fcrypt 0.3.3

Cross-platform CLI for password-based file encryption and decryption
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

# Opaque File Format

This is the default encrypted file format starting in `fcrypt` `0.3.0`.
`fcrypt` `0.3.0` does not read pre-0.3.0 encrypted files. Use `fcrypt`
`0.2.0` when access to old encrypted files is required.

The default encrypted file format is intentionally random-looking. New files do
not contain magic bytes, cleartext version fields, cleartext algorithm names, or
cleartext recipient identifiers.

The fixed outer layout is:

```text
32 bytes        file nonce
8 * 16384      recipient slots
4112 bytes     encrypted manifest
rest           encrypted payload chunks
```

The manifest is encrypted with a random manifest key recovered from one
recipient slot. The manifest contains the internal format version, plaintext
length, chunk size, chunk count, tag length, and random payload file secret.

Recipient slots are fixed-size random-looking records. Password slots derive a
slot key with the opaque v1 Argon2id profile and the file nonce:

```text
memory:      131072 KiB (128 MiB)
time cost:   3
parallelism: 1
output:      32 bytes
```

These KDF parameters are part of the opaque v1 format. Future parameter changes
must use a new slot profile or a new opaque format version. PQC slots store
ML-KEM-1024 and HQC-256 ciphertexts followed by an AEAD-wrapped manifest key.
Empty slots are random bytes. The reader tries the supplied password or
available recipient secret keys against every slot.

For signed PQC containers, the AEAD-protected padding of the matching recipient
slot carries a `fcrypt-sig-v1` marker and the 32-byte signer key ID. This is a
backward-compatible opaque v1 extension: it does not change slot sizes, nonces,
AAD, or manifest fields, and older readers ignore the padding. A current reader
uses the marker to require the matching detached signature and verification key
before publishing plaintext, so removing `.sig` cannot downgrade a newly
signed container to unauthenticated decryption. Signed containers created
before this extension have no authenticated marker and retain their original
behavior when the sidecar has been removed.

Payload chunks use AES-256-GCM. Chunk nonces are:

```text
4-byte per-file nonce base || 8-byte big-endian chunk index
```

Chunk AAD binds each chunk to the encrypted manifest hash, chunk index, total
plaintext length, total chunk count, chunk plaintext length, and final flag.

Mimicry/steganographic wrappers are intentionally not part of this format.