Like eat our vegetables. Wait. No, that’s actually good for you.

Whatever.

You get the idea.

Encrypting a file with 7zip is simple. Use the -p option:

~$ 7z a archive.7z -pSTRONG_PASSWORD_THAT_IS_REALLY_LONG_HERE! folder/

7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,8 CPUs x64)

Scanning the drive:
1 folder, 4 files, 0 bytes

Creating archive: archive.7z

Items to compress: 5

    
Files read from disk: 0
Archive size: 186 bytes (1 KiB)
Everything is Ok

I have always loved 7zip’s attempt to make me feel better.

“Don’t worry. Everything is Ok.” :thumbs_up: :grinning_squinting_face:

Note: There is no space between the option and the password. That’s an oddity with 7z that I just don’t see with many other CLI tools.

You may notice, however, that when you go to list the contents of the archive, the folder and file names are listed without prompting for the password!

~$ 7z l archive.7z                   

7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,8 CPUs x64)

Scanning the drive for archives:
1 file, 186 bytes (1 KiB)

Listing archive: archive.7z

--
Path = archive.7z
Type = 7z
Physical Size = 186
Headers Size = 186
Solid = -
Blocks = 0

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2023-08-23 16:01:10 D....            0            0  folder
2023-08-23 16:01:10 ....A            0            0  folder/bank_info.xlsx
2023-08-23 16:01:10 ....A            0            0  folder/classified.txt
2023-08-23 16:01:10 ....A            0            0  folder/file1.txt
2023-08-23 16:01:10 ....A            0            0  folder/file2.txt
------------------- ----- ------------ ------------  ------------------------
2023-08-23 16:01:10                  0            0  4 files, 1 folders

Showing folder and file names without requiring the password is probably not acceptable for encrypted files. (Then again, ideally we wouldn’t be using 7zip for encryption, but….I already made that point.)

To encrypt the folder and file names, too, we need to use an option that only shows up on the man page of 7zip and not in the CLI help output:

-mhe=on|off
   7z format only : enables or disables archive header encryption (Default : off)

So all of this only works on the 7z format vs traditional zip, etc…

With this, our example changes to:

7z a archive.7z -mhe=on -pSTRONG_PASSWORD_THAT_IS_REALLY_LONG_HERE! folder/

The output is the same until the file contents are listed:

7z l archive.7z                           

7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,8 CPUs x64)

Scanning the drive for archives:
1 file, 221 bytes (1 KiB)

Listing archive: archive.7z


Enter password (will not be echoed):
--
Path = archive.7z
Type = 7z
Physical Size = 221
Headers Size = 221
Solid = -
Blocks = 0

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2023-08-23 16:01:10 D....            0            0  folder
2023-08-23 16:01:10 ....A            0            0  folder/bank_info.xlsx
2023-08-23 16:01:10 ....A            0            0  folder/classified.txt
2023-08-23 16:01:10 ....A            0            0  folder/file1.txt
2023-08-23 16:01:10 ....A            0            0  folder/file2.txt
------------------- ----- ------------ ------------  ------------------------
2023-08-23 16:01:10                  0            0  4 files, 1 folders

One other thing to note: encrypting a file in this manner will leave the password in your shell history file. I will leave as an exercise to the reader the following search: “HISTCONTROL=ignorespace” 😏

I originally posted this entry on our family’s Wordpress blog, back in 2015. I decided to update and repost the content here, since it’s still relevant and it fits better here anyway…

miniLock is no longer actively maintained and is no longer recommended as an encrypton option.

There are lots of different ways to encrypt a file and today I want to cover one of the more obscure, and I believe more unique methods.

miniLock is was a Chrome app and relies on the combination of an email address and a strong passphrase as the key. This is both a positive and a negative.

That’s great because it means you can encrypt and decrypt files on a Chromebook, or any other machine without storing the private key locally. It’s bad because most people don’t have good passwords – much less passphrases.

Still, it’s a simple way to encrypt files, and I like to have options.

At the risk of making the process more complicated than it really is, I took some screenshots and walked through the installation and encryption process below.

Installation

Step 1: Install

Installation is super simple. Visit minilock.io and click the link to the Chrome App Store

Click “Add to Chrome”

Step 2: Launch

Go to the installed Apps in Chrome and click on the light blue padlock

Step 3: Create key

This is done by entering your email address and a strong passphrase.

Encryption

Step 4: Select file

Your miniLock ID is shown at the bottom of this window. This key can be posted or sent anywhere – and should be if you want others to be able to send you encrypted files with miniLock. I currently have even had my ID in my Twitter bio line - and in fact, the entire key ID fits in a single tweet.

My miniLock ID is UXTFUyqcoM3spXNMtqpZGqqNzjZyZsGiQQwezVH1UYNR5.

Now you can either drag the file you want to encrypt, or click the big square box to find your file.

Step 5: Encrypt

Paste in the miniLock IDs of the file recipients. I strongly recommend keeping these in a text file or email or Evernote or something similar. Again, they are not sensitive, so it really doesn’t matter where you keep them. A file in Dropbox would work just fine. :-)

You can add more miniLock IDs if you need to.

Step 7: Save encrypted file

Once complete, you can download the encrypted file by clicking on the down arrow. This “.minilock” file can be attached to an email or sent via Dropbox or put on a USB stick or stored and distributed anywhere, really.

Decryption

Decrypting a “.minilock” file is just as easy. Simply drag and drop the file onto the window from Step 4. The file will decrypt (assuming it was encrypted to your miniLock ID) and you can download and save the original file.

Conclusion

That’s really all there is to it.

I believe the greatest weakness and strength of the entire miniLock system is the keys. (Of course, that should be said of any good encryption system - and this solution hasn’t been elevated to that status yet.)

It’s a strength because the private key isn’t stored anywhere - it’s generated by the login process. It’s a weakness because there isn’t a good way to store the keys for others. Which means key distribution with miniLock has the same problem as PGP. Except there isn’t a way to sign the keys of others, so there’s no good way to establish trust, making the miniLock less ideal than PGP.

I still prefer PGP (or GnuPG) for encryption, but it’s good to have alternatives to work with. So I consider this just another option.

ncat is full of really slick new features, but the one I will cover here is the ability to do all the wonderful things nc could do, but over an SSL connection. (Yes, yes, yes: I should call it a TLS connection instead, but since the ncat documentation still refers to it as “SSL”, I will do the same here.)

To establish an encrypted ncat session, simply pass the “–ssl” option to ncat, along with the hostname or IP and destination port, like you would with any other connection:

ubahmapk@laptop:~ > echo -e "GET / HTTP/1.1\r\nHost: \
ubahmapk.github.io\r\nUser-Agent: ncat\r\nAccept: */*\r\nReferer: \
https://www.google.com/?gws_rd=ssl#q=ncat+ssl\r\n\r\n" \ 
| ncat --ssl -v ubahmapk.github.io 443
Ncat: Version 6.49SVN ( http://nmap.org/ncat )
Ncat: SSL connection to 23.235.44.133:443. Fastly, Inc.
Ncat: SHA-1 fingerprint: 2199 1384 6372 1713 B9ED 0E8F 00A5 9B73 0DD0 5658
HTTP/1.1 200 OK
Server: GitHub.com
Content-Type: text/html; charset=utf-8
Last-Modified: Mon, 21 Mar 2016 02:14:16 GMT
Access-Control-Allow-Origin: *
Expires: Mon, 21 Mar 2016 03:42:50 GMT
Cache-Control: max-age=600
X-GitHub-Request-Id: 17EB2C2C:38FF:984CD29:56EF6B60
Content-Length: 12733
Accept-Ranges: bytes
Date: Mon, 21 Mar 2016 03:32:50 GMT
Via: 1.1 varnish
Age: 0
Connection: keep-alive
X-Served-By: cache-dfw1826-DFW
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1458531170.944139,VS0,VE49
Vary: Accept-Encoding
X-Fastly-Request-ID: f9a65b919e4649f5ef6f24397ecdf953fee840dd

[trimmed output]

The ‘-v’ option above caused ncat to include the three lines at the top beginning with “Ncat: “, which confirm the version running, along with the SSL connection connection information. Adding three ‘-v’ options would add information like this:

 NCAT DEBUG: Using system default trusted CA certificates and those in /usr/local/share/ncat/ca-bundle.crt.
 Ncat: Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
 Ncat: Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
 Ncat: SHA-1 fingerprint: 5FB7 EE06 33E2 59DB AD0C 4C9A E6D3 8F1A 61C7 DC25
 Ncat: Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
 Ncat: Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
 Ncat: SHA-1 fingerprint: A031 C467 82E6 E6C6 62C2 C87C 76DA 9AA6 2CCA BD8E
 Ncat: Subject: C=US, ST=California, L=San Francisco, O=Fastly, Inc., CN=www.github.com
 Ncat: Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
 Ncat: SHA-1 fingerprint: 2199 1384 6372 1713 B9ED 0E8F 00A5 9B73 0DD0 5658
 NCAT DEBUG: Checking certificate DNS name "www.github.com" against "ubahmapk.github.io".
 NCAT DEBUG: Checking certificate DNS name "*.github.com" against "ubahmapk.github.io".
 NCAT DEBUG: Checking certificate DNS name "github.com" against "ubahmapk.github.io".
 NCAT DEBUG: Checking certificate DNS name "*.github.io" against "ubahmapk.github.io".
 Ncat: SSL connection to 23.235.40.133:443. Fastly, Inc.
 Ncat: SHA-1 fingerprint: 2199 1384 6372 1713 B9ED 0E8F 00A5 9B73 0DD0 5658

But it also includes a great deal of other details from the libnsock library and can greatly clutter up the output.

Inbound connections with ncat can also utilize the ssl option:

ncat --ssl -l -p 443 -e /bin/bash

(The above is a terrible thing to run. Do NOT do that…)

The code snippet below shows the options used to specify public and private SSL keys; certificate validation behavior and which file should be used to validate certificates; and which SSL ciphers to accept (or reject):

--ssl-cert             Specify SSL certificate file (PEM) for listening
--ssl-key              Specify SSL private key (PEM) for listening
--ssl-verify           Verify trust and domain name of certificates
--ssl-trustfile        PEM file containing trusted SSL certificates
--ssl-ciphers          Cipherlist containing SSL ciphers to use

If you needed to make SSL connections with the traditional nc client, you could either create an stunnel connection or utilize the openssl s_client command as a ncat client:

ubahmapk@laptop:~ > openssl s_client -host ubahmapk.github.io -port 443 
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "Fastly, Inc.", CN = www.github.com
verify return:1
---
Certificate chain
0 s:/C=US/ST=California/L=San Francisco/O=Fastly, Inc./CN=www.github.com
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate

[output trimmed]

But this method isn’t nearly as clean, and doesn’t allow for all the other functionality of netcat!

In fact, I’ll probably start a series on the different ncat options just for fun… :-)