enk 2.0.1

[![version](https://img.shields.io/crates/v/enk.svg)](https://crates.io/crates/enk)
[![build](https://github.com/pepa65/enk/actions/workflows/ci.yml/badge.svg)](https://github.com/pepa65/enk/actions/workflows/ci.yml)
[![dependencies](https://deps.rs/repo/github/pepa65/enk/status.svg)](https://deps.rs/repo/github/pepa65/enk)
[![docs](https://img.shields.io/badge/docs-enk-blue.svg)](https://docs.rs/crate/enk/latest)
[![license](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://github.com/pepa65/enk/blob/main/LICENSE)
[![downloads](https://img.shields.io/crates/d/enk.svg)](https://crates.io/crates/enk)

# enk 2.0.1
**Simple and hard to crack data en/decryption**

* License: GPLv3.0
* Authors: github.com/pepa65, Ariel Horwitz
* Repo: https:/github.com/pepa65/enk
* After: https://github.com/ArielHorwitz/rhinopuffin
* Version 2 is very costly to crack: 60 rounds of Argon2id on 256 MiB
* Version 1 has lower time_cost, but can be read with current version 2.
  - To in-place convert a version-1 enk-file to version 2:
    `tmp=$(mktemp) && enk -d FILE.enk >"$tmp" && enk "$tmp" >FILE.enk`
* Version 0 is obsolete and incompatible with version 1
  - To decrypt `version 0` encrypted files, use `enk 0.4.2` or earlier.
  - Use `version 1` going forward for more security.
  - See specs for `version 1` below.
* Encryption and decryption happens in-memory, the whole input is read
  into memory and the output is constructed in memory before writing out.

## Usage
```
enk 2.0.1 - Simple and hard to crack data en/decryption
Usage: enk [OPTIONS] [FILE]
Arguments:
  [FILE]  Input file (omit to read from stdin)

Options:
  -d, --decrypt            Decrypt [default: encrypt]
  -k, --keyfile <KEYFILE>  Use a file as the encryption/decryption secret
  -p, --password           Read password from stdin instead of prompting
  -h, --help               Print help
  -V, --version            Print version
```

## Install
### Download static single-binary
```
wget https://github.com/pepa65/enk/releases/download/0.4.3/enk
sudo mv enk /usr/local/bin
sudo chown root:root /usr/local/bin/enk
sudo chmod +x /usr/local/bin/enk
```

### Using cargo (rust toolchain)
If not installed yet, install a **Rust toolchain**, see https://www.rust-lang.org/tools/install

### Cargo from crates.io
`cargo install enk`

#### Cargo from git

`cargo install --git https://github.com/pepa65/enk`

#### Cargo static build (avoid GLIBC incompatibilities)
```
rustup target add x86_64-unknown-linux-musl
git clone https://github.com/pepa65/enk
cd enk
cargo rel
```

### Install with cargo-binstall
Even without a full Rust toolchain, rust binaries can be installed with the static binary `cargo-binstall`:

```
# Install cargo-binstall for Linux x86_64
# (Other versions are available at https://crates.io/crates/cargo-binstall)
wget github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz
tar xf cargo-binstall-x86_64-unknown-linux-musl.tgz
sudo chown root:root cargo-binstall
sudo mv cargo-binstall /usr/local/bin/
```

Only a linux-x86_64 (musl) binary available: `cargo-binstall enk`

Then `enk` will be installed in `~/.cargo/bin/` which will need to be added to `PATH`!

### Set magic
Add "magic" for the `file` command:
```sh
echo '0 string enk1 enk v1 encrypted data, gitlab.com/pepa65/enk' |sudo tee -a /etc/magic
```

## Encryption
### File format `enk2`
* 4 bytes magic ("enk2") [old format `enk1` has "enk1"]
* 16 bytes Argon2id salt (128 bits)
* 12 bytes AES-256-GCM nonce (96 bits)
* N bytes AES-256-GCM ciphertext
* 16 bytes authentication tag (128 bits)

### Key derivation
* AES-256 key = Argon2id(secret, salt)

### Encryption parameters for `enk1`
* KDF Algorithm: Argon2id
* Version: 1.3 (0x13)
* Memory: 256 MiB (262144 KiB)
* Time cost: 60 [old format `enk1` has 13]
* Parallelism: 1
* Output: 32 bytes

**The magic & salt are authenticated as AES-GCM AAD, the nonce by AES-GCM itself.**