1

I know there are some standards for transferring data securely such as HTTPS for web applications, or SPC & SFTP for secure file transfers.

Encrypting files using PGP is a way to encrypt files during emails transfers.

I want to add a layer of security to my files which are going to be transported over SFTP/SCP and encrypt files before transferring them over SFTP/SCP.

As I understood using PGP for encrypting files is not safe enough (If I'm not mistaking). I want to know are there any standards for encrypting files which can be interchangeable among different systems and operating systems?

4
  • 9
    Where did you get the impression that PGP is not safe for encrypting files?
    – vidarlo
    Oct 2 at 9:32
  • 1
    Check out github.com/meixler/web-browser-based-public-key-encryption. You can use this to do public key (ECDH) encryption/decryption using a web page that runs in your browser. Full disclosure: I am the author.
    – mti2935
    Oct 2 at 10:25
  • 1
    There are many algorithms: AES, ChaCha20, ThreeFish and many others. Why don't you want to use one of them?
    – mentallurg
    Oct 2 at 20:15
  • "I want to add a layer of security to my files which are going to be transported over SFTP/SCP and encrypt files before transferring them over SFTP/SCP." - Why? What security do you expect to be able to add beyond what the SSH protocol - already used by SFTP/SCP - already provides? And how are you planning to exchange the encryption key securely?
    – CBHacking
    Nov 1 at 21:33
1

There are many encryption standards but currently AES is by far the most common, typically in two primary flavors AES-128 and AES-256.

Many software implementations use AES under the covers, including PGP/GPG.

Public key cryptography like PGP/GPG simply encrypts the AES key used underneath.

If you have no need for the Public/Private key sets, as in only you are encrypting and decrypting, you can stick with straight symmetric AES encryption. Common packages that support straight AES include PKzip and 7zip.

1

Email is unencrypted by default, so you need to encrypt the files before transmitting.

I want to add a layer of security to my files which are going to be transported over SFTP/SCP and encrypt files before transferring them over SFTP/SCP.

If you are concerned about the files during transmission, you don't need to. By definition, SCP and SFTP are secure, it's right in the name: Secure Copy and Secure FTP. It's the equivalent of encrypting a file before sending over HTTPS.

When you use SCP, your files will travel over an encrypted SSH tunnel, so nobody but the end server can decrypt the traffic and have access to the file. When you use SFTP, it's a HTTPS tunnel and the end result is the same.

That applies to data in transit. But if your goal is to protect data at rest, you have some options.

PGP/GnuPG is an option, but it's usually complex to setup correctly. OpenSSL is another option that I consider simpler than PGP/GnuPG. And depending on the application that will use those files, there are countless libraries for helping you encrypt and decrypt files.

Point to consider: encrypting files is a very easy task. The difficult task is Key Management, and that is the difference between secure file storage, and security theater. If you don't have proper key management, you may end up with a bank safe where the key is stored on the keyhole and the password is spray painted on the door.

0

It is common when exchanging sensitive data to encrypt the files before sending them whatever the exchange media.

But when it comes to security, the rule is do not roll your own. So the blessed way is to rely on a well known implementation of a good reputation algorithm. Except for trivially small files, the common use is to use a symetric encryption algorithm and either pass the key over a different channel, or if you know a public key of the recipient, encrypt only the symetric key with that public one (with an asymetric algorithm then). I do not use PGP/GPG but this can easily be done with OpenSSL so I am pretty sure that PGP/GPG can also do that. If you want a full package, Zed! is a good reputation tool able to manage encrypted containers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.