CLI Tool for File Encryption?

Question

I recently came across sigtool[1] which on the surface looks like a slightly more well defined tool/format for encryption than age[2].And they both attempt to be simpler, more modern than gnupg[3] and easier to use than eg: openssl[4].Which tool do you use/recommend for encrypting files, and why?My primary use case is for backups - but interested in other use-cases as well.[1] https://github.com/opencoff/sigtool[2] https://github.com/FiloSottile/age[3] https://gnupg.org/[4] https://wiki.openssl.org/index.php/Enc

FiloSottile · Accepted Answer

Hello! age (https://age-encryption.org) author here. Different tools can definitely be better for different use cases (for example I am a fan of restic [0] for backups, although age is designed to compose well with tar, if that's your thing), but do you mind me asking what made that tool feel more well defined than age?
age has a stable spec [1] and an alternative implementation in Rust [2] based on the spec with extensive interop tests.
If that’s just not visible, I’d be interested in how to fix that appearance, too!
[0]: https://words.filippo.io/restic-cryptography/
[1]: https://age-encryption.org/v1
[2]: https://github.com/str4d/rage

aborsy · Answer

If you want backups, Restic or Borg. I use Restic.
If you want file encryption, gpg -c (AES 256) or gpg -e (cv25519, optionally signed with ed25519). Frankly, there are tons of choices for file encryption.
If you want file system encryption, ZFS native encryption. There is fscrypt for other Linux file systems, but it doesn’t support authenticated encryption AFAIK.
If you want disk encryption, LUKS. Better yet, use file system encryption with a better mode and authenticated encryption.
If you want per file encryption of a directory, consider rclone which uses secret box from NACL (or gocryptfs which uses OpenSSL). There are many other options such as cryptomator (written in Java), but I can’t confirm them!

zvr · Answer

Many interesting comments in this thread -- thanks, everyone!
But a related question: how to handle long-term usage?
I mean, I had some scripts which were essentially using "openssl enc -bf -salt" and this has worked fine for more than a decade. But at some point (I think when OpenSSL went from 1.1.0 to 1.1.1), OpenSSL started generating a warning about "deprecated key derivation" and suggesting "using -iter or -pbkdf2". Now, I can obviously update the scripts, but then the need to start storing metadata arises: this file was encrypted with this method, but this one with the other method.
I am confident that such issues arise with any long-running process. How to cope with the issue?

byteshock · Answer

If I need to encrypt a file for quick sharing, I’ll use gpg. Encrypt: gpg -c file.zip
Decrypt: gpg file.zip.gpg
However, for my personal files on my computer, I use a Veracrypt container with a strong password and custom pin.

exyi · Answer

When I want symmetric-key encryption which can even be opened by average Windows user, I just use `7z a output-file.7z input-file.txt -p"password"`

chasil · Answer

I wrote an article about OpenSSL some time ago, and it's Google's top hit on "openssl flat file encryption."
I've heard great criticism of directly using the RSA functions, but they do work for the exchange of a very small amount of data.
Newer versions of OpenSSL offer chacha20-poly1305 in the "enc" symmetric ciphers.
https://www.linuxjournal.com/content/flat-file-encryption-op...
I use p7zip for encrypted backups, even though the AES implementation is far from best practice.
https://piunikaweb.com/2019/02/01/insecure-aes-crypto-implem...

trevormcneal · Answer

GPG, I just plug this into my server and is done https://github.com/opsxcq/ansible-role-host-backup

barnabee · Answer

I&rsquo;ve had good experiences with age [1]: it&rsquo;s relatively easy to use and has sane defaults.[1] https://github.com/FiloSottile/age

GekkePrutser · Answer

For me GPG is still the #1.The main reason is the ability to use physical smartcards for encryption (or the openPGP applet on a yubikey). Until 'age' can match that, it is no alternative for me.

ale42 · Answer

Not sure if you are looking to single-file backups or an actual backup solution that includes good encryption. I have very good experience with restic (https://restic.net/), which encrypts all backups and does deduplication, using it on production servers with millions of files, as well as for home use (rather 100k files order of magnitude). It would be a bit too cumbersome for single-file use, though.

user3939382 · Answer

I use gnupg for this because it&rsquo;s widely used/battle testedhttps://blogs.sap.com/2022/04/23/how-to-encrypt-and-decrypt-...For anything critical, I try to avoid tools that are neat/cool but developed by small teams or individuals where the maintenance could suddenly disappear, which is common.

e12e · Answer

Thank you everyone for your input. My use-case for simple cli encryption is mostly for single files - not part of a full backup solution (for that I'm leaning towards zfs send with encrypted file systems).
This is more of a one-off tar czf - $HOME | encrypt > /mnt/usbstick.tgz.enc type thing - or for sharing encrypted files.
But I agree 7zip is a decent option for the latter.

bertman · Answer

I'm using restic -r sftp:: --password-command="pass mybackup" backup https://restic.readthedocs.io/en/latest/

zokier · Answer

age is the one thing that has any degree of mindshare. Technically it is certainly good enough for ensuring confidentiality. There are gazillion somewhat similar also-ran encryption tools, but their benefits are not there compared to their relative obscurity

neatze · Answer

Not sure what is implied specifically by "modern" outside of library's age, but it is really hard to beat setup of Yubikey's with OpenPGP and bash scripts using luks or tar depending on encrypted files use case.

lioeters · Answer

> A simple shell utility for encrypting and decrypting files using OpenSSLhttps://github.com/nodesocket/cryptr

_paulc · Answer

If you want a simple lightweight symmetric crypt CLI utility try ccrypt:http://ccrypt.sourceforge.net/

chrisdew · Answer

I use Turnstile: https://github.com/fadedbee/turnstile

chockablocker · Answer

gocryptfs uses file-based encryption that is implemented as a mountable FUSE filesystem. Each file in gocryptfs is stored one corresponding encrypted file on the hard disk. Filenames are encrypted as well.https://nuetzlich.net/gocryptfs/quickstart/

krnlpnc · Answer

Have you looked into rclone?

Jamie9912 · Answer

7zip

CLI Tool for File Encryption?

If I need to encrypt a file for quick sharing, I’ll use gpg. Encrypt: gpg -c file.zip
Decrypt: gpg file.zip.gpg
However, for my personal files on my computer, I use a Veracrypt container with a strong password and custom pin.

When I want symmetric-key encryption which can even be opened by average Windows user, I just use `7z a output-file.7z input-file.txt -p"password"`

GPG, I just plug this into my server and is done https://github.com/opsxcq/ansible-role-host-backup

I’ve had good experiences with age [1]: it’s relatively easy to use and has sane defaults.
[1] https://github.com/FiloSottile/age

For me GPG is still the #1.
The main reason is the ability to use physical smartcards for encryption (or the openPGP applet on a yubikey). Until 'age' can match that, it is no alternative for me.

I use gnupg for this because it’s widely used/battle tested
https://blogs.sap.com/2022/04/23/how-to-encrypt-and-decrypt-...
For anything critical, I try to avoid tools that are neat/cool but developed by small teams or individuals where the maintenance could suddenly disappear, which is common.

I'm using
`restic -r sftp:: --password-command="pass mybackup" backup`
https://restic.readthedocs.io/en/latest/

age is the one thing that has any degree of mindshare. Technically it is certainly good enough for ensuring confidentiality. There are gazillion somewhat similar also-ran encryption tools, but their benefits are not there compared to their relative obscurity

Not sure what is implied specifically by "modern" outside of library's age, but it is really hard to beat setup of Yubikey's with OpenPGP and bash scripts using luks or tar depending on encrypted files use case.

> A simple shell utility for encrypting and decrypting files using OpenSSL
https://github.com/nodesocket/cryptr

If you want a simple lightweight symmetric crypt CLI utility try ccrypt:
http://ccrypt.sourceforge.net/

I use Turnstile: https://github.com/fadedbee/turnstile

gocryptfs uses file-based encryption that is implemented as a mountable FUSE filesystem. Each file in gocryptfs is stored one corresponding encrypted file on the hard disk. Filenames are encrypted as well.
https://nuetzlich.net/gocryptfs/quickstart/

Have you looked into rclone?

7zip

CLI Tool for File Encryption?

If I need to encrypt a file for quick sharing, I’ll use gpg. Encrypt: gpg -c file.zipDecrypt: gpg file.zip.gpgHowever, for my personal files on my computer, I use a Veracrypt container with a strong password and custom pin.

When I want symmetric-key encryption which can even be opened by average Windows user, I just use `7z a output-file.7z input-file.txt -p"password"`

GPG, I just plug this into my server and is done https://github.com/opsxcq/ansible-role-host-backup

I’ve had good experiences with age [1]: it’s relatively easy to use and has sane defaults.[1] https://github.com/FiloSottile/age

For me GPG is still the #1.The main reason is the ability to use physical smartcards for encryption (or the openPGP applet on a yubikey). Until 'age' can match that, it is no alternative for me.

I use gnupg for this because it’s widely used/battle testedhttps://blogs.sap.com/2022/04/23/how-to-encrypt-and-decrypt-...For anything critical, I try to avoid tools that are neat/cool but developed by small teams or individuals where the maintenance could suddenly disappear, which is common.

I'm using restic -r sftp:: --password-command="pass mybackup" backup https://restic.readthedocs.io/en/latest/

age is the one thing that has any degree of mindshare. Technically it is certainly good enough for ensuring confidentiality. There are gazillion somewhat similar also-ran encryption tools, but their benefits are not there compared to their relative obscurity

Not sure what is implied specifically by "modern" outside of library's age, but it is really hard to beat setup of Yubikey's with OpenPGP and bash scripts using luks or tar depending on encrypted files use case.

> A simple shell utility for encrypting and decrypting files using OpenSSLhttps://github.com/nodesocket/cryptr

If you want a simple lightweight symmetric crypt CLI utility try ccrypt:http://ccrypt.sourceforge.net/

I use Turnstile: https://github.com/fadedbee/turnstile

gocryptfs uses file-based encryption that is implemented as a mountable FUSE filesystem. Each file in gocryptfs is stored one corresponding encrypted file on the hard disk. Filenames are encrypted as well.https://nuetzlich.net/gocryptfs/quickstart/

Have you looked into rclone?

7zip

If I need to encrypt a file for quick sharing, I’ll use gpg. Encrypt: gpg -c file.zip
Decrypt: gpg file.zip.gpg
However, for my personal files on my computer, I use a Veracrypt container with a strong password and custom pin.

I’ve had good experiences with age [1]: it’s relatively easy to use and has sane defaults.
[1] https://github.com/FiloSottile/age

For me GPG is still the #1.
The main reason is the ability to use physical smartcards for encryption (or the openPGP applet on a yubikey). Until 'age' can match that, it is no alternative for me.

I use gnupg for this because it’s widely used/battle tested
https://blogs.sap.com/2022/04/23/how-to-encrypt-and-decrypt-...
For anything critical, I try to avoid tools that are neat/cool but developed by small teams or individuals where the maintenance could suddenly disappear, which is common.

I'm using
`restic -r sftp:: --password-command="pass mybackup" backup`
https://restic.readthedocs.io/en/latest/

> A simple shell utility for encrypting and decrypting files using OpenSSL
https://github.com/nodesocket/cryptr

If you want a simple lightweight symmetric crypt CLI utility try ccrypt:
http://ccrypt.sourceforge.net/

gocryptfs uses file-based encryption that is implemented as a mountable FUSE filesystem. Each file in gocryptfs is stored one corresponding encrypted file on the hard disk. Filenames are encrypted as well.
https://nuetzlich.net/gocryptfs/quickstart/