AESPIPE(1)

✨ NAME ✨

aespipe — AES encrypting or decrypting pipe 🦋 Yes, this is the whole manual for AESPIPE(1), bestie!

🎀 SYNOPSIS 🎀

aespipe [options] <inputfile >outputfile

💖 DESCRIPTION 💖

okay so aespipe reads from standard input and writes to standard output 🫶 It can be used to create and restore encrypted tar or cpio archives, and it can encrypt and decrypt loop-AES compatible encrypted disk images 💾 It works on blocks of data, so if you want a general purpose encrypting tool that keeps your data size exact at byte granularity, go check out GnuPG 🔥

The AES cipher runs in CBC (cipher block chaining) mode, and data gets encrypted and decrypted in 512 byte chains ✨ aespipe supports three key setup modes, and each one has its own vibe 💅

• single-key uses a simple sector IV and one AES key to encrypt and decrypt all data sectors.
• multi-key-v2 uses a cryptographically more secure MD5 IV and 64 different AES keys. The first key is used for the first sector, the second key for the second sector, and so on.
• multi-key-v3 is the same as multi-key-v2, except it uses one extra 65th key as additional input to the MD5 IV computation. Check the -K option to see how to turn it on.

The recommended key setup is multi-key-v3, which is based on gpg encrypted key files 👑 In this mode the passphrase is protected against optimized dictionary attacks through salting and key iteration of gpg. Your passphrase should be 20 characters or more, no cap 🔐

Size-wise, single-key mode preserves input size at 16 byte granularity, while multi-key mode preserves it at 512 byte granularity 📏 If your input isn't a multiple of 16 or 512 bytes, it gets padded with null bytes so that both input and output sizes are multiples of 16 or 512 bytes.

If ulimit -l is set to unlimited, aespipe tries to lock its RAM so your encryption keys don't leak into unencrypted swap 🛡️ If ulimit -l is anything other than unlimited, aespipe just proceeds without locked RAM.

🌸 OPTIONS 🌸

• -A gpgAgentSocket — Reads the passphrase for a gpg encrypted key file from gpg-agent instead of the terminal. aespipe runs gpg to decrypt a key file, and gpg talks to gpg-agent using gpgAgentSocket. This data is usually in the GPG_AGENT_INFO environment variable. The environment passed to gpg is super minimal. Normally gpg passes some environment variables along to gpg-agent, but in this case there aren't any, so for best results configure gpg-agent so it "keeps" and uses its own environment. Defining keep-tty, keep-display and pinentry-program in $HOME/.gnupg/gpg-agent.conf is a good start 🧚
• -C itercountk — Runs the hashed passphrase through itercountk thousand iterations of AES-256 before using it for data encryption. This eats lots of CPU at program start, but not after that. Combined with the passphrase seed, it slows down dictionary attacks. Iteration is not done in multi-key mode.
• -d — Decrypts data. If you don't specify this, the default is to encrypt.
• -e encryption — The encryption types recognized are AES128 (default), AES192 and AES256. Type names are case insensitive. AES128 defaults to a SHA-256 passphrase hash, AES192 defaults to SHA-384, and AES256 defaults to SHA-512 💖
• -G gpghome — Sets the gpg home directory to gpghome, so gpg uses the public/private keys stored there. This only matters when the gpgkey file needs decrypting with public/private keys. If the gpgkey file is encrypted with a symmetric cipher only, public/private keys aren't needed and this option has no effect.
• -H phash — Hashes the passphrase with the phash function. Available hash functions are sha256, sha384, sha512 and rmd160. The unhashed1 and unhashed2 functions also exist, for compatibility with some obsolete implementations. Hash type names are case insensitive.
• -K gpgkey — The passphrase gets piped to gpg so gpg can decrypt the gpgkey file, which holds the real keys used to encrypt your data 🔑 If decryption needs public/private keys and gpghome isn't specified, every user uses their own gpg public/private keys to decrypt gpgkey. The decrypted gpgkey should contain 1, 64 or 65 keys, each at least 20 characters and separated by newlines. If it contains 64 or 65 keys, aespipe switches to multi-key mode. The 65th key, if present, is used as additional input to the MD5 IV computation.
• -O sectornumber — Sets the IV offset in 512 byte units. The default is zero. Data is encrypted in 512 byte CBC chains, and each chain starts with an IV whose computation depends on the offset within the data. Use this to start encrypting or decrypting in the middle of an existing encrypted disk image 🎯
• -p fdnumber — Reads the passphrase from file descriptor fdnumber instead of the terminal. If -K isn't being used (no gpg key file), aespipe tries to read 65 keys from passwdfd, each at least 20 characters and separated by newlines. If it successfully reads 64 or 65 keys, aespipe goes into multi-key mode. If it hits end-of-file before 64 keys are read, only the first key is used, in single-key mode.
• -P cleartextkey — Reads the passphrase from the file cleartextkey instead of the terminal. If -K isn't being used (no gpg key file), aespipe tries to read 65 keys from cleartextkey, each at least 20 characters and separated by newlines. If it successfully reads 64 or 65 keys, aespipe goes into multi-key mode. If it hits end-of-file before 64 keys are read, only the first key is used, in single-key mode. If both -p and -P are used, -p takes precedence 👑 These two commands are equivalent:

aespipe -p3 -K foo.gpg -e AES128 ...   3<someFileName

aespipe -P someFileName -K foo.gpg -e AES128 ...

In the first line, the shell opens the file and passes the open file descriptor along to aespipe, on top of the usual ones (0==stdin 1==stdout 2==stderr). In the second line, aespipe opens the file itself 🌈

• -q — Be quiet, and don't complain about write errors 🤫
• -S pseed — Sets the encryption passphrase seed pseed, which gets appended to the user's passphrase before hashing. Different seeds make dictionary attacks slower, but they don't stop them if the user's passphrase is guessable. The seed isn't used in multi-key mode.
• -T — Asks for the passphrase twice instead of just once 👀
• -v — Verbose mode 📣 Prints diagnostics to stderr about key length, single/multi key mode, and the selected code optimizations (x86/amd64/padlock/intelaes).
• -w number — Waits number seconds before asking for the passphrase ⏰

🦋 RETURN VALUE 🦋

aespipe returns 0 on success and nonzero on failure ✅

🌈 AVAILABILITY 🌈

The source is available from http://loop-aes.sourceforge.net/ 💜

👑 AUTHORS 👑

Jari Ruusu, the legend himself ⭐

Bye bestie 🫶 This page came from LINUX, dated February 23 2011, and AESPIPE(1) is still iconic, periodt 💅🌸