Encryption is a dangerous munition, or at least it was according to US export regulations between the second world war and the twenty first century. Though ridiculous as it may sound today, strong encryption is under attack
once again by the US government, with the likes of ISIS and Boko Haram
as the frightening face of the new anti-encryption campaign. To be fair,
the US government isn't attacking all encryption, rather they're
attacking encryption that works. What they're seeking is a world in
which encryption is broken in a very specific and controlled way, such
that government agencies can get access to the encrypted data while
still locking out other adversaries. This, of course, is fundamentally stupid.
As a response to such an absurd policy direction, I'm writing this guide to show you a reliable way to encrypt files. While the proposals of the US government aren't directed so much at file encryption as they are for encryption of messages, these are things that I've written about several times before. Thus, I thought I'd pivot slightly with this guide and focus on encrypting other kinds of data reliably. This will be the first of a two-part series on file encryption focusing on encrypting data with GPG. Later we will focus on Tomb file encryption.
Typically when we want to encrypt data it involves more than one file, and because of this we need to first aggregate all the different files we want to encrypt into one clump. For this we use a classic tool called Tar. Tar (Tape ARchive) essentially takes multiple files and welds them together, and also provides the ability to apply compression in the process, such as GZIP and XZ, to reduce the file-size. We always want to compress our files before encrypting them, otherwise the data will be too random (as compression relies on patterns).
Here is an example that will create an archive called archive.tar.xz using three text files, with XZ compression being applied in the process.
With this finally set, and with the data aggregated into a single file, we can start encrypting our files!
But what are your favourite methods for file encryption? Leave a comment down below.
As a response to such an absurd policy direction, I'm writing this guide to show you a reliable way to encrypt files. While the proposals of the US government aren't directed so much at file encryption as they are for encryption of messages, these are things that I've written about several times before. Thus, I thought I'd pivot slightly with this guide and focus on encrypting other kinds of data reliably. This will be the first of a two-part series on file encryption focusing on encrypting data with GPG. Later we will focus on Tomb file encryption.
GPG? Isn't That For Email?
GPG is an encryption toolset that is best known for encrypting email, and while it is magnificent in this regard (usability aside), it's also equally capable at encrypting files. Moreover, GPG is also usually associated with asymmetric encryption, that is encryption using separate public and private keys, but it also has the capability to encrypt files symmetrically using a password. Today we'll learn how to encrypt files using the symmetric side of GPG, though there are definitely legitimate use cases for each.But why would we use GPG for file encryption?
There are several pros and cons to using GPG for file encryption. The benefits are that it is usually installed by default on just about any Linux distribution, and it's rock-solid reliable. The cons are that it doesn't hide file size, and can be (in some regard) hard to use at first for beginners. It also doesn't work on directories on its own, requiring another utility called tar, though this is also installed by default on just about every distribution.Step 1: Preparing The Data
(If you are only encrypting one file, skip this step)Typically when we want to encrypt data it involves more than one file, and because of this we need to first aggregate all the different files we want to encrypt into one clump. For this we use a classic tool called Tar. Tar (Tape ARchive) essentially takes multiple files and welds them together, and also provides the ability to apply compression in the process, such as GZIP and XZ, to reduce the file-size. We always want to compress our files before encrypting them, otherwise the data will be too random (as compression relies on patterns).
Here is an example that will create an archive called archive.tar.xz using three text files, with XZ compression being applied in the process.
tar -cJf archive.tar.xz file-1.txt file-2.txt file-3.txt
Step 2: GPG Encryption
Now that the data has been aggregated to only one file, we can use GPG to encrypt it. First, however, we may want to change the default encryption algorithm that GPG uses. To do this, we must edit the gpg.conf file and add a line at the end.
nano ~/.gnupg/gpg.conf
cipher-algo AES256
With this finally set, and with the data aggregated into a single file, we can start encrypting our files!
gpg -c archive.tar.xz
Step 3: Cleaning Up
The file ending in '.gpg' will be the encrypted file that you can send or upload online without worrying (assuming you used a strong password). If, however, you don't want any trace of the original files on your computer, you'll need to do a bit of cleanup. I've already written a quick guide on secure file deletion, so give that a read for a more in depth explanation. Nevertheless, the command you'll want to use to securely erase the unenecrypted data from your disk is the shred command.
shred -u archive.tar.xz file-1.txt file-2.txt file-3.txt
Step 4: Decryption
Decrypting the files takes about as long as encrypting them. First, you'll want to use GPG to decrypt the archive, then tar to uncompress and unpack it.
gpg -d archive.tar.xz.gpg
tar -xf archive.tar.xz
And You're Done
That may seem like quite a bit of work, but after getting the hang of it, which doesn't take long, it is actually a very quick process. I personally use this method for when I work with data on Tails, as it allows me to encrypt and decrypt data without having to install any other software, and without having to go online.But what are your favourite methods for file encryption? Leave a comment down below.
