Encryption Library (KID & CLI)

A C++ library and CLI tool to encrypt/decrypt a file or folder using 7‑Zip for archiving and a chain of transform algorithms (default: AES then XOR).
Each encrypted file embeds a cleartext header with a Key ID (KID) so the correct key can be located in keys.txt without relying on line order.

---

How it works

1. Zip with password (7‑Zip): The input file/folder is archived with 7z using the provided password.
2. Transform chain: On encrypt, algorithms run in order (e.g., AES → XOR). On decrypt, algorithms run in the reverse order (XOR → AES).
3. Clear header: The encrypted output begins with:

   ENCLIBv1
   KID:<64‑hex of SHA‑256(key)>
   
   <encrypted payload bytes...>
   

4. Key lookup by KID: The decryptor reads KID from the header, finds the matching key in keys.txt by hashing each line (after trimming), then runs the reverse chain.

Key consumption policy (as you requested):
After a successful encrypt, the used key is removed from keys.txt (one‑time use). When testing on the same machine, use a separate copy of the keys file for decrypt, or switch the policy to consume only on decrypt.

---

Features

• 7‑Zip CLI for password‑protected archives
• Pluggable transform chain (extensible). Defaults included:
  • AES (OpenSSL EVP, demo settings)
  • XOR (self‑inverse; demo only)
• KID‑based lookup: key order/position in keys.txt doesn’t matter
• Duplicate key removal by KID when loading the keys file

---

Dependencies

• C++17 (e.g., g++)
• OpenSSL for AES (-lcrypto)
• 7‑Zip: 7z must be available in your PATH
  • Linux/WSL: sudo apt install p7zip-full
  • macOS (Homebrew): brew install p7zip
  • Windows: install 7‑Zip and add 7z.exe to PATH

---

Project files

• Encryptor.h — API/types for the library
• Encryptor.cpp — encryption/decryption, header/KID, 7‑Zip calls, AES/XOR
• main.cpp — command‑line interface (CLI)

---

Build

Linux/macOS (g++)

g++ -std=c++17 -O2 -o encrypt_demo main.cpp Encryptor.cpp -lcrypto

Windows (MinGW)

g++ -std=c++17 -O2 -o encrypt_demo.exe main.cpp Encryptor.cpp -lcrypto

For MSVC, link OpenSSL as installed on your system.

---

Usage (CLI)

Help

./encrypt_demo --help

Encrypt

./encrypt_demo -e -i <inputPath> -o <encryptedFile> -k <keys.txt> [-p <zipPassword>]

• -i : input file/folder to zip
• -o : output encrypted file (e.g., encrypted.dat)
• -k : path to the keys file
• -p : 7‑Zip archive password (default: zipSecret)

Decrypt

./encrypt_demo -d -i <encryptedFile> -o <outputDir> -k <keys.txt> [-p <zipPassword>]

• -i : the encrypted file (output of Encrypt)
• -o : target directory for extraction

Examples

# Encrypt
./encrypt_demo -e -i ./example.txt -o ./encrypted.dat -k ./keys_sender.txt -p zipSecret

# Decrypt
./encrypt_demo -d -i ./encrypted.dat -o ./decrypted_output -k ./keys_receiver.txt -p zipSecret

If your policy consumes the key on encrypt, use a separate copy of the keys file for decrypt during round‑trip tests on one machine.

---

Keys file (keys.txt)

• One key per line (UTF‑8, no BOM, no leading/trailing spaces).
• KID = SHA‑256(key) (64‑hex) is stored in the encrypted file header.
• The library de‑duplicates keys by KID when loading.

Quick key generation (Linux/macOS)

for i in {1..200}; do LC_ALL=C tr -dc 'A-Za-z0-9_-.' </dev/urandom | head -c 64; echo; done > keys_raw.txt
python3 - <<'PY'
import hashlib
seen=set(); out=[]
for k in open("keys_raw.txt","r",encoding="utf-8",errors="ignore"):
  k=k.strip()
  if not k: continue
  kid=hashlib.sha256(k.encode()).hexdigest()
  if kid in seen: continue
  seen.add(kid); out.append(k)
open("keys.txt","w").write("\n".join(out)+"\n")
print("written",len(out),"keys to keys.txt")
PY

---

Security notes

• XOR is for demo only—do not rely on it for real confidentiality.
• The sample AES uses AES‑256‑CBC with a zero IV for simplicity. For real‑world use:
  • Generate a random IV per file and store it in the header (e.g., IV:<hex>).
  • Consider AES‑GCM (confidentiality + integrity).
• Protect your keys (chmod 600 keys.txt, encrypted backups, etc.).

---

Common issues

• No matching key for KID=...
  • The corresponding key isn’t present (perhaps consumed on encrypt).
  • File has BOM or extra whitespace changing the KID—save as UTF‑8 without BOM.
  • If consuming on encrypt, use a separate keys copy for decrypt.
• 7zip extract failed
  • Wrong -p password.
  • Decrypt chain order must be reverse of encrypt (the code does this).
  • 7z not in PATH or archive is corrupted.
• 7z: command not found
  • Linux: sudo apt install p7zip-full
  • macOS: brew install p7zip
  • Windows: install 7‑Zip and add it to PATH.

---