1

What would be a recommended library to use for file encryption in C++?

I am looking for a standard up-to-date data encryption.
The file-encryption will be based on a password.
Searching the web I came across OpenSSL, Crtypto++, libsodium and Botan.

I started with Crypto++ but I found the code-style to be non-conventional.
Also did not find many examples or proper documentation on the API.

What I am looking for:

  1. Strong and up-to-date encryption over a file, or memory,
  2. Well documented API with examples,
  3. OS requirements for me is Windows

Many thanks for any tip

1
  • 1
    libsodium has all the components you need, and (on modern hardware) is fast for the AES-GCM part: random number generation for secure nonce, password hashing for key derivation from password, authenticated encryption. You still need to put those parts together securely, add signing if necessary, decide what to authenticate (perhaps the file name) - to build a secure system. Also consider docs.aws.amazon.com/encryption-sdk/latest/developer-guide/… for a more ready-built, well-designed, heavily-tested solution, though you are still left with the derivation of key from pwd Jul 6, 2022 at 13:02

1 Answer 1

2

libsodium has all the components you need, and (on modern hardware) is fast for the AES-GCM part: random number generation for secure nonce, password hashing for key derivation from password, authenticated encryption.

You still need to put those parts together securely, add signing if necessary, decide what to authenticate (perhaps the file name) - to build a secure system.

If you are looking for a library that does almost all of that in a library available in multiple languages, consider the AWS Encryption SDK which is available in C. It's well-designed and heavily-tested, and handles key derivation and commitment, signing (optionally), nonce creation, etc.

You'd still be left with deriving the initial 256 bit raw AES key from your password (plus a salt that you would need to store somewhere), for which you could use libsodium. Use that derived key in the Raw AES Keyring.

One nice feature is the ability to encrypt a plaintext under multiple keys, which means you can encrypt using the normal key plus an emergency RSA public key. In the event the original password-derived key is lost, you can still decrypt the ciphertexts using the RSA private key (that you kept safe somewhere).

1
  • I done some reading on this library now and it definitely sounds like a great choice. Well documented and gives you best options by default. Thanks for the tip!
    – PazO
    Jul 6, 2022 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.