2 * tfcrypt -- high security Threefish encryption tool.
4 * tfcrypt is copyrighted:
5 * Copyright (C) 2012-2018 Andrey Rys. All rights reserved.
7 * tfcrypt is licensed to you under the terms of std. MIT/X11 license:
9 * Permission is hereby granted, free of charge, to any person obtaining
10 * a copy of this software and associated documentation files (the
11 * "Software"), to deal in the Software without restriction, including
12 * without limitation the rights to use, copy, modify, merge, publish,
13 * distribute, sublicense, and/or sell copies of the Software, and to
14 * permit persons to whom the Software is furnished to do so, subject to
15 * the following conditions:
17 * The above copyright notice and this permission notice shall be
18 * included in all copies or substantial portions of the Software.
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
21 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
22 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
23 * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
24 * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
25 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
26 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
31 void xerror(tfc_yesno noexit, tfc_yesno noerrno, tfc_yesno nostats, const char *fmt, ...)
40 if (statline_was_shown == YES && do_statline_dynamic == YES) tfc_esay("\n");
42 tfc_nfsay(stderr, "%s: ", progname);
43 tfc_vfsay(stderr, NO, fmt, ap);
44 if (errno && noerrno == NO) {
52 if (nostats == NO) print_crypt_status(-1);
63 void xexit(int status)
65 memset(srcblk, 0, sizeof(srcblk));
66 memset(dstblk, 0, sizeof(dstblk));
68 memset(key, 0, sizeof(key));
69 memset(ctr, 0, sizeof(ctr));
70 memset(mackey, 0, sizeof(mackey));
71 memset(xtskey, 0, sizeof(xtskey));
72 memset(&sk, 0, sizeof(struct skein));
73 memset(&tfe, 0, sizeof(struct tfe_stream));
77 memset(macvrfy, 0, sizeof(macvrfy));
78 memset(macresult, 0, sizeof(macresult));
80 memset(tmpdata, 0, sizeof(tmpdata));
81 memset(&getps, 0, sizeof(struct getpasswd_state));
82 memset(pwdask, 0, sizeof(pwdask));
83 memset(pwdagain, 0, sizeof(pwdagain));
90 tfc_yesno is_embedded_prog = NO;
93 tfc_say("tfcrypt toolkit, version %s.", _TFCRYPT_VERSION);
97 if ((strlen(progname) <= 9)
98 && ((!strcmp(progname, "sksum"))
99 || ((!memcmp(progname, "sk", 2))
100 && (!memcmp(progname+3, "sum", 3)
101 || !memcmp(progname+4, "sum", 3)
102 || !memcmp(progname+5, "sum", 3)
103 || !memcmp(progname+6, "sum", 3))))) {
104 is_embedded_prog = YES;
105 tfc_say("usage: %s [-AW] [-D BITS] [-n TURNS] [-l length] [-c <file>] [-U <file>] [source] ...", progname);
107 tfc_say("%s: calculate and print Skein hashsum of stream.", progname);
108 tfc_say(" -D BITS: specify bits as it was skBITSsum.");
109 tfc_say(" -n TURNS: number of turns to perform in Skein function.");
110 tfc_say(" sksum defaults to just one in all modes.");
111 tfc_say(" -A: format checksum in base64 rather than in binary hex.");
112 tfc_say(" -W: output raw binary checksum and remove filename(s) from output.");
113 tfc_say(" -H: output small hexdump (hex string and ASCII printable characters).");
114 tfc_say(" -l length: read only these first bytes of source.");
115 tfc_say(" -c <file>: read hashes list from file and check them.");
116 tfc_say(" -U <file>: read Skein MAC key from file.");
117 tfc_say("multiple sources can be given in cmdline, and if one of");
118 tfc_say("them is specified as \"-\", then reads are performed from stdin.");
121 else if (!strcmp(progname, "base64")) {
122 is_embedded_prog = YES;
123 tfc_say("usage: %s [-ed] [source] [output]", progname);
125 tfc_say("tfcrypt embedded base64 encoder/decoder.");
126 tfc_say(" -e: encode stream into base64.");
127 tfc_say(" -d: decode base64 stream.");
128 tfc_say("no error checking is performed.");
131 else if (!strcmp(progname, "tfbench")) {
132 is_embedded_prog = YES;
133 tfc_say("usage: %s seconds", progname);
134 tfc_say("do an in-memory random data benchmark of Threefish.");
138 if (is_embedded_prog) {
139 tfc_say("This program is physical part of tfcrypt toolkit.");
140 tfc_say("(see it's version with %s -V)", progname);
141 tfc_say("Please note that other tfcrypt options are either ignored there,");
142 tfc_say("or result of using them is undefined and it's not a bug.");
147 tfc_say("usage: %s [opts] [--] [key] [source] [output]", progname);
149 tfc_say("tfcrypt toolkit: encrypt streams with Threefish in CTR mode,");
150 tfc_say("calculate and check Skein hashsums, generate CSPRNG quality random data,");
151 tfc_say("convert encrypted data into ASCII format to ease transmission.");
153 tfc_say(" -e, -d: encrypt, decrypt (it maybe required).");
154 tfc_say(" -L <file>: load tfcrypt defsults from file.");
155 tfc_say(" defaults is text file which defines salt, nr_turns and default mode.");
156 tfc_say(" -s <file>: load tfcrypt salt from file.");
157 tfc_say(" -s disable: disable key salting at all.");
158 tfc_say(" -p: instead of using key, ask for password.");
159 tfc_say(" -k: use raw (%u byte) key instead of deriving it from arbitrary data.", TFC_U(TF_KEY_SIZE));
160 tfc_say(" -z: ask for key in plain C string form through password asker.");
161 tfc_say(" -x: ask for key in hex string form through password asker.");
162 tfc_say(" -K <file>: generate key from keyfile or password and write it to file.");
163 tfc_say(" -T: enable tfcrypt1 old mode (useful only for old encryptions).");
164 tfc_say(" -t <file>: use tweak from file (useful only for old encryptions).");
165 tfc_say(" -w: overwrite source file. If not file, ignored.");
166 tfc_say(" -n TURNS: number of turns to perform in Skein function.");
167 tfc_say(" Default is always defined when building tfcrypt.");
168 tfc_say(" -C mode: mode of operation: CTR, STREAM, XTS, ECB, CBC, OCB.");
169 tfc_say(" Default encryption mode can be changed when building tfcrypt.");
170 tfc_say(" -c opt: initial CTR value initialisation mode:");
171 tfc_say(" show: do default action, then dump CTR value to stderr,");
172 tfc_say(" head: when decrypting, read CTR from beginning of stream,");
173 tfc_say(" rand: generate random CTR and write it to beginning of stream,");
174 tfc_say(" <file>: read CTR from given file (both when encrypting/decrypting).");
175 tfc_say(" default is to derive CTR from user provided password or keyfile with");
176 tfc_say(" a single Skein function turn over derived, %u byte raw key", TFC_U(TF_KEY_SIZE));
177 tfc_say(" -q: always be quiet, never tell anything (except when signaled).");
178 tfc_say(" -v: print number of read and written encrypted bytes, and explain stages.");
179 tfc_say(" -V seconds: activate timer that will repeatedly print statistics to stderr.");
180 tfc_say(" -a: shortcut of -O xtime.");
181 tfc_say(" -r <file>: specify random source instead of /dev/urandom.");
182 tfc_say(" -R nr_bytes: generate nr_bytes of random bytes suitable for use as key data.");
183 tfc_say(" -R also supports these aliases specified instead of nr_bytes:");
184 tfc_say(" cbs: output fixed maximum crypt block size (%u bytes),", TFC_U(TF_BLOCK_SIZE));
185 tfc_say(" ks: output fixed maximum crypt key size (%u bytes)", TFC_U(TF_KEY_SIZE));
186 tfc_say(" xks: output fixed maximum crypt XTS key size (%u bytes)", TFC_U(TF_KEY_SIZE*2));
187 tfc_say(" iobs: output %s builtin block size TFC_BLKSIZE (%u bytes),", progname, TFC_U(TFC_BLKSIZE));
188 tfc_say(" if nr_bytes is not a valid number or alias, this string will be");
189 tfc_say(" used to attempt to open it as file, and examine it's size.");
190 tfc_say(" Then this examined size will be set as nr_bytes to output.");
191 tfc_say(" -Z nr_bytes: like -R, but emit zero stream instead of random.");
192 tfc_say(" -D MACBITS: specify bit width of a MAC signature.");
193 tfc_say(" -U key/pwd/<file>: read Skein MAC key from file.");
194 tfc_say(" key: use primary encryption rawkey as a MAC key.");
195 tfc_say(" pwd: ask for password string that will be used as MAC key.");
196 tfc_say(" -S MAC: append MAC signature to end of file:");
197 tfc_say(" MAC: embed MAC signature into file itself at the end,");
198 tfc_say(" <file>: write a detached MAC signature into separate <file>,");
199 tfc_say(" -: write a detached MAC signature to stdout.");
200 tfc_say(" useful only with variable length files! For block devices,");
201 tfc_say(" specify a separate file name to save signature to: -S file.");
202 tfc_say(" -A: format raw binary data, like MAC signature or Skein hash, in base64.");
203 tfc_say(" -W: output pure binary data, and disable any strings addition in Skein.");
204 tfc_say(" -H: output small hexdump (hex string and ASCII printable characters).");
205 tfc_say(" -M MAC: verify attached MAC signature when decrypting a file:");
206 tfc_say(" MAC: embed MAC signature into file itself at the end,");
207 tfc_say(" <file>: write a detached MAC signature into separate <file>,");
208 tfc_say(" -: read a detached MAC signature from stdin,");
209 tfc_say(" drop: do not verify attached MAC, if any, and drop it from output.");
210 tfc_say(" -m: just verify MAC provided with -M. Do not write output file.");
211 tfc_say(" This option must be specified after -M.");
212 tfc_say(" -E how: how to behave on I/O errors (both src or dst):");
213 tfc_say(" exit: print error if not quiet, then exit,");
214 tfc_say(" cont: print error if not quiet, then continue,");
215 tfc_say(" no action to pad missing data is attempted.");
216 tfc_say(" may be dangerous when working with block devices.");
217 tfc_say(" sync: print error if not quiet, then continue,");
218 tfc_say(" pad missing data block with zeroes.");
219 tfc_say(" lsync: same as sync, but does not use SEEK_SET logic,");
220 tfc_say(" lsync uses only relative seek operations, and does not prequery");
221 tfc_say(" the current file position for exact offsets, which maybe unsafe.");
222 tfc_say(" For this reason, it is HIGHLY recommended to use sync instead!");
223 tfc_say(" Note that both sync and lsync work only with read errors!");
224 tfc_say(" default error action is exit with printing status if not quiet.");
225 tfc_say(" -E xall: turn on error actions above for all errors, not just EIO errors.");
226 tfc_say(" -E xseek: ignore positioning and other seek related errors.");
227 tfc_say(" Multiple -E specifiers may be given in separate options.");
228 tfc_say(" -O opts: set options (comma separated list):");
229 tfc_say(" sync: request a synchronous I/O for a output,");
230 tfc_say(" fsync: on each write() call a corresponding fsync(fd),");
231 tfc_say(" trunc: open(O_WRONLY) will truncate output file to zero size.");
232 tfc_say(" pad: pad incomplete (l.t. %u bytes) block with zeroes.", TFC_U(TF_BLOCK_SIZE));
233 tfc_say(" xtime: copy timestamps from source to destination files.");
234 tfc_say(" gibsize: use SI units of size: 1k = 1000. Applies only to size prefixes.");
235 tfc_say(" Computers convention is to use 1024, whereas SI/hdd measure in 1000.");
236 tfc_say(" plainstats: force status line to be plain: no fancy dynamic stuff.");
237 tfc_say(" Dynamic line works well only on VT100 compatible ttys, and");
238 tfc_say(" when the whole status line width is smaller than tty width.");
239 tfc_say(" statless: emit less information in status line (only processed data).");
240 tfc_say(" norepeat: do not ask for any possible password confirmations.");
241 tfc_say(" prompt=str: set main password prompts to this string.");
242 tfc_say(" macprompt=str: set MAC password prompts to this string.");
243 tfc_say(" shorthex: with -H, do not print printable characters, dump only hex string.");
244 tfc_say(" iobs=val: set IO block size value. Must not exceed %u bytes.", TFC_U(TFC_BLKSIZE));
245 tfc_say(" xtsblocks=val: use these nr of TF blocks per XTS block. Default is %u.", TFC_U(TFC_XTSBLOCKS));
246 tfc_say(" iseek=val: seek source file/device by these val bytes.");
247 tfc_say(" Initial counter is adjusted automatically.");
248 tfc_say(" ixseek=val: rawseek source file/device by these val bytes.");
249 tfc_say(" Do not adjust initial counter automatically.");
250 tfc_say(" ictr=val: Increment initial counter by this val blocks.");
251 tfc_say(" The size of each block is %u bytes.", TFC_U(TF_BLOCK_SIZE));
252 tfc_say(" ictr option is valid only for CTR and CTR like modes.");
253 tfc_say(" ixctr=val: Increment initial counter by this val bytes.");
254 tfc_say(" Internally this number is translated into number of %u byte blocks.", TFC_U(TF_BLOCK_SIZE));
255 tfc_say(" oseek=val: seek destination file/device by these val bytes.");
256 tfc_say(" count=val: process only these val bytes, both input and output.");
257 tfc_say(" xkey=val: take only val bytes from user keyfile.");
258 tfc_say(" okey=val: seek the key before reading it (usually a device).");
259 tfc_say(" xctr=val: specify size in bytes of initial counter prepended or read.");
260 tfc_say(" -P: plain IO mode: disable encryption/decryption code at all.");
262 tfc_say("Default is to ask for password, then encrypt stdin into stdout.");
263 tfc_say("Some cmdline parameters may be mutually exclusive, or they can");
264 tfc_say("generate errors or behave abnormally. Please understand that some");
265 tfc_say("dumb mode error checking may be not performed well, and please read");
266 tfc_say("the README included within package and this help text carefully.");