Enscryerypt: Encrypt and decrypt files with Scryer Prolog

[triska]

Hi all,

Enscryerypt allows us to encrypt and decrypt files with Scryer Prolog, using state-of-the-art cryptographic algorithms from library(crypto):

https://www.metalevel.at/enscryerypt/

There are two properties I find especially attractive:

First, the encrypted output is emitted as Prolog facts in ASCII, using at most 75 characters per line. Therefore, the encrypted output can be easily printed on paper, communicated in audio connections and Morse transmissions etc.

Second, the core encryption logic comprises less than 20 lines of Prolog code, written as a DCG nonterminal which I repeat here for inspection:

encrypt_string_(String, Password) -->
        { Cost = 19,
          crypto_n_random_bytes(16, Salt),
          crypto_password_hash(Password, Hash, [algorithm('pbkdf2-sha512'),
                                                cost(Cost),
                                                salt(Salt)]),
          crypto_data_hkdf(Hash, 32, Ks, [info("key"),algorithm(sha256)]),
          crypto_data_hkdf(Hash, 12, IV, [info("iv"),algorithm(sha256)]),
          crypto_data_encrypt(String, 'chacha20-poly1305', Ks, IV,
                              Encrypted, [tag(Ts),encoding(octet)]),
          chars_base64(Encrypted, B64, []) },
        portray_clause_(cost(Cost)),
        portray_clause_(tag(Ts)),
        portray_clause_(salt(Salt)),
        "ciphertext(\"\\\n",
        string_lines(B64, 72),
        "\").\n".

The nonterminal string_lines//2 is used to break long strings into individual lines, using continuation escape sequences so that they are still valid Prolog text:

string_lines(String, Split) -->
        { length(First, Split) },
        (   { append(First, Remainder, String) } ->
            First,
            "\\\n",
            string_lines(Remainder, Split)
        ;   String
        ).

If there is any cryptographic fault in the encryption mechanism of Enscryerypt, it must be in one of the snippets shown above or in the underlying cryptographic primitives.

I find it especially convenient to use Enscryerypt from within Emacs, using the Emacs definitions provided in enscryerypt.el. If you place this file in the same directory as the Prolog source file (enscryerypt.pl) and evaluate it with M-x eval-buffer, then you can encrypt and decrypt Emacs buffers with, respectively, M-x enscryerypt-encrypt-buffer and M-x enscryerypt-decrypt-buffer.

For instance, here is encrypted text that you can try to decrypt:

cost(19).
tag([27,56,238,135,182,31,117,110,223,205,71,186,99,137,211,136]).
salt([81,81,158,43,51,38,46,182,81,231,191,103,41,211,46,21]).
ciphertext("\
Dm1G2he8mVWpQXn8cPBJ1UEgRgfOJmDY1zeAuuDtjBEydblPSZM8raeJiKCcQGAyIWoKPWOK\
eDRkXdaM5vWCDY6JvyoKUe0X1hcjWnpJVxq2VIuGjZpJkqj+IEZ0wnPCO9BwI51jxA+L/mue\
OnJ5awhMsU1FhqW8TBPjAh1VbjTqvM6QXyDv/3Zao8VeXCayt2K45yKL68JiClnAqY7GCq6D\
CZOEl7iuKYVffoDSxRsJN2rtg+ADn88LE7Q0LA==").

The password I used to encrypt it is: where the raven scry

To run Enscryerypt, you need the latest version of Scryer Prolog installed from source, due to the use of phrase_to_stream/2, portray_clause_//1, and other very recent additions.

Enjoy!
Markus

[triska]

Dear all,

Scryer Prolog currently stores the interaction in ~/.scryer_history, and that makes this interaction pattern very unsafe. I have filed #1324 for this issue, and will update the program as soon as such a switch is available.

Until then, please remove any such stored interaction from the log manually to preserve the secrecy of your passwords!

(This only affects the Emacs frontend.)

Thank you and all the best,
Markus

[triska]

Update: I have changed the Emacs frontend to use read/1 for reading passwords, so that passwords do not appear in ~/.scryer_history.

I think this resolves this security problem.

Please download the most recent version of enscryerypt.el to benefit from this improvement.

Thank you and all the best,
Markus

[triska]

Update: The new flag --no-add-history, added via #1342, reliably resolves such issues. I have updated the Emacs frontend so that it uses this flag, in order to not leave any trace of the interaction in the history.

Thank you a lot @wkral !