spieglt / Cloaker

Simple, drag-and-drop, password-based file encryption
GNU General Public License v3.0
405 stars 38 forks source link

Decrypting a previously encrypted empty file does not work #9

Closed errhammr closed 3 years ago

errhammr commented 3 years ago

Hello! I'm running cloaker_cli on OpenBSD.

$ git describe --tags --always --dirty
v3.1
$ cloaker_cli -V                                   
Cloaker v3.1

I was playing around with it to evaluate what I could use it for. Out of curiosity I encrypted an empty file. This worked just fine. So I tried decrypting said file again and Cloaker wasn't having it.

$ cloaker_cli -d /tmp/emptyfile.cloaker
Password: 
Error: File not big enough to have been encrypted

I would expect Cloaker to be able to decrypt every file that it previously encrypted, even if it is empty.

I have two ideas how to solve this:

  1. Allow decryption of previously encrypted empty files. This would leak the plain text version of the file since Cloaker is using a stream cipher that – without padding the plain text – leaks the length of the plain text and a length of 0 doesn't leave a lot of room for interpretation. I don't consider this a security risk because the contents of an empty file don't give an attacker much of an advantage.
  2. Prevent encryption of empty files in the first place. This would, however, break the general purpose file encryption functionality because files need to meet certain criteria (i.e. being non-empty) in order to be encryptable. In a hypothetical software product that encrypts arbitrary files in an automated way using Cloaker, an empty file would cause an error that doesn't really add any value to the software product.

So if you ask me, please allow for empty files to be encrypted and decrypted just like any other file. I'd imagine this to be an easy fix but I have to admit that my Rust skills aren't quite there yet to create a PR.

spieglt commented 3 years ago

I'm working on Cloaker 4 and will add decryption of empty files to the feature list. Thanks!

spieglt commented 3 years ago

This should work now, please try it out and let me know! Also possible in the new browser version: https://cloaker.mobi.