This is the documentation for the tool DiscreteCrypt, which is a BSD-2 Licensed replacement for tools like PGP/GPG designed for flexibility and ease of use.
The tool uses a Hybrid Cryptosystem built on Discrete Log Cryptography (hence, DiscreteCrypt). This design choice makes it far more convenient to support ease of use.
If you want to be able to quickly use the tool without reading the rest of the documentation, this quick start is provided. There are three basic functionalities you need to know.
This allows people to send stuff to you securely, just use:
cryptotool -contact alice.contact
To send an encrypted file quickly (and anonymously) to a contact (like Bob), you just use a command like:
cryptotool -to bob.contact file.zip file.zip.enc
If you want to send it FROM your contact, you use
cryptotool -from alice.contact -to bob.contact file.zip file.zip.enc
This command allows you to open encrypted files that are sent to your personal contact files.
cryptotool -open file.zip.enc file.zip
It is important to note that DiscreteCrypt command line arguments are parsed from left to right, with no program-defined limits on how many commands can be performed in a single execution.
It is important to keep in mind that because of this, the ordering of the arguments matter.
| Command | Use |
|---|---|
| -contact <out> | Generates a contact to allow people to send files to you securely. This contact may also be used for signatures. |
| -to <contact> <file> <encrypted file> | Creates an encrypted file for contacts. This parameter can be comma delimited if you’re sending the file to multiple contacts. |
| -from <contact> | Specifies where the encrypted file is from. If this is not specified before the -to command is performed, the tool will generate an anonymous sender. |
| -open <encrypted file> <out> | Decrypts an encrypted file, and export it to <out>. |
| -sign <contact> <file> <out> | Creates a signature for a file using your contact file. |
| -verify <signature file> <file> | Verifies a file from its signature file. |
| -bundle <contact> <file> <out> | Creates a bundle of the file and its signature. You can use DiscreteCrypt to extract the file and verify it. |
| -debundle <bundle file> <out> | Extracts a file from a bundle and verifies it against the stored signature. |
| -hash <code> | Sets the hash algorithm to be used by following commands. (See Supported Hash Algorithms) |
| -ciph <code> | Sets the cipher to be used by following commands. (See Supported Ciphers) |
| -check <contact> | Used to check a password against a contact file. |
| -import <contact> | Used to import a contact file into the local DiscreteCrypt directory, which can store contacts globally for your user account. |
These are the lesser used auxiliary commands.
| Command | Use |
|---|---|
| -ciphlist | Prints out all supported ciphers. |
| -hashlist | Prints out all supported hash algorithms. |
| -pdh | Prints out the current Discrete Log (Diffie-Hellman) Parameters. |
| -ldh <dh file> | Loads in Discrete Log (Diffie-Hellman) Parameters. These can be generated by a tool like nspdh. |
| -pldh <dh file> | Prints out Discrete Log (Diffie-Hellman) Parameters from a file. |
| -dhtest | Tests the currently loaded Discrete Log (Diffie-Hellman) Parameters. |
| -pc <contact> | Prints out information about a contact. |
| -pe <encrypted file> | Prints out information about an encrypted file. |
| -exc <encrypted file> <contact out> | Extracts a contact from an encrypted file. |
| -exdhe <encrypted file> <dh out> | Extracts Discrete Log / DH Parameters from an encrypted file. |
| -exdhc <contact> <dh out> | Extracts Discrete Log / DH Parameters from a contact file. |
| --deniable | Allows the sender of a file to deny authorship. Excludes signatures from the encrypted file. |
| --prompt <prompt> | Adds an OTR-Style symmetric authentication prompt to an encrypted file. You will be asked to provide the answer during the encryption process. |
| --prompt-hidden <prompt> | Same as above, but obfuscates the input you type in. |
| --add-message | Allows you to add a message to the encrypted payload. Input during the encryption process. |
| --add-message-hidden | Same as above, but obfuscates the input you type in. |
| --drop | Drops all prompts and messages. |
| --exportSigners <contact out> | Exports any signers (usually the sender) of a file as a contact. |
Creating a contact.
cryptotool -contact jdoe.contact
Sending a file anonymously.
cryptotool -to jdm.contact file.zip file.zip.enc
Sending a file from jdoe to jdm,
cryptotool -from jdoe.contact -to jdm.contact file.zip file.zip.enc
Setting the cipher to Kuznyechik and using Skein512_384 as the hash algorithm,
cryptotool -ciph 200 -hash 112 -from jdoe.contact -to jdm.contact file.zip file.zip.enc
Opening the encrypted file,
cryptotool -o file.zip.enc file.zip
Complex Command
cryptotool -c Me -from Me -ciph 212 -hash 12 --prompt "Where did we meet 4/2/2018?" -to jdm.contact file.zip file.zip.enc
This is the list of supported ciphers. To use these in DiscreteCrypt, use the parameter
-ciph <code #>
Prior to executing the command that uses it (like to).
| Cipher Name | Code |
|---|---|
| AES128 | 0 |
| AES192 | 1 |
| AES256 | 2 |
| Threefish256 | 100 |
| Threefish512 | 101 |
| Threefish1024 | 102 |
| Camellia128 | 110 |
| Camellia192 | 111 |
| Camellia256 | 112 |
| Serpent128 | 120 |
| Serpent192 | 121 |
| Serpent256 | 122 |
| Twofish128 | 130 |
| Twofish192 | 131 |
| Twofish256 | 132 |
| Mars128 | 140 |
| Mars160 | 141 |
| Mars192 | 142 |
| Mars224 | 143 |
| Mars256 | 144 |
| Mars384 | 145 |
| Mars448 | 146 |
| Cast6_128 | 150 |
| Cast6_160 | 151 |
| Cast6_192 | 152 |
| Cast6_224 | 153 |
| Cast6_256 | 154 |
| Kuznyechik | 200 |
| Aria128 | 210 |
| Aria192 | 211 |
| Aria256 | 212 |
| Speck128_128 | 220 |
| Speck128_192 | 221 |
| Speck128_256 | 222 |
| Simon128_128 | 230 |
| Simon128_192 | 231 |
| Simon128_256 | 232 |
| Kalyna128_128 | 240 |
| Kalyna128_256 | 241 |
| Kalyna256_256 | 242 |
| Kalyna256_512 | 243 |
| Kalyna512_512 | 244 |
| SM4 | 250 |
This is the list of supported hashes. To use these in DiscreteCrypt, use the parameter
-hash <code #>
Prior to executing the command that uses it (like to, sign, bundle, etc).
| Hash Name | Code |
|---|---|
| SHA256 | 0 |
| SHA384 | 1 |
| SHA512 | 2 |
| SHA3_224 | 10 |
| SHA3_256 | 11 |
| SHA3_384 | 12 |
| SHA3_512 | 13 |
| SHAKE128_224 | 20 |
| SHAKE128_256 | 21 |
| SHAKE128_384 | 22 |
| SHAKE128_512 | 23 |
| SHAKE128_1024 | 24 |
| SHAKE256_224 | 30 |
| SHAKE256_256 | 31 |
| SHAKE256_384 | 32 |
| SHAKE256_512 | 33 |
| SHAKE256_1024 | 34 |
| Skein256_224 | 100 |
| Skein256_256 | 101 |
| Skein256_384 | 102 |
| Skein256_512 | 103 |
| Skein256_1024 | 104 |
| Skein512_224 | 110 |
| Skein512_256 | 111 |
| Skein512_384 | 112 |
| Skein512_512 | 113 |
| Skein512_1024 | 114 |
| Skein1024_224 | 120 |
| Skein1024_256 | 121 |
| Skein1024_384 | 122 |
| Skein1024_512 | 123 |
| Skein1024_1024 | 124 |
| Whirlpool | 130 |
| Streebog256 | 200 |
| Streebog512 | 201 |
| Kupyna_224 | 210 |
| Kupyna_256 | 211 |
| Kupyna_384 | 212 |
| Kupyna_512 | 213 |
DiscreteCrypt has a configuration directory that will be used extensively in future iterations of the software. Currently it is being used to store contacts.
On Windows it is located at:
%appdata%\.discretecrypt
And on Unix
~/.discretecrypt
The tool will automatically grab imported contacts from the DiscreteCrypt directory when a matching contact file doesn’t exist in the current working directory.
Example Usage:
cryptotool -import jdm.contact
rm jdm.contact #
cryptotool -to jdm file file.enc # This will find the imported "jdm.contact" file.
It is okay to omit the “.contact” extension when referencing contact files. The tool will detect this and handle it appropriately.