Library for random access I/O on an counter mode block encrypted file, with 3DES and AES implementations.
The CryptKeeper class provides an interface and framework for random access file I/O to encrypted files. The files are in counter mode with a randomly generated nonce, which means that each block of data is XORed with a unique value based on the file offset before being encrypted. This results in a file where each block can encrypted and decrypted without encrypting previous blocks (as would be needed on CBC mode), but still produces a file where identical input blocks produce different output blocks (unlike ECB mode). There is also a test main that creates a test file and performs various read, write, and append operations on that file to ensure that the I/O works correctly. The file is provided with a header that stores the program name, version number (1.0 is 3DES mode, 1.1 is AES), the size of the raw data, the key check value (KCV), and the random nonce generated when the file was created.
The class is implemented as an abstract base class which will handle block cipers of different block lengths. The nonce is generated one block wide. Before XORing with the data, the least significant bytes of the nonce are replaced with the block number. The user can read and write any number of bytes at any location in the file; the class takes care of determining which blocks are affected, reads and decrypts any existing data, reads or writes only the modified bytes, then re-encrypts and writes any altered blocks to the file.
Implementations are provided for 3DES, using an 8 byte block size, and AES, using a 16 byte block size. It is up to the user to provide correct keys; DES keys can be 8, 16, or 24 bytes long (24 is recommended, and provides the minimum NIST recommended 112 bits of effective security), while AES keys can be 16, 24, or 256 bits long (providing 128, 192, and 256 bits of effective security). Keys are provided to the class as hexadecimal strings; 3DES keys ignore the parity bits. Remember that the files will only be as secure as your keys. A strong password, salted and hashed, can be used as a key, or the keys can be stored in secure storage, such as a hardware security module.