Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encrypted text file support #38

Merged
merged 2 commits into from
Mar 29, 2015
Merged

Encrypted text file support #38

merged 2 commits into from
Mar 29, 2015

Conversation

laenion
Copy link
Contributor

@laenion laenion commented Mar 28, 2015

Add support for encrypted text files

Motivation: As I keep some private files on my phone I needed some way to read / write encrypted text files on my phone. My original intention was to write a separate program, but seeing that it would have been necessary to implement all the file handling stuff myself I decided to just integrate it into file-manager instead.

Technology: For de- and encryption the "Gibberish AES" library is used (https://github.com/mdp/gibberish-aes), mainly because of it's size and speed. I did not do any security review! The library will decrypt files encrypted with AES-256-CBC, thus making it compatible with OpenSSL (and several other libraries). A password of sufficient length (>=12 characters) should keep a supercomputer busy for several decades 😏

Testing: I'm personally using this feature for several months now, but cleaned it up a bit today for this pull request.

Merging: The big question is if such a feature would be interesting for master, so feel free to reject it if you don't think it suits 😏. In case a merge seems reasonable I'll also change the documentation and translation parts of the source in later commits.

Usage: The text editor now has a new lock icon, indicating if the file will be saved with (locked) or without (unlocked) encryption. You can turn encryption on and off by pressing that icon. If you turn encryption on you will be asked to enter a password, which will be applied when saving the document. If you turn it off the document will (obviously) be saved without encryption.
If you open a document which is encrypted already you will be asked for your password on opening. And if you just want to see the encrypted file you may leave the password field empty.

laenion added 2 commits March 25, 2015 17:33
You may want to store secret or private information on your mobile
phone not intended for other eyes; this patch implements basic support
for reading and modifying encrypted text files.

For de- and encryption the "Gibberish AES" library is used
(https://github.com/mdp/gibberish-aes), mainly because of it's size and
speed. The library will decrypt files encrypted with AES-256-CBC, thus
making it compatible with OpenSSL (and several other libraries).
@j8r
Copy link
Collaborator

j8r commented Mar 28, 2015

Nice feature! I believe that someday, crossed with #34 zip feature, we will even be able to encrypt/decrypt archives :D

@elfoxero
Copy link
Owner

Amazing, it's an interesting feature. Thank you.

elfoxero added a commit that referenced this pull request Mar 29, 2015
Encrypted text file support
@elfoxero elfoxero merged commit 4c945d1 into elfoxero:master Mar 29, 2015
@laenion laenion deleted the encryption branch March 29, 2015 09:43
@laenion
Copy link
Contributor Author

laenion commented Mar 30, 2015

Thanks for merging!

@JulR43 I've had a look at the ZIP file specification (https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT). Basically there are two possible ways how a file can be encrypted:

  1. The "old" way, using a custom (and insecure) encryption algorithm per file.
  2. The "new" (Strong Encryption) way. Unfortunately this part of the specification is proprietary / patented (and thus may not be used without a proper license), and apart from that a plethora of different algorithms are supported in the specification, so I'm not sure if that's really in scope ;-)
  3. And then there's the third way: the WinZip encryption, which is not part of the official ZIP standard, is specified here: http://www.winzip.de/aes_info.htm. I guess that's the encryption you meant, isn't it?

In any case: if we want to implement anything of the above this would require some support from the compression library, as required information is stored in the encryption / archive / file header (depending on which encryption it is). Unfortunately JSZip currently doesn't provide access to that information.
It would probably be easier if the compression library supported encrypted files itself in the first place ;-) However JSZip currently has no plans to support encryption (Stuk/jszip#115).

@j8r
Copy link
Collaborator

j8r commented Mar 30, 2015

Thanks for our contribution and informations about zip encryption! Finally it isn't so bad that this feature isn't available, because your encrypted text file feature is very useful to protect sensitive data :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants