Introduction

Help

Introducing FineCrypt

FineCrypt is a security software application that enables you to secure store your data on your computer using strong encryption.

Encrypt files and folder with one mouse click

Quick Encrypt feature lets you encrypt files and folders, create encrypted archives and add new files to an existing archive with just one mouse click. Quick Encrypt not only saves your time, but it automatically does for you almost all work with encryption keys. All you need is to specify directory where you store encryption keys. In fact, Quick Encrypt lets you not to care about passwords and encryption keys at all (except of providing physical safety for a media where encryption keys are stored).

Automatically execute security tasks

Task Manager utility makes it possible for you to entirely automate execution of security tasks. Task Manager is a powerful tool which enables you to perform with one mouse click various actions with unlimited number of files which can be located in any number of directories and drives. With Task Manager you can automatically encrypt and wipe your confidential files, update encrypted archives with newer file versions, perform cleaning of your hard drive, etc.

Create encrypted archives

You can encrypt several files either into single encrypted archive or into different encrypted files. With FineCrypt archives you can work in the same way as you work with zip archives: you can add to or remove files from archive , decrypt desired files, and modify file "in-place" not removing it from archive.

Create self-extracting executables

With FineCrypt you can create encrypted and non-encrypted self-extracting executable files. You can send such files to people who haven't FineCrypt on theirs computers and they will be able to decrypt this file.

Check for absolute correctness of encryption

FineCrypt is the ONLY encryption program that you can check yourself for absolute correctness of encryption: how to check FineCrypt.

Encrypt with encryption key or with password

You can provide for the encryption your own encryption key, which will be used for encryption without any further transformation. Most existing encryption products perform the encryption with a key generated from the user's passphrase. The user does not even see the key that is used for encryption of confidential information. FineCrypt makes it possible to perform encryption both with the passphrase and with the key specified by the user.

Full integration with Windows shell

You can encrypt files in three ways: by choosing Encrypt... from Windows context menu, which appears when you click right mouse button on file or folder; by dragging the file you want to encrypt onto FineCrypt's icon on the desktop; or from main FineCrypt window. You can decrypt files from the Windows Explorer simply by double clicking the left mouse button on the file you want to decrypt; or by dragging encrypted file onto FineCrypt's icon on the desktop.

Statistical analysis

Using the "File statistics" feature you can get the values of some statistic indicators related to the data stored in the file. For example, if you have used a program for file encryption and you cannot test it with the help of test vectors, then you can get an idea about the quality of encryption by analyzing the characteristics of the ciphertext produced by this program. In the main FineCrypt window select a file about which you want to get statistics and after that press Ctrl+Enter or choose menu item File statistics in menu Actions.

Secure deletion of files

Using the "Wipe" utility you can permanently delete the file content so it cannot be retrieved using disk recovery software. You can permanently delete files with the "Wipe" utility in two ways: from the Windows Explorer context menu, or from main FineCrypt window.

Key management

Developed by Crypto Systems advanced key management feature. One of the main requirements that has to be met for encryption is a frequent key change. The number of keys grows rapidly so that the user has to maintain a key database and keep count of what key is used for what file. In FineCrypt for the first time we have used technology developed and patented by Crypto Systems that makes it possible to assign a unique key ID to each key and to store this ID with the file. Thus without any compromise of security there is no need to maintain a separate key database. The keys should be kept in one location and FineCrypt will automatically find the required key before decryption.

10 encryption algorithms

You can choose for encrypting any of 10 encryption algorithms: AES, Blowfish, CAST-256, GOST, IDEA, MARS, RC-6, Serpent, Triple-DES and Twofish; also you can use any of four encryption modes: Electronic Codebook, Cipher Block Chaining, Cipher Feedback and Output Feedback.


Encrypt with passphrase

Encrypt with password

The encryption algorithm chosen by the user determines the maximum length of the encryption key that is used by FineCrypt for encryption. The encryption key may resemble a sequence of symbols that is hard to remember and sometimes even hard to enter from the keyboard. To perform a secure encryption, a key of maximum length must be used and it should include a variety of symbols. If you use encryption keys for encryption, then you should store you keys on the floppy disk, and insert this disk into the FDD every time you want to encrypt or decrypt files. In order to avoid this and to make encryption and decryption more convenient for user, encryption with the password is used. After you have entered the password, FineCrypt with the help of special secure method generates a key of maximum length for the current algorithm from the password and uses this key for encryption or decryption. (Though, it need to mention that encryption with password generally much less secure than encryption with encryption key unless you use such passwords as, for example: "wS&M7#-)@d+$=a2^*;'"9(]!z~Y[4/<?g".)

You can encrypt files with a password from the FineCrypt explorer as well as from the Windows Explorer, from desktop of your computer or from any application that supports drag-and-drop.

Selecting items for encryption from Windows Explorer or desktop.

In the Windows Explorer you can use two ways for encrypting files and folders with a password. Select one or more items you want to encrypt and do one of the following:

  • click with the right mouse button on selected files; from the FineCrypt submenu choose the menu item "Encrypt with password";
  • drag selected file onto FineCrypt icon on the desktop.
Selecting items for encryption from the FineCrypt explorer.

In the main FineCrypt window you can use several ways for encrypting files and folders with a password. Select one or more items you want to encrypt and do one of the following:

  • click with the right mouse button on selected files and choose from the context menu "Encrypt with password" menu item;
  • press F5 key;
  • click "Encrypt with password" ( [image] ) button on the toolbar;
  • select "Encrypt with password…" menu item from the "Actions" menu.

After you have selected the items for encryption, the "Encrypt" dialog box and "Enter passphrase" dialog box appear. Enter password and click OK. After that add or remove if necessary files or directories in the list and press the "Encrypt with password" ( [image] ) button.


Decrypt with passphrase

Decrypt with password

You can decrypt files with a password from the main FineCrypt window as well as from the Windows Explorer, from desktop of your computer or from any application that supports drag-and-drop.

To select files for decryption from the Windows Explorer or desktop do one of the following actions:

  • double-click with the left mouse button on the file you want to decrypt;
  • click with the left mouse button on the file you want to decrypt; from the FineCrypt submenu choose the option "Decrypt…";
  • drag selected file onto FineCrypt icon on the desktop.

To select files for decryption from FineCrypt explorer do one of the following actions:

  • double-click with the left mouse button on the file you want to decrypt;
  • click with the right mouse button on the file you want to decrypt; from the context menu choose menu item "Decrypt…";
  • press F8 key;
  • click the "Decrypt" ( [image] ) button on the toolbar;
  • select the menu item "Decrypt…" from the "Actions" menu.

After you have selected the file, the "Enter passphrase" dialog box will appear. Enter your password and click OK.


Basic concepts

In order to perform secure encryption with a password, the password must include a variety of random symbols and it must be as long as possible. For example, a secure password may look like this: s38.G\R^e@*h](k#. It is not easy to find a mnemonic rule for memorizing such a password. That is why users usually choose less complex passwords that are consequently not so secure. FineCrypt allows you to choose for encryption between a password that is easy to remember and the user's key that is more secure.

The necessity of storing encryption keys on the floppy disk is often considered as an inconvenience. But this necessity must be rather considered as an advantage. Because storing encryption keys on the floppy disk eliminates intrinsic drawbacks which encryption with password has:

Encryption with key | Encryption with password
1. Every file can be encrypted with its own key. One of the main rules of cryptography is that encryption key can be used for encryption only once. Several hundreds keys may be stored on one floppy disk; | 1. If user "stores" passwords in his memory, he scarcely would memorizing many passwords;
2. If user uses key management features, there is no need to track what file with what key has been encrypted. For decryption he only need to indicate directory where keys are stored and appropriate key will be found automatically; | 2. Even if user does not memorize his passwords, but writes them down on a paper, he also must track information about which password for encryption of which file has been used.
3. Encryption key can be entered for encryption or decryption with just two or three mouse clicks; | 3. For providing an acceptable level of security, passwords must be as long as possible and contain great variety of symbols (such as "a1H*&8%#?$<{~q`@-"|>S]w{=!^..."). Procedure of entering of such passwords often takes several minutes (taking into account possible faults and retyping).

And the main drawback of passwords is, of course, their vulnerability to various kinds of attacks. Passwords, in the difference from keys, typically contain less than 20% out of all possible byte values (symbols). And this fact greatly simplifies the task of breaking the encrypted data.

As a conclusion one can say that if you need the maximal level of security of your confidential information, then the only alternative for you is to use encryption with key.


What's this: initial vector

All the encryption algorithms used in FineCrypt are block ciphers. A block cipher is an encryption scheme which breaks up the plaintext data into strings (called blocks) of a fixed length and encrypt one block at a time. If blocks are being encrypted independently from each other (e.g. in the ECB mode), this can lead to some serious weaknesses in ciphertext (see: Encryption modes). In order to avoid these weaknesses, so called chaining modes (or feedback modes) such as CBC, CFB and OFB are used for encryption. In these modes encryption of every block is performed using previously encrypted block. In order to perform encryption of the very first block, there must be "seed", with which the entire process begins. Role of such a "seed" is played by the initial (or initialization) vector (IV).

Length of IV is equal to the size of block which is used in algorithm. E.g. for using with the Blowfish algorithm IV should contain 64 bits (8 bytes). Any arbitrary byte sequence can be used as IV. IV is not a secret information and should not necessarily be random. The only requirement of a highest security standard IV has to meet is to be used for encryption with the same key no more than once. For example, sometimes for encrypting the different messages consecutive numbers are used as IV: 00000001, 00000002, 00000003...

Always, when encryption in chaining modes takes place, IV necessarily must be saved for subsequent decryption. Without IV which was used for encryption it is impossible to decrypt data even if correct encryption key is provided. Thereby, IV can be considered as non-secret necessary part of an encryption key.

FineCrypt automatically generates IV when user presses the "Generate" button in the "Enter encryption key" dialog box. If user does not generate key, but enters it from the keyboard, he always should provide IV. If user does not provide IV, then IV filled with zeroes is used.

Though IV is not a secret information, and sometimes it is openly stored or transmitted with encrypted data, FineCrypt does not store IV openly in encrypted file, but stores it together with encryption key in a key file. When user saves encryption key, IV is automatically stored together with key in the same file. When FineCrypt reads the encryption key from a file, it also reads IV.


How to use the encryption keys?

After you have selected file(s) for encryption or decryption with the key, the "Enter encryption key" dialog box appears. In this dialog box you can see the following information:

  • Current cipher – encryption algorithm, which is currently used;

  • Current mode – encryption mode, which is currently used;

  • Blocksize – the size of block of the current algorithm, the length of initial vector is always equal to Blocksize;

  • Size of key – shows minimal and maximal key length in bytes and step of the key (length of encryption key must be a multiple of step value). The length of the key may vary from min. to the max. number of bytes allowed by the current algorithm;

  • Key size in bytes – spin control with which user can set desired length of the encryption key which will be used for encryption. Length will be automatically adjusted in accordance with the step value. For example, allowed lengths of the key for AES algorithm, which has step 8, include: 16, 24 and 32 bytes;

  • Hide key – check box with which user can hide or show key editor window. It is recommended to always keep key window hide unless key is being entered from keyboard;

  • "Encryption key" editor window – when encryption or decryption with the key takes place, FineCrypt uses as the key the bytes shown in the "Encryption key" editor window. This window is divided into two parts: the hexadecimal part and ASCII part. These two areas are arranged to view the same data in different ways. When you enter from keyboard or generate the encryption key, the bytes of the key are shown as hexadecimal values on the left side and as ASCII characters on the right side of the editor window.
    FineCrypt for encryption and decryption with the user's encryption key uses exactly the bytes that have been defined by the user in this window without any further transformation (in the difference from encryption with password, where user provided password is transformed in a rather complicated way into the encryption key). The user can provide the encryption key from a file, input it from the keyboard or generate it.

  • "Initial vector" editor window – editor window for entering the initial vector. Initial vector is the byte sequence, which is used in CBC, CFB and OFB encryption modes. When user generates the encryption key, initial vector is always being generated together with key. If user enters key from keyboard, he also must always provide the initial vector. Though initial vector is not a secret information, user can consider it as a part of encryption key, because for decryption of data in modes indicated above, user always must provide initial vector, which was used for encryption. When user saves encryption key in a file, initial vector automatically is being saved in the same file. (See also: What's this: initial vector.)

Providing the encryption key from a file

Any file of any size can be used as the encryption key. For example, if the AES algorithm is used for the encryption and the length of the key was set equal to 32 bytes, then when you read the key from the file, the first 32 bytes of the file will be shown in the "Encryption key" editor window, the next 16 bytes will be shown in the "Initial vector" editor window, and all the following bytes will be ignored. In general, this can be stated in the following way: if "K" is the key length, then you must provide "K + Blocksize" bytes of key information; "K" bytes for the encryption key plus number of bytes, which equal to the blocksize of current cipher for the initial vector. If the file size is less than K + Blocksize bytes, then the missing bytes in the encryption key and initial vector are padded with zeros. FineCrypt uses files with the "fck" extension to store the keys.

It is not recommended to use as encryption keys files, which are located on your computer. Even if your hard disk contains hundreds of thousands files, it's a matter of several minutes (or several tens minutes) to test all of them as encryption keys.

Also, it is not recommended to use as encryption keys files, whose content can be modified.

It is important to remember that if the length of the encryption key is less than the upper-range value, then it is necessary before decryption to set the length of the key that has been used for encryption. For example, if you encrypted the file with AES algorithm and 16 byte key, the for decryption you must set length of key to 16 bytes. Otherwise key will be read incorrectly. In order to avoid this and to provide a higher level of security encryption with the key of maximum length is recommended.

Entering the encryption key from the keyboard.

You can use both hexadecimal and ASCII areas to enter the key from the keyboard.

When entering values in the hexadecimal area you can use only hexadecimal digits: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F. Each byte in a hexadecimal area must be equal to the number from 00 to FF.

ASCII symbols representing hexadecimal values are shown to the right of the hexadecimal area. For example, the hexadecimal value 41 is equal to the letter "A" in the English alphabet. Some values do not have an ASCII equivalent, i.e. there is no symbol that represents them on the screen. Such values are shown in the ASCII area as dots. (But remember that "dot" itself has its own hexadecimal value 2E and "space" has the hexadecimal value 20).

Generating the encryption key

All the bytes of the key must be random or equiprobable – this is one of the main requirements that encryption key has to meet. For example, if the user uses in key only alpha-numeric values of bytes then these values are not equiprobable with the other values of bytes, because the user uses only 26 lower-case English letters, 26 upper-case English letters and 10 numeric values out of 256 possible values for the byte in the key. In other words, only 62 values out of 256 possible values are used in the key. Therefore, the number of possible keys decreases significantly and the task of cryptanalysis of the ciphertext encrypted with such a key becomes easier.

With FineCrypt you can generate highly random keys. 17 different random values such as current cursor position or current process ID are retrieved from your computer during the key generating. The values are hashed by the hash function SHA-1. Each subsequent value is added to the output of the hash function and the result is hashed again. This cycle is repeated 1000 times. Some added values are changing even during the cycle, for example, the number of milliseconds that elapsed since the Windows has started. (See Technical notes for more details.)

As a result, FineCrypt receives a highly random sequence of bytes and the encryption key and initial vector are formed from this sequence.

Press the "Generate" button in the "Enter encryption key" dialog box to generate new encryption key and initial vector.

Note: We recommend that you always save the encryption key immediately after generating. If the user generated the key and encrypted a file with this key without saving the key, then it is impossible to restore the key and to decrypt the file.


Passphrase and encryption key: what is more secure?

Passphrases are notoriously vulnerable to attacks. (See Alfred J. Menezes, Paul C. Van Oorschot and Scott A. Vanstone. Handbook of Applied Cryptography, CRC Press, 1996; Bruce Schneier. Applied Cryptography: Protocols, Algorithms and Source Code in C. John Wiley and Sons, Inc., second edition, 1996) Users often have weak passphrases because strong passphrases are long and hard to remember.

Furthermore, passphrase protection weakens with the passage of time and improvements in computer performance: attackers can rely on faster and faster computers for guessing passphrases, while user memory does not seem to expand, and passphrases do not seem to get longer. This is why if you need secure encryption of your data but do not want to remember such a daunting passphrases as s38.G\R^e@*h](k#, then the most reliable way for you is to use the user's encryption key. In this case you have to pay for security because you need to keep the encryption keys on the floppy disk and insert the floppy disk into the FDD every time you want to decrypt the data.

If you encrypt many files then it is much easier to choose between the passphrase and the user's encryption key. If you encrypt many files during a certain period of time using the same passphrase, then there is a serious risk of unsafe storage of your information. The highest security standards require encryption of no more than one message with one key. In real life this requirement is usually ignored. If the key change does not take place after in a certain time, then the task of breaking the encrypted information is greatly simplified.

Imagine that you do not use the key that has to be stored on a diskette for encryption but encrypt the data with the help of the passphrase that you keep in your memory. Let's imagine also that you want to follow the safety requirements and to change the passphrase periodically. If you use alpha-numeric passphrases that guarantee a minimum level of security, such as dW3f9YN5, then even if you were able to keep a number of passphrases in your memory, you would scarcely want to remember what file is encrypted with a certain passphrase. Sooner or later you will need to store your passphrases somewhere.

There are different ways of solving this problem.

One solution is to store all the data on encrypted virtual drives. In this case special programs create one big encrypted file and the files the user wants to encrypt are kept in this big file. The user works with this file in the same way he works with a regular logical drive. But if we remember one of the important rules of safe data storage – do not use the same key for the encryption two times - then we can say that an encrypted logical drive is the least secure method for safe data storage. In this case the same key is used not two or three or even ten times, but all your files on this virtual drive are encrypted with qthe same key. And the cryptanalyst gets the amount of information needed to simplify the cryptanalysis.

For instance, the cryptanalyst may suppose that some files stored on this drive contain some identical fragments. For example, the name of the organization in the header and the cryptanalyst knows this name. The cryptanalyst can analyze the virtual drive, find several fragments with the same structure or content and make some suggestions about the corresponding plaintext. If his suggestions are correct then he will get a ciphertext fragment with a corresponding plaintext fragment. This means that there is a serious risk of unauthorized access to the virtual drive and to all the files on it.

The other safer but less convenient way is to store all the passphrases in one encrypted text file on the hard drive and to decrypt and encrypt this file to get the passphrase. In this case you have to remember only one so-called master-passphrase for this file. But here, in addition to the need to edit, decrypt and encrypt this database (considering security, the data in this very important file must be stay in decrypted state for as little time as possible), you will need to perform disk free space cleaning every time after working with this file. You will need to do this because when working with the passphrase database Windows may copy the data from this file into its swap file; also, many editors create temp files and delete them at the end of the work session. In both cases the data can be easily restored with the help of disk editor.

So we can see that if you use many passwords it is better to store them not on the disk together with encrypted files but in a special separately guarded place. The same way as you do not put your house keys or your safe keys under the rug near your door but keep them with you or store them in a safe place.

So if we find it necessary to store a password on some media instead of remembering it by ourselves, then why do we need the passwords that we chose at the beginning in order to make the memorization easier? Considering security, the more logical way is to use the more secure user's encryption keys for encryption and store them.


Storing the encryption keys

Safe storage of encryption keys is one of the most important things for providing safe conditions of data storage. It seems useless to encrypt key with another key and store it on the hard disk, because we will eventually need to store somewhere the last key. The securest way of key storage is to insure the physical safety of the encryption keys.

The most convenient way is to store files with encryption keys on the floppy disks. Depending on the size of keys one floppy disk can contain up to 2000 keys. Remember, that floppy disk is a rather fragile media, and it is good idea to always have a backup copy of the keys.

You should always remember that in case your safe key is lost you can call a locksmith with a gas-cutting device and he will open the safe at your request. But if the encryption key is lost then you will not restore data encrypted with it even using the power of all the computers in the world.


Encrypt with key

You can encrypt files and folders with encryption key in two ways: from the Windows Explorer context menu, or from the FineCrypt explorer.

Selecting items for encryption from Windows Explorer.

Select one or more items you want to encrypt and click with the right mouse button on them. From the FineCrypt submenu of the context menu choose menu item "Encrypt with key…".

Selecting items for encryption from the main FineCrypt window.

In the main FineCrypt window there are several ways of encrypting files and folders with key. Select one or more items you want to encrypt and do one of the following actions"

  • click with the right mouse button on selected files; from the context menu choose menu item "Encrypt with key…";
  • select the menu item "Encrypt with key…" from the "File" menu;
  • press F7 key;
  • click "Encrypt with key" ( [image] ) button on the toolbar.

After you have selected the items for encryption, the "Encrypt" dialog box and "Enter encryption key" dialog box appears. Enter from the keyboard, read from the file or generate encryption key and click OK. After that add or remove if necessary files or directories in the list and press the "Encrypt" ( [image] ) button. To learn more about the "Enter encryption key" dialog box and how to use the encryption keys see How to use the encryption keys?


Decrypt with key

You can decrypt a file with key in two ways: from the Windows Explorer context menu, or from the main FineCrypt window.

To select a file for decryption from the Windows Explorer do one of the following actions:

  • double-click with the left mouse button on the file you want to decrypt.
  • select the one or more files you want to decrypt and click with the right mouse button. From the FineCrypt submenu choose menu item "Decrypt…".
  • drag selected file onto FineCrypt icon on the desktop.

To select a file for decryption from FineCrypt explorer do one of the following actions:

  • click with the right mouse button. From the context menu choose menu item "Decrypt…";
  • select menu item "Decrypt…" from the "Actions" menu;
  • double click with the left mouse button on the file you want to decrypt;
  • press F8 key;
  • click the "Decrypt" ( [image] ) button on the toolbar.

After you have selected a file, the "Enter encryption key" dialog box appears. After you have entered the key and initial vector press OK to decrypt the file. To learn more about the "Enter encryption key" dialog box and how to use the encryption keys see How to use the encryption keys?


Adding or removing files

When you are in the "Encrypt" dialog box you can add files to the file list for encrypting, or remove files from the list. You can add to the list both individual files and whole directories.

To add individual files to the list:

Press "Add files" ( [image] ) button. After that navigate inside "Add files" dialog box into the desired directory and select files you want to add. Then press "Open" button in the "Add files" dialog box.

To add folders to the list:

Press "Add folders" ( [image] ) button. After that choose in the "Select folder" dialog box desired folder and press "OK".

To remove files from the list:

  1. Select the files you want to remove. You can do this in three ways:

    • press and hold left mouse button and drag mouse over files;
    • select the first file in the list among those you want to remove, press and hold "Shift" key and select the last file;
    • press and hold "Ctrl" key and select different files.
  2. Press "Delete" ( [image] ) button. If you want to remove all the files from the list, press "Clear list" ( [image] ) button.


Applying file filters

It is often needed to encrypt only files of certain types (e.g. only text files). In that case it is convenient to use the file type filters. Using file type filters you can quickly select for encryption files only of those types that you need.

You can use the file type filters from inside the "Encrypt" dialog box. Once you have added files to the list, you can apply file type filter on them. To do this you first need to define your file type filter.

To define file type filter:
  1. Click "Define filter" ( [image] ) button in the "Encrypt" dialog box.
  2. Enter as new filter desired file extensions or modify existing filter. File extension is the part of file name which is located after the dot (or after the last dot if file name has several dots). For example, files with names "file.txt" and "file1.exe" have the extensions "txt" and "exe" accordingly. Text files usually have extensions: "txt", "doc", "wri", "rtf"; picture files have extensions such as "jpg", "bmp", "gif" and so on. Windows explorer by default does not show the file extensions for the registered file types (e.g. explorer does not show "txt" or "doc" extensions). To see the file extensions either you should enable Windows explorer to show the extensions for all file types, or you can see extensions in the FineCrypt explorer. To see file extensions in the Windows explorer start Windows explorer, select menu item "Folder options" in the "View" menu, go to the page "View" and uncheck option "Hide file extensions for known file types". Another way to see file extension in Windows explorer is to click right mouse button on the file and select in the context menu item "Properties", file extension will be displayed in the string "MS-DOS name".

You can enter as file type filter either extensions of those file types which you want to remove from the list, or extensions of those file types which you want leave in the list.

After you you have defined filter, you can apply it.

To apply file type filter:
  1. Select in the "Filter" combo box desired filter.
  2. If you want to remove files with extensions defined in the filter from the list, press "Apply exclude filter" ( [image] ) button. If you want to leave files with extensions defined in the filter in the list, press "Apply include filter" ( [image] ) button.


Other operations

From inside "Encrypt" dialog box you can change the current encryption settings and set passphrase or encryption key.

To change the current encryption settings press the "Preferences" ( encpref.bmp (1134 bytes) ) button. In case you are encrypting files with encryption key, then if you change in the current settings encryption algorithm or encryption mode, you will be prompted to enter encryption key again.

To set or change passphrase or encryption key press "Set key" ( [image] ) button.


Overview of Quick Encrypt feature

Overview of Quick Encrypt

Quick Encrypt feature lets you encrypt files and folders with key or password, create encrypted archives and add new files to an existing archive with just one mouse click. You can save much of your time by using this feature.

Quick Encrypt not only saves your time, but if you are using encryption with key it automatically does for you almost all work with encryption keys. All you need is to specify directory where you store encryption keys. In fact, Quick Encrypt lets you not to care about passwords and encryption keys at all (except of providing physical safety for a media where encryption keys are stored).


How to use Quick Encrypt

You can use Quick Encrypt from both the Windows Explorer and desktop. Using of Quick Encrypt is straightforward: select files or folders you want to encrypt, click right mouse button and select in the submenu "Quick encrypt to" destination where you want to place encrypted files. You can either create new encrypted file, for this you select desired folder as a destination, or you can add files to an existing encrypted archive, for this you select desired FineCrypt archive as a destination.

You also can select destination named as "Current folder", in this case encrypted files will be placed into the same directory where original files are residing.

When you are selecting folder as a destination, FineCrypt automatically generates new encryption keys, encrypts selected files with these keys, and saves these keys in the special folder that you have specified as a place for storing encryption keys.

When you selecting existing encrypted archive as destination, FineCrypt automatically scans folder where encryption keys are stored for an appropriate encryption key. If key is found, then FineCrypt encrypts selected files with this encryption key and adds them to the destination archive.

Encryption during quick encryption is performed in a background. That is you do not see any dialog boxes or progress indicators and there is no need for you to wait till encryption process will be finished for continuing your work. But you still have control over FineCrypt during quick encryption and you can stop encryption process at your desire: just after you start quick encryption, the FineCrypt icon is placed on the taskbar:

If you click on this icon with the right mouse button, popup menu will appear that contains one menu item: "Break current operation". If you click on this menu item, current operation will be canceled. As soon as encryption is finished, FineCrypt icon will disappear from the taskbar.

For more details see:

Defining destinations for Quick Encrypt.

Quick Encrypt preferences.

Quickly encrypt to: archive.

Quickly encrypt to: folder.

Using Quick Encrypt with session keys


Defining destinations for Quick Encrypt

For using Quick Encrypt you first should to specify destinations places. Destination place is a place into which encrypted files will be automatically placed when you use Quick Encrypt. You can define as destinations places both folders and FineCrypt encrypted archives. You can set up to 20 different destinations. Also you should specify folder in which encryption keys will be stored.

To define folder for encryption keys:
  1. Open "Peferences" dialog box. How to do this see: "Setting preferences". In the "Preferences" dialog box go to the "Quick Encrypt" page.
  2. On the "Quick Encrypt" page in the edit control "Encryption keys folder:" specify directory where encryption keys will be stored and from where they will be read. The best and securest location for this directory is a floppy disk (e.g. "A:\"). But you can choose any desired directory.
  3. Press OK.
To define destination:
  1. Open "Peferences" dialog box. How to do this see: "Setting preferences". In the "Preferences" dialog box go to the "Quick Encrypt" page.
  2. On the "Quick Encrypt" page press "Destinations..." button.
  3. In the "Destinations" dialog box add or remove any destinations you want. You can define up to 20 different destinations.
  • To define folder as destination:

Press "Add folder" button. In the "Select folder" dialog box select desired directory and press OK.

  • To define FineCrypt archive as destination:

Press "Add archive" button. In the "Select archive" dialog box go to the directory where archive you want to select locates, select desired archive and press OK.

  • To remove destination from the list:

Select destination you want to remove and press "Remove" button.

4. After you have defined desired destinations press OK.

See also:

Quick Encrypt preferences.


Quick Encrypt preferences

On the "Quick Encrypt" page in the "Preferences" dialog box you can choose several options which will be used when you perform quick encryption. These options relate to naming of encryption keys and how to use encryption keys.

Naming of encryption keys.

When you use Quick Encrypt, encryption keys for new encrypted files are generated and saved automatically. You can choose the way by which FineCrypt will name new files with encryption keys. These ways are:

  • "Use name of original file" - In this case the name of original file will be used for creating name of key file.
    This method has one advantage: you can easily see what file with what key was encrypted. Though there is no necessity in this, because you can automatically find key file by pressing "Find" button in the "Enter encryption key" dialog box. This method also has one disadvantage: if original files have long names, then key files will consume more space on the disk (this is important if you store key files on the floppy disk).
  • "Use current time" - In this case key files are named with random names which are created with using current date and time. All file names have 8-character length .
Encrypt every file with new encryption key

This option takes effect only when you use Quick Encrypt for encrypting multiple original files into individual encrypted files (i.e. when option "Create archive" is unchecked; see Encryption preferences). If you check this option, then every file will be encrypted with its own unique encryption key. That is if you encrypting 10 files, then 10 different encryption keys will be created and 10 encryption key files will be saved in the encryption key folder. Use this option if you need an encryption of an ultimate security level. If this option is unchecked, then when you encrypting multiple files only one encryption key will be created. That is if you encrypting 10 files, all of them will be encrypted with same encryption key.

Using session key/password

If you check this option, FineCrypt for quick encryption will not generates new encryption key, but will use for encryption predefined session key or password. For more details see: Using Quick Encrypt with session keys.

See also:

Defining destinations for Quick Encrypt.


Quickly encrypt to: archive

Using Quick Encrypt you can with one mouse click add files to an existing FineCrypt archive. You can specify as a Quick Encrypt destination any archive that have been encrypted with an encryption key (not with a password) and has a key ID (see: what is key ID). Archive has a key ID if you created it using an encryption key that has been generated by pressing "Generate" button in the "Enter encryption key" dialog box.

To create new archive that can serve as a destination for Quick Encrypt:
  1. Make sure that option "Create archive" in the encryption preferences is checked (see: Encryption preferences).
  2. Select one or more files you want to encrypt, press the right mouse button, from the FineCrypt submenu of the context menu choose menu item "Encrypt with key…".
  3. In the "Enter encryption key" dialog box press "Generate" button. After that press "Save" button and save encryption key in the directory that you want to use for storing encryption keys (floppy disk is the securest location for encryption keys). After you have saved encryption key, press OK.
  4. Specify in the "Output file name" combo box the name of new archive. This new file should reside in an existing folder. After that press "Encrypt" ( encrypt.GIF (127 bytes) ) button.
To add an existing archive to the Quick Encrypt destinations:
  1. Open "Preferences" dialog box. How to do this see: "Setting preferences". In the "Preferences" dialog box go to the "Quick Encrypt" page.
  2. Make sure that directory specified in the edit control "Encryption keys folder" is the directory where archive's encryption key is stored and press "Destinations..." button.
  3. In the "Destinations" dialog box press "Add archive" button. In the "Select archive" dialog box go to the directory where archive you want to select locates, select desired archive and press OK.


Quickly encrypt to: folder

Using Quick Encrypt you can with one mouse click encrypt files and folders and automatically place them in the desired folder. How to define folder as Quick Encrypt destination see: "Defining destinations...".

You can use a predefined folder destination named as "Current folder", in this case encrypted files will be placed into the same directory where original files reside.

How files and folders will be encrypted when you using Quick Encrypt depends on whether the option "Create archive" in the "Encryption settings" is set (see: Encryption settings).

If option "Create archive" is set:

  • If you have selected a single file or folder for quick encryption, they will be encrypted into a single FineCrypt archive. Archive name will be the same as the name of the original file or folder. E.g. if you encrypting file "document.txt" then encrypted file will be "document.fca"; if you encrypting folder "Work" then encrypted file will be "work.fca".

  • If you have selected multiple files or folders for quick encryption, they will be encrypted into a single FineCrypt archive. Just after you select destination folder in the Quick Encrypt submenu, "Save file" dialog box will appears. Enter the name for the new archive and press OK to start encryption.

If option "Create archive" is not set:

  • Independently of whether you have selected a single file or folder, or multiple files or folders, all files, including files inside folders, will be encrypted into the individual files. E.g. if you encrypting folder that contains 10 files, you will get in the destination folder 10 encrypted files.


Using Quick Encrypt with session keys

You can quickly encrypt files using session keys and passwords. In this case FineCrypt does not automatically generates new encryption key, but uses for encryption existing session key or password.

To use session key or password for quick encryption, you first should define session key or password. How to do this see: Defining session key. After that open "Preferences" dialog box and check on the "Quick Encrypt" page "Use session key/password" option .

If option "Use session key/password" is checked, but you have not defined current session key or password, then Quick Encryption is performed as usually, with newly generated encryption key.

Note: session key or password is used for Quick Encryption only when you are selecting folder as a destination for encrypted files. If you are selecting existing archive as a destination, session key or password is not used, but FineCrypt is searching encryption key for that archive in encryption keys folder.


Overview of session keys

You can greatly simplify and speed up the process of encryption of files using session keys (or session passwords). You can define key or password which will reside in the computer memory during a certain period of time, and this key or password will being automatically used for encryption. You can define a time during which session key or password will be valid, and you can at any time securely wipe off session key or password from the memory.

Using session keys is slightly less secure than to enter key or password anew every time you need to encrypt a file. The only security flaw in using session keys is that if your computer will be suddenly cut off from the current and turned off when the session key resides in the memory, there is a risk that the session key will not be securely wiped off from the memory, and its traces will remain on your hard disk.


Defining session key

To define session key or password:
  1. Open "Preferences" dialog box. How to do this see: "Setting preferences". In the "Preferences" dialog box go to the "Session" page.
  2. On the "Session" page select the option you want to use: "Use session password" or "Use session key".
  3. Enter password or key you want to use as a session password or key. You can enter new encryption key from the keyboard, generate new key or read existing key from the file. To change session key, press button "Set session key/password".
  4. If you want session key to be automatically deleted from the memory in a certain time, select in "Auto delete" option using up and down arrows desired number of minutes. If you want session key will be valid an indefinite time, set number of minutes to zero. In this case you will have to delete session key from the memory explicitly.
  5. 5. Press OK.

After you have pressed OK, on the taskbar the icon of Session Key Manager will appears: .

You can at any time define new session key or modify the existing one. To do this click with right mouse button on the Session Key Manager icon on the taskbar and select "Set session key/password".


Encrypting with session key

You can use session key or password as for conventional encryption (when you select "Encrypt with password" or "Encrypt with key") as for quick encryption (when you select "Quickly encrypt to...").

Using session key or password for conventional encryption:

The process of encrypting of files with the session key is just the same as when you encrypting files without session key. The only difference is that when you select for encrypting files or folders, session key or password is already entered in dialog box which appears for entering key or password. You can leave session key or password unchanged and use it for encryption, or you can enter new key or password.

Note: if you have defined session password, it will be used only when you encrypt with password; if you have defined session key, it will be used only when you encrypt with key.

Using session key or password for quick encryption:

To use session key or password for quick encryption check in the "Preferences" dialog box on the page "Quick Encrypt" option "Use session key/password". In this case all files you encrypt by selecting "Quickly encrypt to..." will be encrypted with session key or password you have defined.

If option "Use session key/password" is checked but there is no session key or password in the computer memory, encryption is performed as it is performed without using session key.


Clearing session key

You can at any time wipe off session key or password from the computer memory. To do this click with right mouse button on the Session Key Manager icon on the taskbar and select "Clear and Exit". Memory where session key is residing will be 10 times overwritten with ones, zeroes and random values, and after that Session Key Manager will be stopped. The same procedure is being done for automatic deleting session key.


Overview of archives

You can encrypt files in two ways: either you can encrypt every original file into a corresponding individual encrypted file, in this case you get as many encrypted files, as the original ones; or you can encrypt files into a single encrypted archive. FineCrypt encrypted archive is a file containing one or more encrypted files. Once you have created an archive you can open it with the ArcViewer and perform various operations on it, such as adding to or deleting files from archive, decrypting all or chosen files from archive, you can open files right inside archive and edit them "in-place", in this case the file in archive will be updated with the changes.

FineCrypt archives have the file name extension "fca" and the icon:


ArcViewer Window

To open an archive click twice with the left mouse button on it or click right mouse button and choose menu item "Decrypt" from the FineCrypt submenu. After that you will be prompted to enter password or key. Once you have provided valid password or key, archive will be opened and its contents will be displayed in the ArcViewer window.


Creating archives

Creating archive

You can encrypt files into an archive using both password and encryption key. To create an archive you have first select files you want to add to an archive. How to select files for encrypting read here: "Encrypt with password" or "Encrypt with key".

Files automatically will be encrypted into an archive if option "Create archive" has been selected in the "Preferences". To set this option press "Preferences" ( encpref.bmp (1134 bytes) ) button in the "Encrypt" dialog box, go to the "Encryption" page and check the option "Create archive".

After you have selected files for adding to an archive, specify in the "Output file name" combo box the name of new archive file. This new file should resides in an existing folder. After that press "Encrypt" ( encrypt.GIF (127 bytes) ) button.


Adding files to archive

After you have opened an archive you can add files to it. You can add to an archive both individual files and whole directories.

To add individual files to an archive:

Press "Add files" ( arcaddfile.bmp (918 bytes) ) button. After that navigate inside "Add files" dialog box into the desired directory and select files you want to add to an archive. Then press "Open" button in "Add files" dialog box.

To add folders to an archive:

Press "Add folders" ( arcaddfold.bmp (1062 bytes) ) button. After that choose in the "Select folder" dialog box desired folder and press "OK".


Decrypting files from archive

After you have opened an archive you can decrypt files which are contained in it. You can either decrypt all the files in archive or only those files you have selected.

To decrypt all files in an archive:

  1. In the "Output folder" combo box specify output folder into which files from an archive must be decrypted. The folder should exists on your computer.

  2. Press "Decrypt all" ( arcdecall.bmp (1134 bytes) ) button.
To decrypt selected files:
  1. In the "Output folder" combo box specify output folder into which files from an archive will be decrypted. The folder should exists on your computer.
  2. Select the files you want to decrypt. You can do this in a three ways:
    • press and hold left mouse button and drag mouse over files;
    • select the first file in the list among those you want to decrypt, press and hold "Shift" key and select the last file;
    • press and hold "Ctrl" key and select different files.
  3. Press "Decrypt selected files" ( arcdecselect.bmp (918 bytes) ) button. If you want to remove files from an archive after decrypting them, then in this case press "Decrypt and remove selected files" ( arcdecrem.bmp (918 bytes) ) button.


Removing files from archive

After you have opened an archive you can remove files which are contained in it. You can remove them either after decrypting or without decrypting.

To remove files from an archive:

  1. Select the files you want to remove. You can do this in a three ways:

    • press and hold left mouse button and drag mouse over files;
    • select the first file in the list among those you want to remove, press and hold "Shift" key and select the last file;
    • press and hold "Ctrl" key and select different files.

  2. Press "Delete" ( [image] ) button. If you want to first decrypt files before removing, press "Decrypt and remove selected files" ( arcdecrem.bmp (918 bytes) ) button.


Opening files in archive

You can open and edit files right inside encrypted archive.

To open file in an archive:

Select file you want to open and either double-click on it with left mouse button or press "Open" ( [image] ) button.

File will be opened with the program that associated by default with the file type which the file that is being opened has. If file does not have any associated program, then you will be prompted to select the program from the list. You can perform with the opened file all the operations you can do with the regular file of that type. If you have modified the file, then when you return in the "ArcViewer" window you will be asked if you want to update file in the archive. Click "Yes" if you want to update the file.

When work with archive is finished, after closing "ArcViewer" you will be prompted to wipe temporary file(s), which have been created for working with opened files. These files may be (and should be) safely wiped.


Overview of self-extracting archives

Encrypted self-extracting (ESE) archive is an executable program file (.EXE file) that includes compressed and encrypted files and software to decrypt or "extract" the encrypted files. Users can run (execute) an ESE-archive just as they run any other program. The main merit of ESE-archives is that for decrypting an ESE-archive users do not need any additional software (except of Windows) on their computers, including FineCrypt. Therefore, you can send such ESE-archives via Internet to users who have not FineCrypt on their computers and they still will be able to decrypt contents of this archive. All they need to do for decrypting an ESE-archive is to double click on it and enter a correct password.

ESE-archive consists of two parts: encrypted archive and piece of executable code that decrypts and decompress files in an archive. The size of encrypted archive is usually equal or slightly less than the size of a corresponding unencrypted zip-archive. The size of executable code that is added to encrypted archive is about 36 Kb.

FineCrypt self-extracting archives have the file extension "exe" and the default icon: . You can provide instead of default icon any icon you wish.


Creating self-extracting archives

You can create both encrypted and unencrypted self-extracting archives. You can create encrypted self-extracting archives only using encryption with password (not with key). Contents of ESE-archive is automatically encrypted with the CAST-128 algorithm. To create an ESE-archive you have first select files you want to add to an ESE-archive. You can select files in several ways:

Selecting items for adding to an ESE-archive from within Windows Explorer.

Select one or more files or folders you want to add and click with the right mouse button on them. From the FineCrypt submenu choose the option the Add to FineCrypt Extractor... menu item.

Selecting items for adding to ESE-archive from within the FineCrypt explorer.

In the FineCrypt explorer you can use several ways for adding files and folders to an ESE-archive. Select one or more items you want to add and do one of the following:

  • press F9 key.
  • click the "Add to self-extractor" ( [image] ) button on the toolbar.
  • select the "FineCrypt Extractor" menu item from the "Actions" menu.

After you have selected the items for encryption, the "FineCrypt Extractor" dialog box appears. Add or remove if necessary files or directories in the list. How to do this read here: "Adding and removing files in "Encrypt" dialog box". How to apply file filters read here: "Applying file filters."

After you have selected files for adding to an ESE-archive, specify in the "Output file name" combo box the name of new archive file. This new file should be located in an existing folder. After that press "Add" button.

By pressing the "Settings" button in the "FineCrypt Extractor" dialog box, you can set several options related to creation of ESE-archives:

  • "Custom icon" - check this option if you want to provide your own icon for self-extracting archive. After checking this option enter in the editor window "Icon file" full path name of the file which contains icon.
  • "Encrypt archive" - uncheck this option if you want to create unencrypted self-extracting archive. Files in the unencrypted SE-archive are not encrypted and can be extracted without a password, just by clicking on the SE-archive.
  • "Include subdirectories when adding directory" - when you adding a directory to a list, all files that are contained in the all subdirectories are added to the list by default. If this option unchecked, then when you adding a directory to a list, files from subdirectories will not be included to a list.
  • "Default add folder" - here you can set the directory that will automatically appears in the "Add to archive" combo box in the "FineCrypt Extractor" dialog box. If you do not specify default folder, then the current folder will be used.


Decrypting self-extracting archives

To decrypt all files from a ESE-archive from the Windows Explorer or desktop:

  1. Either double click on ESE-archive with left mouse button, or select ESE-archive and press "Enter".

  2. In the "Extractor" dialog box in the field "Extract into folder" specify directory into which files from an ESE-archive will be decrypted. Directory should exists on your computer.

  3. Press "Extract" button.


Wipe

When you delete your sensitive files from a disk on your computer, the Windows does not erase these files' contents from the disk - it only deletes 'references' to these files from some system tables. Contents of the deleted file (or file body) continue to be stored on the disk and can be easily restored using any disk tool utility.

With "Wipe" utility you can permanently delete the file content so it cannot be retrieved using disk recovery software.

You can permanently delete files with the "Wipe" utility in two ways: from the Windows Explorer File menu, or from FineCrypt explorer.

Selecting files to wipe from Windows Explorer.

Select one or more files you want to wipe and click the right mouse button. From the FineCrypt submenu choose menu item "Wipe".

Selecting files to wipe from FineCrypt explorer.

To select files for wiping from FineCrypt explorer do one of the following actions:

  • click the right mouse button. From the context menu choose "Wipe" menu item.
  • click the "Wipe" ( [image] ) button on the toolbar.
  • select the "Wipe" menu item from the "Actions" menu.

FineCrypt deletes the files by overwriting them with the help of the procedure recommended by Department of Defense: first all the data in the file is overwritten by all ones then it is overwritten by all zeros and finally it is overwritten by a stream of random values. This procedure is repeated as many times as defined in the user Preferences.


How to test the reliability of FineCrypt?

How to test the reliability of FineCrypt's encryption?

How can you know that program with which you are protecting your confidential information performs the encryption with the declared algorithm and with the declared length of key? It is worth to mention, that published source code of the program is NOT the guarantee of the correct encryption unless you built source files and got executables by yourself (otherwise, you cannot be sure that program works exactly as you see in the published source code) .

You can check the correctness of encryption by the most simple and most reliable method which has specially been designed for such checking: by comparing the original text (so called "plaintext") and the resulting ciphertext, which is being produced by the program from the plaintext, with some examples that are offered by the developers of algorithms (these examples are called "test vectors").

Such test vectors are widely published and you can find them in the Internet on the web sites of authors of algorithms . For example, you can find test vectors for the Blowfish algorithm on the site of Counterpane Systems company (Bruce Schneier, the author of the Blowfish algorithm, is the president of this company): http://www.counterpane.com/vectors.txt. In order to perform such a test you will need any hexadecimal file editor (no special experience or knowledge is needed for this). You can download a free copy of a simple hexadecimal editor "HighLight" here.

Example of checking FineCrypt.

Let’s test the encryption with the AES algorithm in the Electronic Codebook mode. We use the HighLight editor in this example but you may use any other hexadecimal editor.

At the site of the National Institute of Standards and Technology (NIST) there are test vectors for the AES algorithm. You can download them in a single zip file from the address: http://csrc.nist.gov/ encryption/aes/rijndael/rijndael-vals.zip Here is one of these test vectors from the file "ecb_tbl.txt" (all values are hexadecimal):

Plaintext:  83 4E AD FC CA C7 E1 B3 06 64 B1 AB A4 48 15 AB

Key:        00 01 02 03 05 06 07 08 0A 0B 0C 0D 0F 10 11 12
            14 15 16 17 19 1A 1B 1C 1E 1F 20 21 23 24 25 26

Ciphertext: 19 46 DA BF 6A 03 A2 A2 C3 D0 B0 50 80 AE D6 FC

1. Create a new file in a hexadecimal editor. In order to do this select "File/New/New Binary File" menu item in the HighLight. After you have created new file make sure that there is a blinking cursor in the top left corner of the editor window and then enter the plaintext exactly as shown in the test vector:

2. Select the "File/Save" menu item, choose a directory where you want to save the file and save the file as "aesp". Then select the "File/Close" menu item. Our plaintext is created.

3. Start FineCrypt and select the "Tools/Settings" menu item. On the "Algorithms" page set "AES" as the encryption algorithm and "Electronic Codebook" as the encryption mode.

On the "General" page set the compression option as "Don’t compress.".

4. In the FineCrypt window go to the directory where you have saved the file "aesp". Click with the right mouse button on this file and choose "Encrypt with key…". A dialog box will appear. Make sure that the current cipher is "AES", the current mode is "Electronic Codebook" and length of the key is equal to 32 bytes.

Enter the encryption key exactly as shown in the test vector. Below there is a view of the "encryption key" editor window after that:

ASCII symbols to the right of the hexadecimal values may look differently on your computer. How the ASCII symbols look depends on the codepage of your computer, but for now this is not important.

This is the key for the plaintext encryption. We do not change anything in the "initial vector" editor window (below the "encryption key" editor window) because the initial vector is not used in Electronic Codebook mode. In "Output file name" field set the filename as "aesp".

Press the "Encrypt" button and encrypt the file.

The process is finished. The test plaintext has been encrypted with the test key and we just have to check whether the ciphertext in the file "aesp" corresponds with NIST’s ciphertext or not.

5. Go back to the hexadecimal editor. Choose "File\Open…"; go to the directory where the file "aesp" has been saved; in the "Files of type" combo box select "All Files (*.*)", in the "Open as:" combo box select "Binary". Find the encrypted file "aesp" and open it.

If everything has been done correctly you will see the following picture:

The first 68 bytes are the file header. This header contains information about the algorithm and the mode used for encryption, whether the file was encrypted with the password or with the user’s encryption key, whether the file was compressed before encryption or not. The header also contains encrypted creation time of original file and last write time of original file, encrypted size of the original file, the length of the name of the original file and the encrypted name of the original file with relative path. If you are registered user, make request to support@finecrypt.net and we'll send you detailed explanation of every byte in the file header.

The next 16 bytes (marked here with green color) are the ciphertext. Compare it with the ciphertext from the test vector and make sure they are identical. So you can see that the internal realization of the algorithm is fully adequate to the author’s scheme.

The last 4 bytes is a checksum of the file content, which is used for ensuring that the file content is not damaged.

You can test in the same way with appropriate test vectors all algorithms in all modes. In order to check FineCrypt in modes such as CBC, CFB and OFB the fourth array called initial vector must be added. Take into account that size of the file header will changes together with the length of the name of the encrypted file. In our example length of file name was equal to 4 bytes, if you will encrypt file whose file name is 5 bytes long, then size of the header also become longer on one byte. And do not forget to turn off compression before testing.


Overview of Key Manager

FineCrypt Key Manager is the convenient tool for managing encrypted files and encryption keys which reside on your computer. With Key Manager you can handle not only the files which are encrypted with key, but also those ones that are encrypted with password.


Setting up Key Manager

Before use Key Manager for working with encrypted files and keys you should indicate locations on your computer that Key Manager will search for encrypted files and keys.

To define locations of encrypted files:

  1. Press "Locations" ( [image] ) button on the toolbar. (F7 or menu item "File/Locations..." makes the same effect.)

  2. In the "Locations" dialog box using buttons "Add" and "Remove" select folders or drives where you are storing encrypted files. Drives and folders will be searched including all subfloders they contain.

  3. Press OK.

To define locations of encryption keys:

  1. Press "Encryption keys folder" ( [image] ) button on the toolbar. (Menu item "File/Encryption keys folder..." makes the same effect.)

  2. In the "Encryption keys folder" dialog box define folder where encryption keys are stored.

  3. Press OK.


Using Key Manager

Key Manager window is divided into three views: Locations, File list and Description.

  • The Locations view displays three categories of locations: Keys, Folders and All files.
    - Keys category represents folder you have indicated as encryption keys folder.
    - Folders category is a folder tree that represents folders on your computer where encrypted files are stored. Folders view displays only those drives and folders that you have indicated as locations of encrypted files (see: Setting up Key Manager).
    - All files category represents content of all folders that are defined as locations of encrypted files.

  • The File list view displays information depending on what location is currently selected in the Locations view.
    - When Keys category is selected, File list view displays all key files contained in the encryption key folder (including all subfolders). More details see in: Managing keys.
    - When you are selecting folder in the Folders category, File list view displays encrypted files contained in this folder (without subfolders). More details see in: Managing files.
    - When category All files is selected, File list view displays all encrypted files contained on all drives and folders that are defined as locations of encrypted files. More details see in: Managing files.

  • The Description view displays information depending on what item is currently selected in the File list view.
    - When you are selecting key file in the File list view, Description view displays list of all found encrypted files that are encrypted with this key.
    - When you are selecting encrypted file in the File list view, Description view displays list of files contained in this encrypted file. Content of encrypted file is displayed automatically if file is encrypted with key and this key is found in the encryption key folder. If file is encrypted with password, you will be prompted to enter password. If the next file you are selecting is encrypted with the same password, this password will be automatically used for viewing file content.


Managing keys

When you select in the Locations view (left pane in the Key Manager window) Keys category, Key Manager displays information about encryption keys stored on your computer. You can see information about encryption keys in two views: File list view and Description view.

File list view displays list of all key files found in the folder which you have indicated as encryption keys folder (including all subfolders).

  • First column (from the left) "Name" displays name of key file.

  • Second column "Used" displays number of found encrypted files that are encrypted with this key. If you are storing encryption keys on the floppy disk, for saving disk space it is recommended to periodically delete unused key files.

  • Third column "Size(64)" displays length of the key if it used with 64-bit encryption algorithms such as IDEA, Blowfish, GOST...

  • Fourth column "Size(128)" displays length of the key if it used with 128-bit encryption algorithms such as AES, Serpent, Mars... (see: Overview of algorithms).

When you are selecting key file in the File list view, Description view displays list of files that are encrypted with this key.

  • First column "Name" displays name of encrypted file.

  • Second column "Size" displays size of encrypted file in bytes.

  • Third column "Type" displays whether files was encrypted with password or with key.

  • Fourth column "Algorithm" displays encryption algorithm with which file was encrypted.

  • Fifth column "Mode" displays encryption mode in which file was encrypted.

  • Sixth column "Path" displays full path of the file on your computer.


Managing files

When you select in the Locations view (left pane in the Key Manager window) folder in the Folders category or in the All Files category, Key Manager displays information about encryption files stored on your computer. You can see information about encryption files in two views: File list view and Description view.

File list view displays list of all encrypted files found in the currently folder if you are in the Folders category, or list of all encrypted files found in the all folders defined as locations of encrypted files if you are in the All files category.

  • Column "Name" displays name of encrypted file.

  • Column "Size" displays size of encrypted file in bytes.

  • Column "Type" displays whether files was encrypted with password or with key.

  • Column "Key file" displays name of key file with which file was encrypted if key file is found, string "Key not found" if key file was not found, or empty string if file was encrypted with password.

  • Column "Algorithm" displays encryption algorithm with which file was encrypted.

  • Column "Mode" displays encryption mode in which file was encrypted.

  • Column "Path" displays full path of the file on your computer.

When you are selecting encrypted file in the File list view, Description view displays list of files that are contained in this encrypted file.
If file is encrypted with key, Key Manager using key ID searches key for decrypting selected file and if key is found, file content is displayed in the Description view.
If file is encrypted with password, Key Manager tries to use for decrypting and displaying file content previously used password if any, if this password is incorrect, Key Manager prompts to enter new password.


Why you need to change keys?

Why is it necessary to change keys?

If you encrypt two text files which have identical text fragments, for example, the name of the organization, date or name in the header, with the same key, then the corresponding ciphertexts of these fragments will also be identical. The cryptanalyst can make some suggestions about identical fragments. If his suggestions are correct then he will get a ciphertext fragment with a corresponding plaintext fragment and will be able to use this information for further cryptanalysis. The more fragments the cryptanalyst has, the greater is the risk of breaking the encrypted data.

This is why periodical change of the keys is recommended to provide safe storage of your information. The rule of changing the key is formulated in cryptography as a strict requirement, not as a recommendation. Each key may be used only once for encrypting the data in those organizations that deal with very valuable confidential information.


Key ID

What is Key ID?

Crypto Systems uses a new technology in FineCrypt that significantly simplifies key management. If you are using encryption with key, you may choose to assign to each key an unique key ID which is stored along with the key. This key ID is stored also in the header of the encrypted file. With key IDs user does not have to keep in mind what file is encrypted with what key. The user for decryption of file has only to specify the directory where the keys are stored, press the "Find key" button and FineCrypt using the key ID will automatically find the appropriate key.

Key ID is a perfect mean of simplifying key management. Key ID does not make any changes in the encryption technique. Key ID is not secret information. Knowing the key ID does not help the cryptanalyst to break encrypted data. In the same way as a burglar, having only tallies from keys, does not be able to open a door.

FineCrypt generates the key ID with the help of the algorithm proposed by Open Systems Foundation (OSF) for their Distributed Computing Environment (DCE). The key ID is a 128-bit (16-byte) integer that is virtually guaranteed to be unique in the world across space and time. This algorithm generates keys using the Internet protocol (IP) number (unique in space) and the current date/time when the algorithm is run (unique in time). Uniqueness in both time and space means that no matter when and where the algorithm is run, it will produce a unique value. If each of 6 billion people on the Earth generated 10 trillion key IDs in a second then it would take 190 million years to run out of key IDs.


Key managment with FineCrypt

Key management with FineCrypt

A new key ID is automatically generated during generation of a new key. If you do not want assign unique ID to a new key and store this ID with key, then you have to input the key from the keyboard or read it from file, instead of generating a new key with FineCrypt. In this case key will not have ID and you will not be able to automatically find the appropriate key when decrypting the file.

It is recommended to store all the FineCrypt key files on a floppy disk, and floppy disk itself should be kept in a secure place. Several hundreds keys can be stored on one floppy disk. It is recommended to always have a backup copy of the floppy disk with the keys and to keep this copy separately.

To decrypt the file with key which has key ID, press "Find" button in the "Decrypt with key" dialog box and specify in the appeared window the directory where FineCrypt key files are located. Then press "OK". If FineCrypt key file with ID, which is identical to the ID stored in the file currently being decrypted, is found, then the key and initial vector from this key file will appear in the "encryption key" dialog box.


Overview of Task Manager

FineCrypt Task Manager is a powerful tool with which you can entirely automate the process of encryption and deletion of files on your computer. With one mouse click you can encrypt and/or wipe any number of files which can be located in different folders and even on different drives. You can automatically perform various operations with files by creating and configuring various tasks.

With Task Manager there is no need for you anymore to be anxious about confidential files on your hard disk which you could forgot to encrypt, or about temporary files which are created by many programs and which can contain sensitive information, or about updating your encrypted archives with new versions of files, etc. All these tasks you can accomplish with a single mouse click using Task Manager.


Task Manager window


Using Task Manager

Task Manager is an utility with which you can automate some operations with files that you do regularly on your computer. You can use Task Manager for automatic executing of 5 types of tasks: Encrypt, Encrypt and wipe, Delete, Move to Recycling Bin, Wipe.

To start use Task Manager you need to create a task schedule. Task schedule is a list of tasks which you want to do automatically with Task Manager. By creating and configuring tasks you define what action you want to do and what files must be affected by this action. You create and delete tasks in the Task window, and configure task properties in the Properties window. When you have created a task schedule, you can save it and use again in the future.

After task schedule has been created, before executing tasks Task Manager builds in the File list window a list of files which will be affected by these tasks. You can edit this file list by removing files from it or changing actions that must be executed with these files.

After the file list has been built, you press "Execute" button and Task Manager will execute all tasks with files which are in the file list.

During building a file list or executing tasks Task Manager will generate messages about results of current operations. These messages are shown in the Output window. If Task Manager encounters some error during execution of task, it put in the "Output" window the task properties and a brief description of error.

For more details see:

How to...

Task properties


How to...

This section contains information about procedures which you will do when using Task Manager:


Start Task Manager

To start Task Manager

  • Click "Start" button, in the "Program" menu open the "FineCrypt" submenu and select "Task Manager".

  • If you already created task schedule with Task Manager, you can start Task Manager by double-clicking on the FineCrypt TaskMan Schedule file. These files have "FCT" extension and icon [image].

Note: if you are opening by double-clicking an encrypted schedule file, then before Task Manager window will appear you will be prompted to enter the password for encrypted schedule file.


Adding new task

To add new task:

  1. In the Task window select a pane on which you want to add task.

  2. To add new task to the task schedule, do one of following actions:

    • Press "Add new task" button( [image] )on the toolbar;

    • Press F2 key;

    • Select "Create new task..." item in the "Actions" menu;

    • Click with the right mouse button on any item in the Task window and select "Create new task..." item in the context menu.

  3. In the "Select folder" dialog box select the folder that contains the files on which you want to take actions and press OK.


Removing tasks

Deleting tasks

To delete a task:

  1. On the current pane in the Task window select the task you want to delete.

  2. To delete task from the task schedule do one of the following:

  • Press "Delete task" button ( [image] ) on the toolbar;

  • Press F3 key;

  • Select "Delete task" item in the "Actions" menu;

  • Click with the right mouse button on the item in the Task window and select "Delete task" item in the context menu.


Build file list

Building file list

Before executing tasks, you need to list files which will be affected by the tasks in the schedule. You can list files for one task, for all the tasks on the current pane, or for all the tasks on both panes.

To build file list for one task:

  1. Select task you want to execute in the task window.

  2. Do one of the following actions:

  • Press "List files for selected task" button ( [image] ) on the toolbar;

  • Press F4 key;

  • Select "List files for selected task" item in the "Actions" menu;

  • Click with the right mouse button on the desired task and select "List files for this task" item from the context menu.

To build file list for all the tasks on the pane:

  1. Select desired pane in the task window.

  2. Do one of the following actions:

  • Press "List files for current pane" button ( [image] ) on the toolbar;

  • Press F5 key;

  • Select "List files for current pane" item in the "Actions" menu;

  • Click with the right mouse button on any item on the current pane and select "List files for this pane" item from the context menu.

To build file list for all the tasks on both panes:

Do one of the following actions:

  • Press "List files for both panes" button ( [image] ) on the toolbar;

  • Press F6 key;

  • Select "List files for both panes" item in the "Actions" menu;

  • Click with the right mouse button on any item on the current pane and select "List files for both panes" item from the context menu.


Work with file list

Working with file list

In the File list window Task Manager lists files which will be affected by tasks that are selected for execution. You can edit this list by removing files from it or changing actions that will be executed on these files.

If you remove files from the list, these files will not be affected by any task that will be executed.

To remove files from the list:

  1. Select one or more files you want to remove.

  2. Click with the right mouse button over the selection and select "Remove from list" item from the context menu.

Notes:

You can select files in the list by several ways:

  • Press and hold left mouse button and drag mouse pointer over the files;
  • Select the first file in the list among those you want to remove, press and hold "Shift" key and select the last file;
  • Press and hold "Ctrl" key and select different files.

To change the action that will be executed on files:

  1. Select one or more files you want to change;

  2. Click with the right mouse button over the selection and choose from the context menu new action you want to execute on these files.

Notes:

  • When you are changing action for files, you can assign new action to these files only from the same category ("Encrypt" or "Delete") that the previous action was from. For example, if the previous action was "Wipe", you can choose new action only from "Delete" category: "Don't delete", or "Move to Recycle Bin", or "Delete".


Execute tasks

Executing tasks

After Task Manager has built list of files that will be affected by execution of tasks, you can start execution of tasks.

To start execution of tasks, do one of the following actions:

  • Press "Execute" button ( [image] ) on the toolbar;

  • Press F8 key;

  • Select "Execute" item in the "Actions" menu.

Notes:

  • After tasks has been executed there is no way to undo them. Therefore it is highly recommended to always check files listed for execution of tasks.


File mask

Task properties: "File mask"

This property defines which files must be affected by the task. File mask is a search pattern which Task Manager uses when building list of files which will be subjects of execution of this task.

To define a file mask click with the left mouse on the "File mask" field in the "Properties" window, after that press the button which will appear on the right side of the field. "File mask" dialog box will be shown.

In the "Edit file mask" dialog box you can enter file mask in two ways. If you want to apply the task to all the files of a certain type in the folder (e.g. to all text files), you can define file mask by selecting file types.

If you want to narrow or extend a number of files which must be affected by the task (e.g. you want to apply the task only to the text files whose name beginning with "a") you need to enter the file mask manually.

To enter file mask by selecting file types:

  1. Press "Add" button in the upper part of the dialog box (in the section "File types").

  2. In the "Select file type" dialog box select any file whose type you want to include in the mask. (E.g. if you wish to apply the task to all text files, select any text file). After that press "Open" button.

  3. You can include in the file mask as many file types as you wish. To do this, repeat steps 1 and 2. In the end press OK to close "Edit file mask" dialog box

To enter file mask manually:

  1. Press "Add" button in the bottom part of the dialog box (in the section "File masks").

  2. Enter search pattern and press OK. You can use in the search pattern wildcard characters (see below).

  3. You can include in the file mask as many search patterns as you wish. To do this, repeat steps 1 and 2. In the end press OK to close "Edit file mask" dialog box.

Search patterns

If you enter file mask manually, in most cases you will need to use in the search patterns file extensions. File extension is the part of file name which defines the file type and locates in a file name after the dot (or after the last dot if file name has several dots). For example, files with names "file.txt" and "file1.exe" have the extensions "txt" and "exe" accordingly. Text files usually have extensions: "txt", "doc", "wri", "rtf"; picture files have extensions such as "jpg", "bmp", "gif" and so on. Windows explorer by default does not show the file extensions for the registered file types (e.g. explorer does not show "txt" or "doc" extensions). To see the file extensions either you should enable Windows explorer to show the extension for all file types, or you can see extensions in the FineCrypt explorer. To see file extensions in the Windows explorer start Windows explorer, select menu item "Folder options" in the "View" menu, go to the page "View" and uncheck option "Hide file extensions for known file types". Another way to see file extension in Windows explorer is to click right mouse button on the file and select in the context menu item "Properties", file extension will be displayed in the string "MS-DOS name".

Search patterns which you can use in the mask are file names where one or more symbols can be replaced with so called "wildcard characters". Wildcard character is a symbol which is used as a placeholder for letters or numbers in a file name. You can use as wildcard characters the question mark (?) and the asterisk (*). The asterisk matches any sequence of characters, whereas the question mark matches any single character.

Examples of search patterns:

Search pattern | Files which will be found | Files which will not be found
a*.txt | a.txt; abcd.txt; ABC.txt. | ba.txt; a.txx;
*b?.c?? | abc.cab; aabc.ccd; bc.cqq; | abcc.cab; abc.ca; ab.cab;
*a.* | bca.txt; dda.html; a.h | bac.txt;

You can include in the file mask all the files that are contained in the directory, in this case you can use pattern "*.*" (without quotation marks). You also can specify in the file mask only one file, in this case you will enter the name of this file (without path), for example: "file.txt".


Folder

Task properties: "Folder"

This property is set automatically when you create new task. It indicates the folder where files which will be subjects of this task are residing. You cannot change this property, therefore "Folder" field is read-only.

This property is valid for both "Encrypt" and "Delete" tasks.


Include subfolders

Task properties: "Include subfolders"

You determine in this property whether subfolders which are contained in the folder indicated in the "Folder" property must be included in the execution of task. If this property is set as "Yes", then all the files which are contained in all subfolders and which match the file mask will be affected by task execution.

This property is valid for both "Encrypt" and "Delete" tasks.


Task name

Task properties: "Task name"

By default each task in the task tree in the Task window is represented by its file mask. Often such a representation is inconvenient, especially when the file mask includes many search patterns. In this case you can assign to the task any arbitrary name. For example, you can assign name "Text files" to a task with file mask "*.txt". Task name does not affect in any way execution of task.

This property is valid for both "Encrypt" and "Delete" tasks.


Deletion type

Task properties: "Deletion type"

This property is valid only for "Delete" tasks. You determine in this property which action must be applied for deletion of file. You can choose from the four alternatives: "Don't delete", "Move to Recycle Bin", "Delete" and "Wipe".

"Don't delete" - does nothing with files. You may use this action when, for example, you want to leave some files in the folder, while all other files of the same type must be deleted. For instance, if you want to wipe all the "txt" files from the folder except one file with name "file.txt", you can create two tasks for this folder: one task will have file mask "*.txt" and the deletion type "Wipe", other task will have file mask "file.txt" and the deletion type "Don't delete". "Don't delete" has higher priority than other deletion types, and when Task Manager encounters an ambiguity (in this case between "Wipe" and "Don't delete" actions), it chooses action with higher priority (in this case Task Manager will choose "Don't delete").

"Move to Recycle Bin" - moves files to Recycle Bin. If you use this action, files are not being deleted from your computer, but moved to the Recycle Bin, and you (or someone else) can easily restore them later.

"Delete" - deletes files. In this case references to the files are removed from some systems tables, but the file contents continue to be stored on your hard disk and can be restored with any disk tool utility. It is recommended to use this action for deleting files whose contents are not confidential.

"Wipe" - wipes files from your hard disk. This is the most secure type of deletion which permanently deletes the file content so it cannot be restored using disk recovery software.


Wipe original files

Task properties: "Wipe original files"

This property is valid only for "Encrypt" tasks. You determine in this property whether original files must be wiped after encryption. If this property is set as "Yes", then all the files which match the file mask will be wiped after encryption.


Destination folder

Task properties: "Destination folder"

This property is valid only for "Encrypt" tasks. You indicate in this property the directory into which Task Manager must place encrypted files. Directory must exist, otherwise Task Manager will generate an error. If destination directory is not specified, encrypted files will be placed into the directory where original files are located.

To define a destination folder:
  1. Click with the left mouse on the "Destination folder" field in the "Properties" window, after that press the button which will appear on the right side of the field.
  2. In the "Select folder" dialog box select desired folder and press OK.

Note: This property is used only if property "Create archive" is set as "No". Otherwise, this property is ignored.


Create archive

Task properties: "Create archive"

This property is valid only for "Encrypt" tasks. If this property is set as "Yes", then all files that are affected by the task will be encrypted and placed into archive. Archive name you should specify in the "Archive name" property. If this property is set as "Yes" and archive name is not specified, Task Manager will generate an error.

If this property is set as "No", then all the files that are affected by the task will be encrypted into individual encrypted files and placed into the directory indicated in the "Destination folder" property. If destination folder is not specified, then all encrypted files will be placed into the directory where original files are located.


Archive name

Task properties: "Archive name"

This property is valid only for "Encrypt" tasks. If property "Create archive" is set as "Yes", you specify in the "Archive name" property the name of archive into which files must be placed during encryption. You can specify either existing archive or new archive. The directory where archive is located must exist, otherwise Task Manager will generate an error.

This property is ignored if the property "Create archive" is set as "No".

To enter an archive name:
  1. Click with the left mouse on the "Archive name" field in the "Properties" window, after that press the button which will appear on the right side of the field.
  2. In the "Select FineCrypt archive" dialog box first navigate to the desired folder, then either select existing archive or type in new archive name and press OK.

Note: If you specify in this property as an archive name the name of existing archive, then in the case if the name of a file that is being added to the archive coincide with the name of a file that already exists in the archive, Task Manager will behave accordingly to user preferences which are set in the "Encryption preferences" dialog box on the "General" page in the section called "If file already exists in archive". You can select in these preferences one of four options: "Always overwrite", "Overwrite with newer version", "Show prompt", "Never overwrite".


Key file

Task properties: "Key file"

This property is valid only for "Encrypt" tasks. If you wish to encrypt files with encryption key, you need to specify in this property the name of the key file. The key file must exists, otherwise Task Manager will generate an error.

To enter a name of key file:
  1. Click with the left mouse on the "Key file" field in the "Properties" window, after that press the button which will appear on the right side of the field.
  2. In the "Select FineCrypt key file" dialog box navigate to the desired folder, then select a key file and press OK.

Note: The key file must contain encryption key which is compatible with selected encryption algorithm in the "Algorithm" property. That is encryption key must have a length equal to the maximal key length for selected algorithm. If encryption key is not compatible with selected algorithm, Task Manager will generate an error.


Password

Task properties: "Password"

This property is valid only for "Encrypt" tasks. If you wish to encrypt files with password rather than with encryption key, you need to specify in this property the password which will be used for encryption of files.

Note: This property is ignored if you have specified in the "Key file" property the name of key file. That is if you provide both password and the name of file with encryption key, encryption will be done with encryption key.


Algorithm

Task properties: "Algorithm"

This property is valid only for "Encrypt" tasks. You specify in this property the encryption algorithm which must be used for encryption of files.

Note: If you wish to perform encryption with key file rather that with password, in this case encryption algorithm and encryption key must be compatible. That means that encryption key must be the same length as the maximal key length for the selected algorithm. For example, if you select AES as encryption algorithm, you should provide key file which contain 32-byte (256-bit) encryption key.


Mode

Task properties: "Mode"

This property is valid only for "Encrypt" tasks. You specify in this property the encryption mode which must be used for encryption of files.


Preferences

To open "Preferences" dialog box select "Preferences" item in the "File" menu.

"Encrypt schedule" - set this option if you wish your schedule documents to be stored encrypted. If this option is set, then every time when you save or open Task Manager schedule files, you will be prompted to enter a password. It is recommended to use this option if encryption tasks in your schedule contain passwords. If you are using this option, you can safely store passwords in your encryption tasks because schedule files are encrypted with AES encryption algorithm which is one of the strongest encryption algorithms.

"Load last schedule on startup" - If this option is set, then every time when you start Task Manager it will try to open a schedule file which was used most recently.


Setting preferences

You can specify your preferences in the "Preference" dialog box, which you can in several ways:

  • choosing "Settings..." from the "Tools" menu in the FineCrypt explorer.
  • by clicking the "Preferences" ( encpref.gif (905 bytes) ) button in the FineCrypt explorer.
  • by clicking the "Preferences" ( encpref.gif (905 bytes) ) button in the "Encrypt" dialog box.

The preferences dialog box includes five panes: Algorithms, Encryption, General, Quick Encrypt and Session.


Algorithms

On the "Algorithm" pane you can select encryption algorithm and encryption mode.

Encrypt with: Choose one algorithm that you want to be used for the encryption from 10 encryption algorithms.

Encryption mode: Select the desired encryption mode.

If you change encryption algorithm or encryption mode after you already have entered encryption key for encryption with other algorithm or mode, then you will be prompted to enter encryption key again.


Encryption preferences

On the "Encryption" pane you can select the encryption settings:

  • Default output folder - Here you can set the directory that will automatically appears in the "Output folder" combo box in "Encrypt" and "Archive" dialog boxes. If you do not specify default folder, then the current folder will be used.

  • Create archive - Check if you want to encrypt original files into encrypted FineCrypt archive. That is to encrypt several files into the single file with which you can work in the same way as you work with zip archives. If you uncheck this option, then original files will be encrypted into the individual encrypted files. Read more about archives: Overview of archives.

  • Include subdirectories when adding directory - when you adding a directory to a list, all files that are contained in the all subdirectories are added to the list by default. If this option unchecked, then when you adding a directory to a list, files from subdirectories will not be included to a list.

  • Wipe original file after encryption - Check if you want to automatically wipe original files after the encryption. The files will be wiped without any warning. Read more about wiping: Wipe.


General preferences

On the "General" pane you can select general settings. Your options are:

  • Number of wiping rounds - Here you can set the number of times for FineCrypt to perform overwriting of the data during wiping of the file. This value may vary from 1 to 99.

  • Rounds of "mashing" encryption key - Here you can set the number of cycles of scanning and hashing the random values during the encryption key generating. This value may vary from 1 to 9999.

  • Compress all files before encryption - If selected, all the files will be compressed before the encryption. Take into consideration that the data stored in many files such as jpg, mov, mp3, etc. is already compressed. An attempt to compress such files may enlarge them. Besides, you are just wasting your time trying to compress such files. Select this option if you encrypt mostly compressible files such as txt, doc, xls, etc.

  • Compress only compressible files - If selected, then the compression will be performed only for the files that can be compressed with a ratio exceeding 10%. FineCrypt will check the file before the encryption and compression will be performed only for compressible files. This option saves time when encrypting large incompressible files because the time of checking the compressibility of the file is less than the time of compression by dozens of times. Select this option if you encrypt both compressible and incompressible files.

  • Don't compress - This option disables the compression for all files. Select this option if you encrypt mostly incompressible files such as zip, arj, jpg, jpeg, mov, etc.

  • Always overwrite output files with the same name - If checked, then all new files with the same names will be overwritten during the encryption without any warning.

  • Obscure passphrase with asterisks - Check this option to obscure the current passphrase with asterisks to prevent anyone from reading it from your screen.

  • Restore original time/date stamp for decrypted files - If selected, FineCrypt sets for the decrypted files time/date stamp ("Modified" and "Created" date and time) which original files had. If not selected, FineCrypt sets for the decrypted files the current date and time as time/date stamp.

The section "If file already exists in archive" determines behaviour of the program in situations when the name of a file that is being added to the archive coincide with the name of a file that already exists in the archive. This section contains four options:

  • "Always overwrite" - existing file is always overwritten with new file.
  • "Overwrite with newer version" - existing file is overwritten with new file only if the new file has been more recently modified that the existing file.
  • "Show prompt" - if file with the same name is already existing in an archive, the dialog box will be shown and you will be able to choose whether to overwrite the existing file or not.
  • "Never overwrite" - existing file is never overwritten with new file.


Overview of algorithms

A symmetric cryptographic algorithm is a cryptographic algorithm that typically uses a single key for encryption and decryption. Symmetric algorithms can be divided into two categories: stream algorithms and block algorithms (also called stream and block ciphers).

All cryptographic algorithms used in FineCrypt are symmetric block algorithms.

A block cipher is a type of symmetric-key encryption algorithm that transforms a fixed-length block of plaintext data into a block of ciphertext data of the same length. This transformation takes place under the action of a user-provided secret key. Decryption is performed by applying the reverse transformation to the ciphertext block using the same secret key. The fixed length is called the block size. For all algorithms used in FineCrypt the block size is 64 bits or 128 bits.

Iterated block ciphers encrypt a plaintext block by a process that has several rounds. In each round, the same transformation (also known as a round function) is applied to the data using a subkey. The set of subkeys is usually derived from the user-provided secret key by a special function. The set of subkeys is called the key schedule. The number of rounds in an iterated cipher depends on the desired security level and the consequent trade-off with performance. In most cases, an increased number of rounds will improve the security offered by a block cipher.

The algorithms offered in FineCrypt are listed below.

Algorithm | Max. length of key |  | Block size
 | bits | bytes | bits
AES | 256 | 32 | 128
Blowfish | 576 | 72 | 64
CAST-256 | 256 | 32 | 128
GOST | 256 | 32 | 64
IDEA | 128 | 16 | 64
MARS | 448 | 56 | 128
RC-6 | 2040 | 255 | 128
Serpent | 256 | 32 | 128
Triple DES | 192 | 24 | 64
Twofish | 256 | 32 | 128

NOTE: Latest enhancement of Blowfish algorithm by author of this algorithm Bruce Schneier has increased key length from 448 bits to 576 bits.


Encryption modes

When we use a block cipher to encrypt a message of arbitrary length, we use techniques known as modes of operation for the block cipher. To be useful a mode must be at least as secure and as efficient as the underlying cipher. Modes may have properties in addition to those inherent in the basic cipher. The standard DES modes have been published in FIPS PUB 81 and as ANSI X3.106. A more general version of the standard generalized the four modes of DES to be applicable to a block cipher of any block size. The standard modes are Electronic Code Book (ECB), Cipher Block Chaining (CBC), Cipher Feedback (CFB), and Output Feedback (OFB).

Electronic Codebook mode (ECB)

When this cipher mode is used, each block is encrypted individually. No feedback is used. This means any blocks of plaintext that are identical and are either in the same message, or in a different message that is encrypted with the same key, will be transformed into identical ciphertext blocks.

If the plaintext to be encrypted contains substantial repetition, then it is feasible for the ciphertext to be broken one block at a time. Furthermore, it is possible for an unscrupulous person to substitute and exchange individual blocks without detection.

Initialization vectors cannot be used with this cipher mode.

If a single bit of the ciphertext block is garbled, then the entire corresponding plaintext block will also be garbled.

Cipher Block Chaining mode (CBC)

This cipher mode introduces feedback. Before each plaintext block is encrypted, it is combined with the ciphertext of the previous block by a bitwise XOR. This ensures that even if the plaintext contains many identical blocks, they will each encrypt to a different ciphertext block.

The initialization vector is combined with the first plaintext block by a bitwise XOR before the block is encrypted.

As with the electronic codebook cipher mode, if a single bit of the ciphertext block is garbled, then the corresponding plaintext block will also be garbled. In addition, a bit in the subsequent plaintext block (in the same position as the original garbled bit) will be garbled. Synchronization errors are fatal. If there are extra or missing bytes in the ciphertext, the plaintext will be garbled from that point on.

Cipher Feedback mode (CFB)

In CFB mode the previous ciphertext block is encrypted and the output produced is combined with the plaintext block using exclusive-OR to produce the current ciphertext block. It is possible to define CFB mode so it uses feedback that is less than one full data block. An initialization vector is used as a “seed” for the process.

CFB mode is as secure as the underlying cipher and plaintext patterns are concealed in the ciphertext by the use of the exclusive-or operation. Plaintext cannot be manipulated directly except by the removal of blocks from the beginning or the end of the ciphertext. With CFB mode and full feedback, when two ciphertext blocks are identical, the outputs from the block cipher operation at the next step are also identical. This allows information about plaintext blocks to leak.

Output Feedback mode (OFB)

OFB mode is similar to CFB mode except the quantity exclusive-ORed with each plaintext block is generated independently of both the plaintext and ciphertext. An initialization vector is used as a “seed” for a sequence of data blocks, and each data block is derived from the encryption of the previous data block. The encryption of a plaintext block is derived by taking the exclusive-OR of the plaintext block with the relevant data block.

OFB mode has an advantage over CFB mode in that any bit errors that might occur inside ciphertext are not propagated to affect the decryption of subsequent blocks. However, by changing the ciphertext, the plaintext can be easily manipulated.


AES

AES (Rijndael)

AES (stands for Advanced Encryption Standard, former name: "Rijndael") is a winner of AES competition (got 86 votes). It is a 128-bit block cipher with keysize of up to 256 bits developed by Joan Daemen and Vincent Rijmen. The round transformation of AES does not have the Feistel structure. Instead, the round transformation is composed of three distinct invertible uniform transformations, called layers. Every layer has its own function:

- The linear mixing layer: guarantees high diffusion over multiple rounds.

- The nonlinear layer: parallel application of S-boxes that have optimum worstcase nonlinearity properties.

- The key addition layer: A simple EXOR of the Round Key to the intermediate State.

In the final round of AES competion another four algorithms were under consideration to become the AES: MARS, RC-6, Serpent and Twofish. NIST (National Institute of Standards and Techology) made the following comments about the five finalists: "Each of the finalist algorithms appears to offer adequate security, and each offers a considerable number of advantages. Any of the finalists could serve admirably as the AES. However, each algorithm also has one or more areas where it does not fare quite as well as some other algorithm; none of the finalists is outstandingly superior to the rest."


Blowfish

Blowfish is a 64-bit block cipher developed by Bruce Schneier. It is a 16-round Feistel cipher and each round consists of a key-dependent permutation and a key-and-data-dependent substitution. All operations are based on exclusive-ors and additions on 32-bit words. The key has a variable length (with a maximum length of 576 bits) and is used to generate several subkey arrays. This cipher was designed specifically for 32-bit machines and although there is a complex initialization phase required before any encryption can take place, the actual encryption of data is very efficient on large microprocessors.


CAST-256

CAST is a 64-bit block cipher with keysize of 128 bits developed by Carlisle Adams and Stafford Taveres. It is a 16-round Feistel cipher that uses rotation to provide intrinsic immunity to linear and differential attacks; it uses a mixture of XOR, addition and subtraction (modulo 2**32) in the round function; and it uses three variations of the round function itself throughout the cipher. Finally, the 8x32 s-boxes used in the round function each have a minimum nonlinearity of 74 and a maximum entry of 2 in the difference distribution table.


GOST

GOST 28147-89 is a Russian encryption standard. It is a 64-bit block cipher with keysize of 256 bits. GOST is a DES-like 32-round Feistel cipher and each round consists of key-and-data-dependent substitution and rotation. All operations are based on exclusive-ors and additions on 32-bit words. GOST unlike DES does not specify the contents of its eight substitution boxes, saying they're a parameter of the Feistel network being set up. FineCrypt in GOST algorithm uses the first rows of the 8 S-boxes from the DES.


IDEA

IDEA (International Data Encryption Algorithm) is the second version of a block cipher designed and presented by Lai and Massey. It is a 64-bit iterative block cipher with a 128-bit key. The encryption process requires eight complex rounds. While the cipher does not have a Feistel structure, decryption is carried out in the same manner as encryption once the decryption subkeys have been calculated from the encryption subkeys. The cipher structure was designed to be easily implemented in both software and hardware, and the security of IDEA relies on the use of three incompatible types of arithmetic operations on 16-bit words. One of the principles used during the design of IDEA was to facilitate analysis of its strength against differential cryptanalysis and IDEA is considered to be immune to differential cryptanalysis. Furthermore there are no linear cryptanalytic attacks on IDEA and there are no known algebraic weaknesses in IDEA. IDEA is generally considered to be a very secure cipher and both the cipher development and its theoretical basis have been openly and widely discussed.


MARS

MARS is a 128-bit block cipher with keysize of up to 448 bits developed by IBM. MARS uses a unique combination of S-box lookups, multiplications and datadependent rotations. MARS has a heterogeneous structure, with cryptographic core rounds that are wrapped by simpler mixing rounds. The cryptographic core rounds provide strong resistance to all known cryptanalytical attacks, while the mixing rounds provide good avalanche and offer very wide security margins to thwart new (yet unknown) attacks.

Algorithm was a finalist in AES competition and got 13 votes (5-th place).


RC-6

The RC-6 block cipher was designed by Ron Rivest in collaboration with Matt Robshaw, Ray Sidney, and Yiqun Lisa Yin from RSA Laboratories. The algorithm is an evolutionary improvement over the RC-5 block cipher, and like RC-5, it makes essential use of data-dependent rotations. It has 128-bit block size, a key size of up to 2040 bits, and a 32 rounds. There are three routines in RC-6: key expansion, encryption, and decryption. In the key-expansion routine, the user-provided secret key is expanded to fill a key table whose size depends on the number of rounds. The key table is then used in both encryption and decryption. The encryption routine consists of three primitive operations: integer addition, bitwise exclusive-or, and variable rotation. The heavy use of data-dependent rotations and the mixture of different operations provide the security of RC-6. In particular, the use of data-dependent rotations helps defeat differential and linear cryptanalysis.

Algorithm was a finalist in AES competition and got 23 votes (4-th place).


Serpent

Serpent is a 32-round SP-network, designed by Ross Anderson, Eli Biham and Lars Knudsen. It operating on four 32-bit words, thus giving a block size of 128 bits. All values used in the cipher are represented as bitstreams. Serpent encrypts a 128-bit plaintext to a 128-bit ciphertext in 32 rounds under the control of 33 128-bit subkeys. Its design is highly conservative, yet still allows a very efficient implementation. It uses S-boxes similar to those of DES in a new structure that simultaneously allows a more rapid avalanche and a more efficient bitslice implementation.

Algorithm was a finalist in AES competition and got 59 votes (2-nd place).

Here, what authors of Serpent say: "Serpent and Rijndael are in fact somewhat similar; the main difference is that Rijndael is faster (having fewer rounds) but Serpent is more secure."


Twofish

Twofish is a 128-bit block cipher that accepts a variable-length key up to 256 bits. The cipher is a 16-round Feistel network with a bijective F function made up of four key-dependent 8-by-8-bit S-boxes, a fixed 4-by-4 maximum distance separable matrix over GF(28), a pseudo-Hadamard transform, bitwise rotations, and a carefully designed key schedule. The design of both the round function and the key schedule permits a wide variety of tradeoffs between speed, software size, key setup time, gate count, and memory.

Algorithm was a finalist in AES competition and got 31 votes (3-rd place).


Format of key files

FineCrypt lets you generate highly random encryption keys (by pressing "Generate" button in the "Enter encryption key" dialog box). But you also can provide your own encryption keys which can be generated with your own methods. In order to use your own encryption keys you need to provide them in files which have the same format that FineCrypt key files have.

FineCrypt key file contains 3 items (in the order of their placement in the file): key ID, encryption key and initialization vector (IV).

Key ID - is used for automatic finding of the key (see: What is key ID). The size of key ID is always equal 16 bytes. You can generate your own key ID, or you can fill it with all zeroes, in this case you will not be able to automatically find this key during decryption of file.

Encryption key - the array of bytes which is used as encryption key during encryption without any modifications. The size of this array must be equal to the maximal key length which is allowed by encryption algorithm with which this encryption key is supposed to be used.

Initialization vector - the array of bytes which is used as IV (see: What's this: initialization vector) during encryption in chaining modes (see: Encryption modes) without any modifications. The size of this array must be equal to the blocksize of encryption algorithm with which this IV is supposed to be used.

Below is example of structure of key file for using with the AES encryption algorithm which has maximal key length equal to 32 bytes and 16-bytes blocksize :

Key ID
16 bytes

Encryption key
32 bytes

IV
16 bytes


Generation of encryption keys

FineCrypt generates encryption keys in two cases: when you encrypt files with password and when you press the "Generate" button in the "Enter encryption key" dialog box. However FineCrypt uses different methods in each of these cases. Below there is a description of these methods. (Note: in all cases FineCrypt do hashing with hash function SHA-1.)

Generation of encryption key from password

1. Password is hashed with current date and time into 8-bytes array called "salt".

2. Password along with salt are transformed into the encryption key and initialization vector.

Transformation function for transforming password and salt into the encryption key (C programming language)

Function parameters:

BYTE* in - byte array which contain user password concatenated with the salt;
USHORT inLen - the length of in;
BYTE* out - byte array which will contain encryption key and IV upon exit of function;
USHORT outLen - the length of out;

Function body:

#define DIGESTSIZE 20

void
GenerateKey(BYTE* in, USHORT inLen, BYTE* out, USHORT outLen)
{
UINT bufSize = (outLen-1 + DIGESTSIZE -((outLen-1) %
DIGESTSIZE));
DWORD iterations = 1000;

BYTE b[2];
BYTE* buf = new BYTE[bufSize];
BYTE* outBuf = new BYTE[bufSize];
SHA hash;

UINT i;
for(i=0; i<outLen; i+=DIGESTSIZE)
{
b[0] = (BYTE) i >> 8;
b[1] = (BYTE) i;
hash.Update(b, 2);
hash.Update(in, inLen);
hash.Final(outBuf+i);
}

while (iterations-- > 1)
{
memcpy(buf, outBuf, bufSize);
for(i=0; i<bufSize; i+=DIGESTSIZE)
{
b[0] = (BYTE)
i >> 8;
b[1] = (BYTE)
i;
hash.Update(b,
2);
hash.Update(buf, bufSize);
hash.Final(outBuf+i);
}
}

memcpy(out, outBuf, outLen);
delete buf;
delete outBuf;
}

Generation of new encryption key

This procedure takes place when user presses "Generate" button in the "Enter encryption key" dialog box.

1. First FineCrypt collects pseudorandom data from the user's computer and transform into array with random bytes.

2. Array with random bytes is transformed into encryption key and IV.

Function for generating new encryption key (C programming language)

Function parameters:

DWORD dwNumOfIterations - the number which is defined by user in the "Preferences" dialog box on the   page "General" in the option: "Rounds of "mashing" encryption key";
BYTE* keyInfo - byte array which will contain encryption key and IV upon exit of function;
USHORT keyLen - the length of keyInfo, this number is equal to maximal key length of the current algorithm plus blocksize of the current algorithm;

Function body:

#define DIGESTSIZE 20

#define addRandomLong( word ) \
{ \
h[0] += (( LONG ) word >> 24 ); \
h[1] += ( ( LONG ) word >> 16 ); \
h[2] += ( ( LONG ) word >> 8 ); \
h[3] += ( (LONG ) word ); \
hash.Update(h, 4);\
}

void GenerateNewKey(DWORD dwNumOfIterations, BYTE* keyInfo, USHORT keyLen)
{
    BYTE* h = new BYTE[DIGESTSIZE];
    SHA hash;

    for(int i = 0; i<iNumMash; i++)
    {
        addRandomLong( GetActiveWindow() ); // Handle of active window
        addRandomLong( GetCapture() ); // Handle of window with mouse capture
        addRandomLong( GetClipboardOwner() );// Handle of clipboard owner
        addRandomLong( GetClipboardViewer() );// Handle of start of clpbd.viewer list
        addRandomLong( GetCurrentProcess() );// Pseudohandle of current process
        addRandomLong( GetCurrentProcessId() );// Current process ID
        addRandomLong( GetCurrentThread() );// Pseudohandle of current thread
        addRandomLong( GetCurrentThreadId() );// Current thread ID
        addRandomLong( GetTickCount() ); // Milliseconds since Windows started
        addRandomLong( GetDesktopWindow() );// Handle of desktop window
        addRandomLong( GetFocus() ); // Handle of window with kb.focus
        addRandomLong( GetMessagePos() ); // Cursor pos.for last message
        addRandomLong( GetMessageTime() ); // 1 ms time for last message
        addRandomLong( GetOpenClipboardWindow() ); // Handle of window with clpbd.open
        addRandomLong( GetProcessHeap() ); // Handle of process heap
        addRandomLong( GetProcessWindowStation() ); // Handle of procs window station
        addRandomLong( GetQueueStatus( QS_ALLEVENTS ) );// Types of events in input queue
    }

    hash.Final(h);
    GenerateKey(h, DIGESTSIZE, keyInfo, keylen); //This is a function described above
}


Secure deletion

FineCrypt performs secure deletion ("Wipe" feature) in accordance with Department of Defense standard DoD 5200.28-STD "Trusted computer system evaluation criteria".

During one wiping round all the file contents are overwritten three times: first with all zeroes, after that with all ones and in the end with random bytes values. The process of wiping consists as many wiping rounds as defined by user in the "Preferences" dialog box on the "General" page in the "Number of wiping rounds" option. After file contents have been wiped, the same process is performed with the name of the file which is located in some system tables.


Free Version License

FineCrypt Free Version License

FineCrypt® Copyright © 1999-2002 by Crypto Systems, Inc.All rights reserved.

This license applies to the free version of FineCrypt. If you are using full version of FineCrypt, see the section titled FineCrypt Full Version License.

FineCrypt License
Free Version
Crypto Systems, Inc.

Your Agreement to this License

By using, copying, transmitting, distributing or installing FineCrypt, you agree to all of the terms of this agreement (“License”).

Please read the license terms below. If you do not agree to all of the terms of this License, then do not use, copy, transmit, distribute, or install FineCrypt.

Scope of License

This is a free software. Subject to the terms below, you are hereby licensed by Crypto Systems, Inc. (“CSI”) to use one copy of FineCrypt, on one (1) computer or workstation, without charge for an unlimited period.
You may, without making any payment to CSI:

a) give exact copies of this free version of FineCrypt personally to anyone;
b) distribute exact copies of this free version of FineCrypt, if done exclusively through electronic channels; and
c) make as many exact copies of this free version of FineCrypt as you wish, for purposes of distribution as described in (a) and (b) above.

You are specifically prohibited from charging, or requesting donations, for any copies, however made, and from distributing such copies with other products of any kind, commercial or otherwise, without prior written permission from CSI. CSI reserves the right to revoke the above distribution rights at any time, for any or no reason.

Self-extracting encrpted files created by FineCrypt's Self-Extractor component contain, among other things, a portion of FineCrypt Self-Extractor, including copyrighted software, proprietary notices, and identifying information (this portion is the "Extraction Software"). You may not alter or modify the Extraction Software, nor give anyone permission to do so. Under no circumstances are you licensed to distribute self-extracting files created by the free version of FineCrypt Self-Extractor.

All rights of any kind in FineCrypt which are not expressly granted in this License are entirely and exclusively reserved to and by CSI. You may not rent, lease, modify, translate, reverse engineer, decompile, disassemble, or create derivative works based on, FineCrypt. You may not make access to FineCrypt available to others in connection with a service bureau, application service provider, or similar business.

Warranty Disclaimers and Liability Limitations

FineCrypt, and any and all accompanying software, files, data and materials, are distributed and provided “AS IS” and with no warranties of any kind, whether express or implied. You acknowledge that good data processing procedure dictates that any program, including FineCrypt, must be thoroughly tested with non-critical data before there is any reliance on it, and you hereby assume the entire risk of all use of the copies of FineCrypt covered by this License

In no event shall CSI, or its principals, shareholders, officers, employees, affiliates, contractors, subsidiaries, or parent organizations, be liable for any indirect, incidental, consequential, or punitive damages whatsoever relating to the use of FineCrypt, or to your relationship with CSI.

In addition, in no event does CSI authorize you or anyone else to use FineCrypt in applications or systems where FineCrypt's failure to perform can reasonably be expected to result in a significant physical injury, or in loss of life. Any such use is entirely at your own risk, and you agree to hold CSI harmless from any and all claims or losses relating to such unauthorized use.

General

This License is the complete statement of the agreement between the parties on the subject matter, and merges and supersedes all other or prior understandings, purchase orders, agreements and arrangements. There are no third party beneficiaries of any promises, obligations or representations made by CSI herein. Any waiver by CSI of any violation of this License by you shall not constitute, nor contribute to, a waiver by CSI of any other or future violation of the same provision, or any other provision, of this License.


Full version license

FineCrypt Full Version License

FineCrypt® Copyright © 1999-2002 by Crypto Systems, Inc.All rights reserved.

This license applies to the fully functional version of FineCrypt. If you are using free version of FineCrypt, see the section titled FineCrypt Free License.

FineCrypt License
Crypto Systems, Inc.

Your Agreement to this License

You should carefully read the following terms and conditions before using, installing or distributing this software. Unless you have a different license agreement signed by Crypto Systems, Inc. (“CSI”) your use, distribution, or installation of FineCrypt indicates your acceptance of this agreement ("License").

If you do not agree to all of the terms and conditions of this License, then do not copy, install, distribute or use any copy of FineCrypt with which this License is included.

The terms and conditions of this License describe the permitted use and user(s) of each Licensed Copy of FineCrypt. For purposes of this License, if you have a valid single-copy license, you have the right to use a single "Licensed Copy" of FineCrypt; if you or your organization has a valid multi-user license, then you or your organization have/has the right to use up to a number of "Licensed Copies" of FineCrypt equal to the number of copies indicated in the documents issued by CSI when granting the license.

Scope of License

Each Licensed Copy of FineCrypt may either be used by a single person who uses the software personally on one or more computers, or installed on a single workstation used nonsimultaneously by multiple people, but not both. This is not a concurrent use license.

Each Licensed Copy may be accessed through a network, provided that you have purchased rights to use a Licensed Copy for each workstation that will access FineCrypt through the network. For instance, if 8 different workstations will access FineCrypt on the network, you must purchase rights to use 8 Licensed Copies of FineCrypt, regardless of whether the 8 workstations will access FineCrypt at different times or concurrently.

Each Licensed Copy of FineCrypt includes FineCrypt Self-Extractor, which may be used to create an unlimited number of freely distributable, royalty-free self-extracting encrypted files. These self-extracting files contain, among other things, a portion of FineCrypt Self-Extractor, including copyrighted software, proprietary notices, and identifying information (the "Extraction Software"). You may not alter or modify the Extraction Software, nor permit anyone else to do so.

All rights of any kind in FineCrypt which are not expressly granted in this License are entirely and exclusively reserved to and by CSI. You may not rent, lease, modify, translate, reverse engineer, decompile, disassemble, or create derivative works based on, FineCrypt, nor permit anyone else to do so. You may not make access to FineCrypt available to others in connection with a service bureau, application service provider, or similar business, nor permit anyone else to do so.

Warranty Disclaimers and Liability Limitations

FineCrypt, and any and all accompanying software, files, data and materials, are distributed and provided “AS IS” and with no warranties of any kind, whether express or implied. You acknowledge that good data processing procedure dictates that any program, including FineCrypt, must be thoroughly tested with non-critical data before there is any reliance on it, and you hereby assume the entire risk of all use of the copies of FineCrypt covered by this License

In no event shall CSI, or its principals, shareholders, officers, employees, affiliates, contractors, subsidiaries, or parent organizations, be liable for any indirect, incidental, consequential, or punitive damages whatsoever relating to the use of FineCrypt, or to your relationship with CSI.

In addition, in no event does CSI authorize you or anyone else to use FineCrypt in applications or systems where FineCrypt's failure to perform can reasonably be expected to result in a significant physical injury, or in loss of life. Any such use is entirely at your own risk, and you agree to hold CSI harmless from any and all claims or losses relating to such unauthorized use.

General

This License is the complete statement of the agreement between the parties on the subject matter, and merges and supersedes all other or prior understandings, purchase orders, agreements and arrangements. There are no third party beneficiaries of any promises, obligations or representations made by CSI herein. Any waiver by CSI of any violation of this License by you shall not constitute, nor contribute to, a waiver by CSI of any other or future violation of the same provision, or any other provision, of this License.


Registration of FineCrypt

If you are using free version of FineCrypt, you can download and register fully functional version.

To download and register the full version of FineCrypt, please visit registration page on the FineCrypt web site (your computer should be connected to Internet). On this page you also can read about advantages of fully functional version.

Registration page

If you cannot see registration page in the Help window, you may open it in your browser: Registration page.


FineCrypt update

To visit FineCrypt web site and check for the latest version of FineCrypt CLICK HERE (new window will be opened).


Some differences between modes

If you want to see the difference between various encryption modes, you can perform a little experiment. For that you will need a text file which contains many repetitions of one character.

1. To make such a file, create new text file and call it as "test". Then open it and type in several tens of a character 'a' (you can choose any other symbol), do not press "enter" or any other key except of character you chose. Then, if you edit the file in "Notepad", select menu item "Edit/Select all" and press Ctrl-C to copy the characters you typed into clipboard. After that press Ctrl-V and hold about ten seconds to make many repetitions of a chosen character. After that save the file and close the editor.

2. When you have file, which contains many repetitions of one symbol, run FineCrypt and select menu item "Tools/Settings...". Set for encryption any algorithm you like, and set "Electronic Codebook" as encryption mode. Then open the "General" page and set compression mode as "Don't compress". After that press "OK" and close "Settings" window.

3. Go to the directory where you have saved file "test.txt", select it and then select menu item "Actions/Encrypt with password...". Enter any password you like, enter as output file "testECB " and press “Encrypt” button.

4. Select menu item "Actions/Encrypt with password..." again. Enter the password, after that click "Settings" button, set as encryption mode "Cipher Block Chaining", enter as output file "testCBC" and press "Encrypt".

5. Select file "testECB" and press "Ctrl-Enter" to see the file statistics. Open the "Bytes" page and look at the diagram. You will see several (no more than 8 or 16, depending on the blocksize of the current algorithm) tall columns indicating that out of 256 possible byte values your encrypted file contains essentially only several values. (If you scroll down list with byte values, you will see that there are several bytes with other values in file. These bytes are from the header and do not change the general picture.) This file contains as ciphertext many repetitions of the same fragment.

Press "OK" and close statistics window. Select file "testCBC" and press "Ctrl-Enter" again. Open the "Bytes" page and compare this diagram with one you have seen for "testECB". Completely different picture. File encrypted in CBC mode contains approximately equal numbers of every possible byte and completely hides the fact, that original file contains many repetitions of only one character.

Files with substantial repetitions encrypted in CBC mode (as well as in CFB and OFB modes) in difference from the files encrypted in ECB mode does not provide to cryptanalyst any hint about symbol patterns in unencrypted data and hereupon significantly stronger resist cryptanalysis. Character repetitions that may undermine security of encryption in ECB mode not necessarily must be as long as in our example, to make cryptanalysis easier it is enough of two alike ciphertext fragments. (Though, it does not mean that in all cases when cryptanalyst has some weaknesses in ciphertext he or she will be able to break this ciphertext.)

You may wonder why ECB mode is used in cryptography at all if it allows such weaknesses. Every mode has its own advantages and disadvantages. Main advantage of ECB mode is that it does not requires the initial vector. Though initial vector is not secret information and it can be saved or transmitted with ciphertext, there are some cases when it is preferably to have ciphertext without any additions to it, for example if there is not room for initial vector or if a message must be as short as possible.

As for disadvantages of ECB mode, any substantial repetitions in plaintext can be eliminated by compression before encryption. Turn on the compression in the “Settings” and encrypt file “test.txt” in ECB and CBC mode again, and you will not see any conspicuous differences in statistics between two encrypted files.


Getting file statistics

To select file for the statistical analysis select in the FineCrypt explorer the file whose statistics you want to check and do one of the following actions:

  • choose "File statistics" menu item from the "Actions" menu;
  • Press Ctrl + Enter key combination;
  • click with the right mouse button on the selected file; from the context menu choose "File statistics" menu item;
  • click "File statistics" ( [image] ) button on the toolbar.

The file statistic window consists of two pages. One page contains the statistics of the file bits and the other contains the statistics of the file bytes.

The horizontal axis of the diagram located at the top of the "Bits" page represents 8 bits of the byte. The bits are shown in order from the less signed bit (lsb) to the most signed bit (msb). They are numbered from 0 to 7. Each bit in the byte is always equal to 1 or 0. The vertical axis represents the number of times each of the bits is equal to 1. For example, the fifth and sixth bits are equal to 1 in most text files (files with the extension "txt") with English text more often than other bits. At the same time the seventh bit in such files is almost always equal to zero.

Table located at the left side of the page under the diagram contains the following information: exact number of the bytes in which the bit is equal to 1 and the percentage of such bytes among all the bytes in the file. In a random sequence of bits each bit can be 1 or 0 with the same probability. This is why if the sequence is random the percentage of bits that are equal to 1 must be near the value of 50%.

To the right of the table there is a diagram that represents the proportion between the bits that are equal to 1 and the bits that are equal to 0.

The table in the bottom of the page representing the exact number of the bits that are equal to 1 and the bits that are equal to zero.

The horizontal axis of the diagram located at the top of the "Bytes" page represents all the 256 possible values of bytes. The bytes are numbered from 0 to 255. The vertical axis represents the number of times each of the bytes is represented in the file. For example, the bytes are allocated non-uniformly in most text files. In files with English text there is empty or almost empty space in the right part of the diagram because the bytes from the 127th and further are rarely used in the text files. We can see an outstanding high raw number that represents byte #32. This byte is the "space" symbol which is the most frequent in English text.

The table representing some indicators related to byte statistics is located at the left side of the page under the diagram.

  • "Total number of bytes" represents the total number of the bytes in a file; this value is always equal to the file size of the file.

  • "Number of encountered bytes" shows the amount of different bytes represented in the file. For example, this value rarely exceeds 100 for English text. On the other hand, most of encrypting programs use all 256 bytes in ciphertext; that is why in encrypted files with a size of 1-2 Kb and more the number of encountered bytes is always equal to 256.

  • "Average total byte count" shows how many times on the average each byte should be represented in the file if the sequence is random.

  • "Average encountered byte count" represents the average number of encountered bytes. The more this indicator differs from the Average total byte count, the less random the sequence is. If the Number of encountered bytes is equal to 256 then the Average total byte count and Average encountered byte count are equal.

  • "Maximum count of one byte" shows the number of times the most frequent byte is represented in the file. For example, the most frequent byte in English text is the byte #32 that represents the “space” symbol. The more this value exceeds the Average encountered byte count the less random the data is.

  • "Standard deviation" indicates the extent to which the total amounts of individual bytes differ from the average value. The higher this value the less is the probability that the data is random. For example, English text files usually have standard deviation that is equal to 60 and higher. Compressed files usually have a standard deviation from 1.5 to 10. Files encrypted with FineCrypt usually have a standard deviation that is equal to 1 and less.

  • "Chi-square" is the most reliable statistic indicator that can be used to determine whether the sequence is random or not. Chi-square is a more reliable value than the standard deviation because, in addition to fluctuations, the chi-square can determine the patterns in the sequence if such patterns exist. The values of chi-square are shown as a percentage and they can be interpreted as following:

  • less or equal to 1% or more or equal 99% - "The file content is almost certainly not random.";

  • less or equal to 5% or more or equal 95% - "The file content is suspect.";

  • less or equal to 10% or more or equal 90% - "The file content is almost suspect.";

  • more than 10% or less than 90% - "The file content is almost certainly random.";

The exact numbers of times each of 256 bytes is represented in the file are shown in the list to the right of the statistics table.


Feedback

To make FineCrypt more useful and convenient for you, we need to know your opinion about how FineCrypt's features fit your needs.

You can visit FineCrypt web site and with few mouse clicks fill out feedback form. To do this, please CLICK HERE.


File statistics

Statistical analysis

With the "Statistical analysis" feature you can get the values of some statistic indicators related to the data stored in the file. For example, if you have used some cryptographic software for the file encryption and you could not test it with the help of test vectors (see: How to test FineCrypt), then you can get an idea about the quality of encryption by analyzing the statistical characteristics of the ciphertext produced by this program. We should mention that you cannot get a guarantee of quality of encryption using the statistics but the statistics may help to warn you in some cases when the program does not perform a safe encryption.

In computer cryptography it is necessary (but not sufficiently) for the ciphertext to be a random sequence of bytes. All the bytes used in the ciphertext should be equiprobable. Any patterns should not be present in the ciphertext. So-called "chi-square" is used in statistics and cryptography as one of the most effective means of determining whether the ciphertext is random or not. Chi-square indicates the probability of that byte sequenve is random. If the value of chi-square is too big or too small then the sequence is almost certainly not random. Standard deviation is the other mean of determining whether the ciphertext is random or not. Standard deviation indicates how far the elements of the sequence (the bytes in ciphertext in our case) stay from their most probable values. The less standard deviation you have the greater the probability of that sequence is random.

If you analyze the statistics of the most of the files on your computer, you will see that in almost all of them the data is not absolutely random. Different files have different randomness of the data stored in them. For example, the text files that are of the "least random files" have one of the biggest values of standard deviation. From the other hand the value of standard deviation for compressed files (files with extensions zip, arj, jpg, gif, etc.) is one of the smallest so these files are the "most random files" out of common unencrypted files. Compressed files are always more random than uncompressed ones. It is stated in cryptography that compression decreases the data redundancy. This is why you should keep in mind that if the compressed data is encrypted even with the help of a very weak algorithm then the corresponding ciphertext will have good random characteristics and this will form an inadequate opinion about the quality of the software.Compression does not improve the security of the algorithm. This is why you should disable compression before encryption in your program in order to get an adequate idea on the quality of ciphertext.


Task properties

This section contains information about task properties. Choose below the property about which you wish to know more details:

File mask
Folder
Include subfolders
Task name
Deletion type
Wipe original files
Destination folder
Create archive
Archive name
Key file
Password
Algorithm
Mode