0

I have been trying to implement a high-volume symmetric (AES256) encryption/decryption pipeline for files on disk.

Originally, I tried to do this by having scripts call command-line tools such as gpg2, openssl, or mcrypt, but I found this approach unworkable. The root of the problem is that all these command-line tools impose too many restrictions on what the user can and cannot do. For example, openssl won't encrypt stdin; mcrypt won't allow one to specify the name of the encrypted file; gpg2 requires gpg-agent to run, etc., etc., etc.1

I also looked into Python's cryptographic libraries, but I read that they are not suitable if one needs to encrypt/decrypt very large files or if performance is important, both of which apply to my project.

So I think I'm going to have to bite the bullet and code this in C (at least as a C extension of Python).

For my needs, the ideal library would be one that had functions that took three arguments: an input stream, an output stream, and a key. They would then AES-256-{en,de}crypt the input stream using the key, and write the encrypted content to the output stream.

Can someone recommend a C library that has this sort of functionality, can be used safely by someone without much formal training in cryptography, and is under active development?

BTW, I did try libmcrypt but when I attempted, as a test, to compile the mcrypt utility from source, the resulting executable crashes with a malloc(): memory corruption error. I spent many hours trying to fix this without success. Then I looked for a developers' mailing list for the mcrypt project to post a question to, but it appears that the project is now defunct.

1 Please, do not address these issues in this question. I just wanted to provide a few examples of the issues I've run into; I've run into many more than these.

Improve this question
4
  • Is the library offering "AES-256" a hard requirement or does "secure symmetric encryption functionality" suffice? – SEJPM Feb 21 '19 at 21:14
  • I get that Python is relatively slow, but what have you read, and what libraries have you looked into? Generally, with Python you're encouraged to think not about "how efficient is this compared to expertly hand-tuned machine code?" but rather "is this fast enough?". Since it's usually easy to implement something with Python, you can try it and just see for yourself whether it's fast enough for your purposes. If it is, then great, you're done! The major Python cryptographic libraries (PyCryptodome and cryptography) both employ C already for the main bottlenecks. – John Y Feb 22 '19 at 15:12
  • Here's one which uses cryptography and sounds almost exactly like what you're looking for (in terms of functionality, if not necessarily speed). Please understand I am not trying to be dismissive of your question. You may well need a C-based solution. But it would be kind of silly not to at least try Python, just because you read something that said "Python will be too slow, don't bother". – John Y Feb 22 '19 at 15:22
  • @SEJPM: yes, the AES-256 requirement is a hard one. – kjo Feb 23 '19 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.