v4.0.0

Warning
This release contains many breaking changes. If you're updating from a previous version of Kryptor, please decrypt all of your files using your current version.

After many hours and much indecision, the next major version of Kryptor is here. It's not perfect; there are still a few things I'm not entirely happy about. However, it's definitely an improvement on v3. I just hope I haven't missed anything, and please bear with me whilst I update the website.

Deprecated

• Support for the previous private key format will be removed in a future release. The format is automatically updated when you use your private key for the first time.
• Similarly, support for the previous public key format will be removed in a future release. Again, the format is automatically updated when your private key is. Alternatively, you can use -r|--recover.

Note
You should republish/share your new public key string/file in place of the old one and back up your new private key file. However, your key pair doesn't actually change. The private key gets re-encrypted, and the public key has a different header, so the string looks different.

Added

• The new encryption format is intended to be indistinguishable from random to limit metadata. This means no identifiable headers and randomised padding. Few tools do this (e.g. age doesn't care about metadata). A huge thanks to Monocypher for Elligator 2 and Covert Encryption for inspiration and their randomised padding scheme.
• Directories are now converted into ZIP files (with no compression for speed) before being encrypted. This means an encrypted directory is indistinguishable from an encrypted file.
• You can now specify up to 20 public key recipients for a single file. It used to be limited to 1 recipient.
• Support for pre-shared keys has been added to provide optional post-quantum security when encrypting a file to someone's public key.
• Pre-shared keys can also be used for file encryption alone like keyfiles. This is a faster alternative to password-based encryption.
• Some of the encrypted metadata header is currently empty, which will eventually be used for storing the file timestamps and cross-platform attributes. The timestamps of the encrypted file can then be altered to further limit metadata. This all needs more thought and some study of digital forensics though.
• You can now sign each file in a directory. This is handy for signing software releases quickly.
• Multiple signatures can now be verified at once.
• Multiple custom signature paths can be specified at once for signing.
• Key pairs can be generated non-interactively.
• macOS ARM64 and Linux ARM64 are now officially supported and can be updated using -u|--update.
• A -1 exit code is returned when an error occurs.

Changed

• Switched from XChaCha20-BLAKE2b to ChaCha20-Poly1305 for encryption. It's faster and standardised. The padding fix is applied when encrypting the metadata header to add key commitment.
• Now using a little-endian counter nonce and the STREAM construction. A random nonce is unnecessary in this use case, especially since it was being incremented for each chunk before anyway. Then the STREAM construction has become unofficially standardised and is more flexible.
• The Argon2 parameters have been reduced as they were excessive and much slower than I thought on other machines. This speeds up password-based key derivation whilst retaining a good security margin.
• Passwords are no longer prehashed. This was done previously for consistency with how peppering was done.
• The pepper is now used as input keying material for key derivation after password hashing instead of being used as a key prior to password hashing. This was done to save an extra call to BLAKE2b.
• Using a keyfile alone no longer uses Argon2 as random keyfiles are high in entropy.
• Keyfile hashing has been made compatible with the pre-shared key format, and random keyfiles are now 32 bytes in size instead of 64 bytes.
• The previous authentication tag is no longer used as associated data. This was unnecessary and came with a performance cost.
• Both public keys are included in the key derivation for shared secrets.
• The long-term and ephemeral shared secrets are concatenated the other way around to comply with the Noise Protocol Framework.
• The ephemeral public key is used as info in the wrap key derivation instead of being used as associated data. With passwords/pre-shared keys, this is actually an additional 256-bit random salt since no public key is used.
• The encrypted metadata header has been rearranged. The file length is now stored instead of the amount of padding. The file name is also stored there and padded to 256 bytes.
• Private keys are now encrypted using ChaCha20-Poly1305 with the padding fix for key commitment and an all zero nonce since the key is unique.
• The public/private key headers have been changed to make the algorithm readable at the beginning of the string (Cu// for Curve25519 and Ed// for Ed25519).
• Geralt, my libsodium binding, is now used instead of libsodium-core.
• Thanks to Geralt, spans are used instead of byte arrays when possible for improved performance and fewer allocations.
• Sensitive bytes are pinned when possible/sensible so they can be zeroed properly.
• FileStream performance should be improved as the buffer size is now adjusted based on the size of the file and output files are preallocated on disk.
• Random file name generation has been improved due to Geralt.
• File names are checked for invalid characters to prevent problems storing the file name/decrypting cross-platform.
• libsodium is used for Base64 encoding, which is done in constant time.
• Lots of wrapper classes have been removed due to Geralt.
• It's now clearer when you're being asked for a private key password compared to a regular password.
• 'Directory' is used instead of 'folder' in messages.
• Some error messages have been made more consistent.
• Blue is no longer used for any messages; orange (technically 'dark yellow') is used instead.
• The initial validation has been improved.
• Code has been spaced out for readability, Geralt constants are used, and the if/loop braces style has been changed.

Fixed

• Early returns when an exception was thrown during decryption, potentially preventing some files from being processed.
• An empty file name in error messages when the path ends in a directory/volume separator character.
• An unhandled directory UnauthorizedAccessException during empty directory validation.
• 'name (2)' getting restored to 'name (3)' instead of 'name (2) (2)' if 'name (2)' exists decrypting a file that had its name encrypted. I don't like this numbering, but it's the safest approach I can come up with.
• Removing double digit file name numbers (e.g. 'name (10)').
• The resources are now embedded when building as well as publishing.
• The publish profiles for ARM64.
• Probably some other stuff I've neglected to mention.