Cryptex 1.1.2

Cryptex

A secure command-line tool for encrypting and decrypting files and folders using AES-GCM encryption with PBKDF2 key derivation.

Features

• Strong Encryption: Uses AES-256-GCM authenticated encryption
• Secure Key Derivation: PBKDF2 with 100,000 iterations and SHA-256
• File & Folder Support: Encrypt/decrypt individual files or entire folders
• Authenticated Encryption: Prevents tampering with encrypted data
• Multiple Passphrase Options: Command-line, environment variable, or interactive prompt
• Smart Folder Processing: Automatically handles .enc extensions and skips already encrypted files
• Command Aliases: Short aliases for faster typing (e, d, ef, df)
• Cross-Platform: Works on Windows, macOS, and Linux

Installation

Install from NuGet

Install as a global .NET tool:

dotnet tool install -g Cryptex

Usage

Basic Commands

Encrypt a single file

cryptex encrypt input.txt output.txt.enc
cryptex e input.txt output.txt.enc  # Short alias

Decrypt a single file

cryptex decrypt input.txt.enc output.txt
cryptex d input.txt.enc output.txt  # Short alias

Encrypt all files in a folder

cryptex encrypt-folder /path/to/folder
cryptex ef /path/to/folder  # Short alias

Creates .enc files for all files in the folder (recursively) and skips already encrypted files.

Decrypt all encrypted files in a folder

cryptex decrypt-folder /path/to/folder
cryptex df /path/to/folder  # Short alias

Decrypts all .enc files in the folder (recursively) and removes the .enc extension.

Passphrase Options

Command-line (use with caution)

cryptex encrypt input.txt output.txt.enc --passphrase "your-passphrase"
cryptex encrypt input.txt output.txt.enc -p "your-passphrase"  # Short form

Environment variable (recommended for scripts)

export CRYPTEX_PASSPHRASE="your-passphrase"
cryptex encrypt input.txt output.txt.enc  # No passphrase prompt

Interactive prompt (most secure)

cryptex encrypt input.txt output.txt.enc  # Will prompt for passphrase

Security Details

• Algorithm: AES-256-GCM
• Key Derivation: PBKDF2 with 100,000 iterations using SHA-256
• Salt: 16 bytes (randomly generated per file)
• Nonce: 12 bytes (randomly generated per file)
• Tag: 16 bytes (authentication tag)
• AAD: Includes magic bytes, version, salt, and nonce for additional integrity

File Format

Encrypted files use the following structure:

[Magic: "AESGCM10"] [Version: 1] [Salt: 16 bytes] [Nonce: 12 bytes] [Tag: 16 bytes] [Ciphertext: variable]

Development

Requirements

• .NET 9.0 or later

License

MIT