Metadata-Version: 2.4
Name: not-enough-secrets
Version: 0.1.1
Summary: basic cli tool for file encryption
Author-email: SR <srichters@uni-muenster.de>
Maintainer-email: SR <srichters@uni-muenster.de>
License-Expression: MIT
Project-URL: Source, https://github.com/RichtersFinger/not-enough-secrets
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: End Users/Desktop
Classifier: Topic :: Security :: Cryptography
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Provides-Extra: cryptography
Requires-Dist: cryptography==48.0.1; extra == "cryptography"
Dynamic: license-file

# not-enough-secrets

A small command line tool for file encryption.
It keeps a simple job simple: pick a file, get an encrypted file back.

The tool is built around pluggable modules, so the actual crypto is swappable and versioned, while the interface stays the same.
If a software component is not installed, modules report themselves as unavailable instead of breaking.

## Quick example

```bash
# encrypt a file, result goes to stdout by default
not-enough-secrets encrypt secret.txt -o secret.txt.nes

# decrypt it again
not-enough-secrets decrypt secret.txt.nes -o secret.txt

# encrypt in place, with a backup safety net and print output to stdout
not-enough-secrets encrypt --stdout --in-place secret.txt
```

You get prompted for the key on stdin.

## Install

From the Python Package Index:
```bash
pip install not-enough-secrets
```
or install with extra `cryptography` (enabling, for example, AES-GCM)
```bash
pip install not-enough-secrets[cryptography]
```
Use the file `completions.bash` to set up autocomplete in `bash` shells.

From a Debian package:
Download a release package and enter
```bash
dpkg -i not-enough-secrets_<version>.deb
```

## Usage

The tool has four commands: `version`, `modules`, `encrypt` and `decrypt`.

List modules:

```bash
# only modules that are available on your system
not-enough-secrets modules
# also show modules you cannot use, but with their requirements
not-enough-secrets modules --all
```

Encrypt and decrypt share the same output options:

- default writes the result to stdout
- `-o, --output PATH` writes to a file, add `-f, --force` to overwrite an existing one
- `--in-place` replaces the input file, and only does so once the new content is safely written
- `--stdout` can be added alongside `-o` or `--in-place` to also print the result

Pick a module with `-m`.
The value is the module identifier, optionally followed by options after a colon (options are module specific):

```bash
not-enough-secrets encrypt notes.txt -m aes-gcm-0:128 -o notes.nes
```

Leave `-m` off and encrypt picks a sane default for your system.
Decrypt reads the module and its settings from the file header, so you normally only need to supply the key.
You can still pass `-m` on decrypt to force a specific module if you know what you are doing.

Add `-v` for info logging or `--debug` for debug logging and full tracebacks (logs to stderr).

### Modules

- `aes-gcm-0` AES-GCM with a PBKDF2-HMAC-SHA256 derived key. Optional key size of 128, 192 or 256 bits, default 256. Needs the `cryptography` package.
- `fernet-0` Fernet authenticated encryption with a PBKDF2-HMAC-SHA256 derived key. No options. Needs the `cryptography` package.
- `base64` Base64 obfuscation. This is not encryption and provides no security at all. It exists for tests and debugging, do not use it for real data.

Each module carries its own version in its identifier.
Older files keep working because the matching module version stays around to read them.

## Build

This project uses Docker to create reproducible builds.

Build the Python distributions with
```bash
make up
make build-wheel
make down
```

Build a DEB-file with
```bash
make build-deb
```

## Development

The `Makefile` defines some helpful targets for local development:
```bash
make up
make install
make test
make down
```
