encryption.md

Encryption

The process of changing a file or data stream to be unreadable by someone with the passphrase or key.

• SSL
• Volume Encryption
• File Encryption
  • GnuPG
  • OpenSSL
  • Age - Actually Good Encryption

SSL

See SSL doc.

Volume Encryption

See these pages for details:

• VeraCrypt
• Mac Native Volume Encryption
• Mac Native File as Encrypted Volume

File Encryption

For maximum strength, encrypt individual files using one tool and then place the encrypted files into VeraCrypt encrypted mounted volume.

GnuPG

https://gnupg.org/

GNU Privacy Guard is the open source implementation of the OpenPGP standard.

Supports both asymmetric (public-private) and symmetric encryption.

Compatible across platforms, and highly customizable.

Install on Mac:

brew install gnupg

-c is short for --symmetric encryption, defaults to AES-128, and curses prompts for a password:

gpg -c "$file"

You will want to increase this to the current max AED-256 and stop it caching the passphrase locally:

gpg -c --cipher-algo AES256 --no-symkey-cache "$file"

Creates $file.gpg encrypted file (can change this using --output filename.gpg.

Decrypt (the -d / --decrypt is implicit):

gpg "$file.gpg"

OpenSSL

Usually already available on Linux and Mac.

Encrypt:

openssl enc -aes-256-cbc -pbkdf2 -salt -in "$file" -out "$file.enc"

Decrypt:

openssl enc -d -aes-256-cbc -pbkdf2 -salt -in "$file.enc" -out "$file"

Age - Actually Good Encryption

Install on Mac:

brew install age

Encrypt original_file into encrypted_file.age using a passphrase with high-strength elliptic curve encryption (X25519):

age -p -o "$file.age" "$file"

Decrypt:

age -d -o "$file" "$file.age"