the algorithm for encryption. See How It Works for description of available algorithms.
Password hash algorithm
Select the algorithm for password hashing. The plugin uses selected hash algorithm to convert a password to a binary key used by encryption algorithm. See How It Works for description of available algorithms.
Compression
Choose the level of ZIP compression (Deflate algorithm) here. Deflate 0 means no compression (fast), Deflate 9 means the highest compression (slowest).
Cipher mode
The plugin supports two modes: ECB (Electronic Codebook) and CBC (Cipher Block Chaining). CBC is more secure. ECB is more resistent to errors in encrypted data. See How It Works for details on ECB and CBC.


Shred Files dialog box

Altap Salamander: Plugins: Encrypt & Decrypt: Dialog Boxes

Shred Files

Use this dialog to shred (irreversibly delete) selected files and directories.

Options

Shredding method, Number of passes
Select the shredding method and number of its passes for shredding of selected files and directories. See the Shredding Methods section in How It Works for details.

See Also

Shredding Files and Directories


Clean Disk Free Space dialog box

Altap Salamander: Plugins: Encrypt & Decrypt: Dialog Boxes

Clean Disk Free Space

Use this dialog to clean (shred) disk free space.

Options

Shredding method, Number of passes
Select the shredding method and number of its passes for shredding of disk free space. See the Shredding Methods section in How It Works for details.

See Also

Cleaning Disk Free Space