Looking for Software that does "Part Oriented" Text File Encryption and/or Archive File Encryption

Question

I am looking for an existing tool, preferably Open Source, that encrypt different parts of a file (text file or archive like tar), with different keys recursively, etc.

I do not know of an existing term for this sort of thing, so I am coining the term "heterogenousy encrypted", or "heterocrypted". As in "recursively heterocrypted text files or archives".

Perhaps an example will help: Imagine an XML text file, that contains various accounts, passwords, notes, etc:

  <BUNDLE>
   <ACCOUNT>
      <HOSTNAME>crypto.stackexchane.com</HOSTNAME>
      <USERNAME>Alice.B.Cryplas</USENAME>
      <PASSWORD>restaurant</PASSWORD>
   </ACCOUNT>
   <ACCOUNT>
      <HOSTNAME>google.com</HOSTNAME>
      <USERNAME>Alice.B.Cryogenic</USENAME>
      <PASSWORD>anything</PASSWORD>
   </ACCOUNT>
  </BUNDLE>

Storing passwords is not the application I have in mind - or, at least, not the primary application I have in mind - but it motivates short examples.

I might want this entire text file to be encrypted:

 <ENCRYPTED>
    <CIPHERTEXT> 9877 5644 8787 ... </CIPHERTEXT>
    <AUTHENICATION>if you really want it</AUTHENTICATION>
  <ENCRYPTED>

I might want to decrypt the entire file.

I might want to decrypt the "top layer" of the file, so that I can see the hostnames and the usernames, but the password fields remain encrypted:

  <BUNDLE>
   <ACCOUNT>
      <HOSTNAME>crypto.stackexchane.com</HOSTNAME>
      <USERNAME>Alice.B.Cryplas</USENAME>
      <ENCRYPTED field="PASSWORD> 4334 8787 ... </ENCRYPTED>
   </ACCOUNT>
   <ACCOUNT>
      <HOSTNAME>google.com</HOSTNAME>
      <USERNAME>Alice.B.Cryogenic</USENAME>
      <ENCRYPTED field="PASSWORD> 8878 5454 2323 ... </ENCRYPTED>
   </ACCOUNT>
  </BUNDLE>

And so on.

Note: I do not mean simply a viewer, where the entire file is encrypted with a single key, and the viewer just chooses which fields to present.

I mean a file format, where each field, or at least certain subsets of fields, may be separately encrypted, with different keys. With a viewer and/or editor, that allows certain fields to be viewed and edited, without allowing access to the plaintext for other fields.

Although I have presented a simple XML file format as an example, this is isomorphic with archive files, like tar files, that may contain binary files as well as text files. (Isomorphic, since any hierarchical filesystem can be linearized as XML text.)

Note also that I would like support for recursion as well. I don't have a simple example at the moment, but in the archive file example you can imagine encrypting a file THIS, then encrypting the parent directory containing that file (PDIR, holding PDIR/THIS), then encrypting the grandparent directory containing that (GPDIR, containing GPDIR/PDIR, and GPDIR/PDIR/THIS), and so on.

(Interesting possibilities for non-hierarchical filesystems, e.g. hard links.)

Q: is there any reasonably well known XML text file format, archive format, or set of tools that accomplishes this?

---

Whether or not there is such an existing toolset, I am also pondering certain design considerations:

The big consideration is key management. We probably want several fields to be encrypted with the same key - e.g one key for all the passwords. In the terminology of non-cryptographic security, such a key would be a capability. Or, a key for all passwords, used to open a "dictionary" of keys for particular passwords.

Would you have such a key management system separate from the heterogenously encrypted file? Or could you store such an encrypted key dictionary encrypted under a master key inside the file itself? In which case, you might split programs that manipulate such a heterocrypted file into at least two parts - one part that manages the keys, small and limited so that you can formally prove it, and which supplies keys, as they are needed, to worker programs so that they can decrypt the fields and sections they need to do their work.

Would you mark the encrypted chunks with ID information that could be used by the key management system to figure out which keys are needed?

  <ENCRYPTED field="PASSWORD> 4334 8787 ... </ENCRYPTED>

Or should encrypted blobs be completely opaque?

Authenticated encryption? I assume encrypt-then-MAC (EtM). (Actually, I have a fondness for MtEtM, but that is probably another post.)

Should the blobs which are encrypted contain context information, so that an encrypted password blob, for example, cannot simply be moved from one account to a completely different account? If so, what should such context information consist of? In the password example, both the system name and the user name might change over time, and be changed by software that is not supposed to be able to access the encrypted password. I suspect that there might have to be a unique or nearly unique identifier associated with the record containing such a password blob, that is encrypted or at least authenticated with the password blob.

In general, are there ways of representing the files structural integrity, protecting against malicious field swapping, in ways that still allow editing and refactoring?

Is it safe to encrypt recursively? I know that I have seen papers that show repeatedly enciphering is not always a good thing, because of fixed points.

It is probably necessary to manage not just keys, but also salts or nonces for the encrypted blobs and sub-blobs.

I would love to have such a tool. I will probably enjoy writing such a tool. But of course, if it already exists, I would like to know.

---

My apologies if this topic is not so much cryptography, as it is about a cryptographic application. Although I suspect that it has some generic interest to cryptographic schemes, in much the same way that "tweaked cryptography" was created after work in encrypted filesystems and encrypted memory had begun.

Answer 1

What you're looking for sounds awfully specific... it's unlikely that something exists that will do exactly what you want out of the box. However, if you're willing to write some code, this might not be too hard.

While most encryption software is designed around the assumption that you're encrypting an entire file, as I recall gpg has built-in functionality to encrypt short strings of text. I believe the original idea was that it would be useful to, say, encrypt part of an email, but still have other parts in plain text (perhaps to explain to the person you're emailing how to decrypt it!)

So basically, you'd have to write a simple program that finds the parts of the XML document (or whatever) that you want to encrypt, and runs them through gpg.