grub4dos
grub4dos copied to clipboard
chenall
Request: deccrypt utility to improve security
Security in g4d/g4e is not very good as files are either plain text or lzma. The md5 password can easily be found simply by looking at the menu.lst text file and decoding the md5 string with a standard md5 decrypt program.
ccrypt allows for asymmetric encode/decode http://ccrypt.sourceforge.net/
It would be very useful to have either the full utility or just a decrypt utility for g4d/g4e. It could be used as follows:
#deccrypt FILE PASSWORD OUTFILE
where OUTFILE is usually a memory drive of a sufficient size -e.g. (md)0x300+1 if file is less than 512 bytes.
set /p mypwd=Enter Pasword:
#pkeyfile is a small encrypted file containg text "PASSED"
/ext/deccrypt /pkeyfile %mypwd% (md)0x300+1
cat --locate=PASSED (md)0x300+1 || halt
#run an encrypted batch file
/ext/deccrypt /mysecretbatch.bat %mypwd% (md)0x3000+0x100
(md)0x3000+0x100
# or call (md)0x3000+0x100 param1 param2 param3
#run an encrypted menu file
/ext/deccrypt /mysecretmenu.lst %mypwd% (md)0x3000+0x100
configfile (md)0x3000+0x100
where OUTFILE is usually a memory drive of a sufficient size -e.g. (md)0x300+1 if file is less than 512 bytes.
So the decrypted text is stored in memory?
That doesn't seem secure. Users can get the plain text using cat command.
As far as I know, grub2's decryption method implements a file filter framework, so that the original text is not available even if you look into memory. (https://github.com/rhboot/grub2/blob/fedora-37/grub-core/kern/verifiers.c)
original text is only seen if you know the password. Only the author will know the password (or trusted colleagues). It is to personalise the USB drive for only one user. The author cannot tell anyone the password - otherwise they can easily decrypt all the encrypted files. The goal is to prevent anyone else from running g4d/g4e menu system or seeing contents of .bat files, domain password .txt files, XML files with passwords or Volume Licence product keys, etc. e.g. found USB drive in road, USB drive left on customer site, USB drive stolen.
ccrypt allows for asymmetric encode/decode http://ccrypt.sourceforge.net/
website down?
403 ERROR The request could not be satisfied.
[home] ccrypt Secure encryption and decryption of files and streams
ccrypt is a tool for encrypting and decrypting files and streams. It is based on the Rijndael block cipher, a version of which is also used in the Advanced Encryption Standard (AES, see http://www.nist.gov/aes). This cipher is believed to provide very strong security. The algorithm provided by ccrypt is not symmetric, i.e., one must specify whether to encrypt or decrypt. The most common way to invoke ccrypt is via the commands ccencrypt and ccdecrypt. There is also a ccat command for decrypting a file directly to the terminal, thus reducing the likelihood of leaving temporary plaintext files around. In addition, there is a compatibility mode for decrypting legacy files from the ancient Unix crypt(1) command. An emacs mode is also supplied for editing encrypted text files.
Encryption and decryption depends on a keyword (or key phrase) supplied by the user. By default, the user is prompted to enter a keyword from the terminal. Keywords can consist of any number of characters, and all characters are significant (although ccrypt internally hashes the key to 256 bits). Longer keywords provide better security than short ones, since they are less likely to be discovered by exhaustive search.
For a detailed description of the encryption algorithm used by ccrypt, see the man page.
Frequently Asked Questions I often receive questions from users about ccrypt. I have written up the answers to some Frequently Asked Questions. News For changes prior to version 1.9, see the file NEWS. For a more detailed list of changes, see the ChangeLog. July 27, 2018: Release 1.11. This release fixes a number of minor portability issues and minor bugs. In cat and unixcrypt modes, "-" can now be specified as a filename to mean standard input. The emacs mode has been updated for compatibility with Emacs 26. Estonian translations were added. Thanks to Hugh McDonald, dcb314, d8uoba, Zhang Jun, and Duncan Bayne for reporting bugs, and to Estprog for the Estonian translation.
July 25, 2018: Emacs 26 compatibility patch. If you are using ccrypt 1.10 or earlier, for compatibility with Emacs 26, apply this patch or use this updated ps-ccrypt.el.
October 18, 2012: Release 1.10. This release fixes a number of minor portability issues and minor bugs. The ccrypt core functionality has been factored into a convenience library libccrypt.a. A ccguess program was added to assist in the recovery of mistyped keys. Improved error checking and fixed minor compiler warnings. Minor improvements to emacs support, and added a --disable-emacs configuration option. Thanks to bornlibra23 and Johannes Ruscheinski for bug reports.
August 28, 2009: Release 1.9. This release fixes a number of portability issues. There is no change in functionality relative to release 1.8. However, compilation errors on several platforms have been fixed, including Mac OS X, Ubuntu, FreeBSD, and Solaris 10. Also, rudimentary OS/2 support via EMX has been added. Thanks to Lester Ingber, Elbert Pol, and Michael Annino for reporting problems and helping to fix them.
Downloading and Installing
You have three different options for installing ccrypt:
From source. Download the "source distribution" from the below list of downloads. Ccrypt is built from sources using the standard configure/make commands. Please see the file INSTALL for detailed instructions.
From a precompiled binary distribution. Precompiled distributions are available for a number of platforms; please download the one you need from the below list. Note that some binary distributions are of older versions of ccrypt. See the file README for some hints on how to install the binaries. Windows users please see the file README-WIN.
From a package. These are for specific platforms. If you want to use one of these, you probably know how.
If you would like to ensure the accuracy of the downloaded files, you can double-check their SHA1 sums.
Source distribution: ccrypt-1.11.tar.gz
Precompiled distributions: Linux (64 bit) ccrypt-1.11.linux-x86_64.tar.gz
Linux (32 bit) ccrypt-1.11.linux-i386.tar.gz
Windows (64 bit) ccrypt-1.11.cygwin-x64.tar.gz
ccrypt-1.11.cygwin-x64.zip
Windows (32 bit) ccrypt-1.11.cygwin-x86.tar.gz
ccrypt-1.11.cygwin-x86.zip
Mac OS X (64 bit) ccrypt-1.11.mac-x86_64.tar.gz
FreeBSD ccrypt-1.11.freebsd-amd64.tar.gz
OpenBSD ccrypt-1.11.openbsd-amd64.tar.gz
Sun Solaris (Sparc) ccrypt-1.11.solaris-sparc.tar.gz
Minix (i386) ccrypt-1.11.minix-i386.tar.gz
Android 4+ ccrypt-1.10.android.tar.gz(1)
AIX ccrypt-1.9.aix-rs6000.tar.gz
Linux for Alpha ccrypt-1.7.linux-alpha.tar.gz
Sun Solaris (i386) ccrypt-1.7.solaris-i386.tar.gz
NetBSD ccrypt-1.7.netbsdelf-i386.tar.gz
HP-UX ccrypt-1.7.hpux.tar.gz(2)
Packages: Debian Package (amd64) ccrypt_1.11-1_amd64.deb(3)
Redhat Source RPM ccrypt-1.11-1.src.rpm
Redhat Binary RPM (x86_64) ccrypt-1.11-1.x86_64.rpm
Solaris Package (Sparc) ccrypt-1.9-sol10-sparc-local.gz(4)
Solaris Package (i386) ccrypt-1.9-sol10-x86-local.gz(4)
OS/2 Package ccrypt-1_11-1_oc00.zip(5)
(1) Android binaries supplied by Lester Ingber. There may be a problem with short options, but long options work fine. Lester Ingber and Roman Lebedev report that ccrypt-1.10 executables can be compiled and work in Android 4.4.2 using C4droid and BusyBox Install Pro (No Root), both from the Google Play store. Android 4+ binaries will not work on Android 5+ phones. You may address queries to
Usage ccrypt 1.11. Secure encryption and decryption of files and streams.
Usage: ccrypt [mode] [options] [file...] ccencrypt [options] [file...] ccdecrypt [options] [file...] ccat [options] file...
Modes: -e, --encrypt encrypt -d, --decrypt decrypt -c, --cat cat; decrypt files to stdout -x, --keychange change key -u, --unixcrypt decrypt old unix crypt files
Options: -h, --help print this help message and exit -V, --version print version info and exit -L, --license print license info and exit -v, --verbose print progress information to stderr -q, --quiet run quietly; suppress warnings -f, --force overwrite existing files without asking -m, --mismatch allow decryption with non-matching key -E, --envvar var read keyword from environment variable (unsafe) -K, --key key give keyword on command line (unsafe) -k, --keyfile file read keyword(s) as first line(s) from file -P, --prompt prompt use this prompt instead of default -S, --suffix .suf use suffix .suf instead of default .cpt -s, --strictsuffix refuse to encrypt files which already have suffix -F, --envvar2 var as -E for second keyword (for keychange mode) -H, --key2 key as -K for second keyword (for keychange mode) -Q, --prompt2 prompt as -P for second keyword (for keychange mode) -t, --timid prompt twice for encryption keys (default) -b, --brave prompt only once for encryption keys -y, --keyref file encryption key must match this encrypted file -r, --recursive recurse through directories -R, --rec-symlinks follow symbolic links as subdirectories -l, --symlinks dereference symbolic links -T, --tmpfiles use temporary files instead of overwriting (unsafe) -- end of options, filenames follow For detailed usage information, see the man page. Emacs Support ccrypt comes with an emacs package for reading and writing encrypted files. (Note that this package currently only works with emacs, not with xemacs.) The package is called ps-ccrypt, and it is based directly on the jka-compr package which is part of GNU Emacs. Unlike previous versions of this package, it can be used in addition to, and not instead of, jka-compr, to handle both encrypted and compressed files. (However, files that are both encrypted and compressed are not currently handled correctly). To use the package, simply load ps-ccrypt and edit as usual. When you open a file with the ".cpt" extension, emacs will prompt you for a password for the file. It will remember the password for the buffer, and when you save the file later, it will be automatically encrypted again (provided you save it with a ".cpt" extension). Except for the password prompt, the operation of the package should be transparent to the user. The command M-x ccrypt-set-buffer-password can be used to change the current password of a buffer.
The simplest way to use this package is to include the lines (setq load-path (cons "path" load-path)) (require 'ps-ccrypt "ps-ccrypt.el") in your .emacs file, where path is the directory which holds the file ps-ccrypt.el.
Other software related to ccrypt The following is a list of software related to ccrypt. The list is not comprehensive; please let me know if you know of other such programs. Note that I have not tried most of these programs. Use them at your own risk. gjots by Bob Hepple. A lightweight jotter which marshals and organizes text notes in a convenient, hierarchical way. It can be used for notes, jottings, bits and pieces, recipes, and even PINs and passwords (encrypted with ccrypt). (Added Oct 2, 2003). xzgvz by Stan Zitello. A modification of xzgv, a GTK-based image viewer. The modified version can display ccrypt-encoded jpeg images with the filename extensions .cjpg or .cjpeg. (Added Jan 30, 2004). Ccrypt-GUIs Integration Scripts by VF. A collection of scripts for creating context menu entries for ccrypt in KDE, Gnome, and Windows 98+. This should allow you to encrypt/decrypt files by right-clicking on them. (Added Sep 26, 2004). Tkccrypt by Lluís Batlle i Rossell. A simple text editor for ccrypt'ed files. (Added Nov 2, 2006). Qccrypt by Philippe Beaureilles. This is a cross-platform graphical user interface for ccrypt. It works anywhere QT is available, like Linux, Windows, and Mac. (Added Apr 3, 2011). CCRYPTGUI by Martin Hilscher. Another graphical user interface for ccrypt using QT. Works in English or German. (Added Apr 3, 2011). Antigift by Maxim Falcony. A simple cross-platform encryption tool. (Added Aug 8, 2012). Support and Reporting Bugs Get ccrypt at SourceForge.net. Fast, secure and Free Open Source software downloadsCcrypt has a project page on SourceForge. There, you will find facilities for reporting bugs, submitting patches, asking for support, asking for features, or discussing ccrypt in general. You are encouraged to use these facilities. You can also send email to the author. Version 1.11 Author Copyright © 2000-2018 Peter Selinger. License This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
Back to Homepage: [home] Peter Selinger /Department of Mathematics and Statistics /Dalhousie University [email protected] / PGP key