enk 2.0.2

Simple and hard to crack data en/decryption

• License: GPLv3.0
• Authors: github.com/pepa65, Ariel Horwitz
• Repo: https:/github.com/pepa65/enk
• After: https://github.com/ArielHorwitz/rhinopuffin
• Version 2 is very costly to crack: 60 rounds of Argon2id on 256 MiB
• Version 1 has lower time_cost, but can be read with current version 2.
  • To in-place convert a version-1 enk-file to version 2: tmp=$(mktemp) && enk -d FILE.enk >"$tmp" && enk "$tmp" >FILE.enk
• Version 0 is obsolete and incompatible with version 1
  • To decrypt version 0 encrypted files, use enk 0.4.2 or earlier.
  • Use version 1 going forward for more security.
  • See specs for version 1 below.
• Encryption and decryption happens in-memory, the whole input is read into memory and the output is constructed in memory before writing out.

Usage

enk 2.0.2 - Simple and hard to crack data en/decryption
Usage: enk [OPTIONS] [FILE]
Arguments:
  [FILE]  Input file (omit to read from stdin)

Options:
  -d, --decrypt            Decrypt [default: encrypt]
  -k, --keyfile <KEYFILE>  Use a file as the encryption/decryption secret
  -p, --password           Read password from stdin instead of prompting
  -h, --help               Print help
  -V, --version            Print version

Install

Download static single-binary

wget https://github.com/pepa65/enk/releases/download/0.4.3/enk
sudo mv enk /usr/local/bin
sudo chown root:root /usr/local/bin/enk
sudo chmod +x /usr/local/bin/enk

Using cargo (rust toolchain)

If not installed yet, install a Rust toolchain, see https://www.rust-lang.org/tools/install

Cargo from crates.io

cargo install enk

Cargo from git

cargo install --git https://github.com/pepa65/enk

Cargo static build (avoid GLIBC incompatibilities)

rustup target add x86_64-unknown-linux-musl
git clone https://github.com/pepa65/enk
cd enk
cargo rel

Install with cargo-binstall

Even without a full Rust toolchain, rust binaries can be installed with the static binary cargo-binstall:

# Install cargo-binstall for Linux x86_64
# (Other versions are available at https://crates.io/crates/cargo-binstall)
wget github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz
tar xf cargo-binstall-x86_64-unknown-linux-musl.tgz
sudo chown root:root cargo-binstall
sudo mv cargo-binstall /usr/local/bin/

Only a linux-x86_64 (musl) binary available: cargo-binstall enk

Then enk will be installed in ~/.cargo/bin/ which will need to be added to PATH!

Set magic

Add "magic" for the file command:

echo '0 string enk1 enk v1 encrypted data, gitlab.com/pepa65/enk' |sudo tee -a /etc/magic

Encryption

File format enk2

• 4 bytes magic ("enk2") [old format enk1 has "enk1"]
• 16 bytes Argon2id salt (128 bits)
• 12 bytes AES-256-GCM nonce (96 bits)
• N bytes AES-256-GCM ciphertext
• 16 bytes authentication tag (128 bits)

Key derivation

• AES-256 key = Argon2id(secret, salt)

Encryption parameters for enk1

• KDF Algorithm: Argon2id
• Version: 1.3 (0x13)
• Memory: 256 MiB (262144 KiB)
• Time cost: 60 [old format enk1 has 13]
• Parallelism: 1
• Output: 32 bytes

The magic & salt are authenticated as AES-GCM AAD, the nonce by AES-GCM itself.