0
$\begingroup$

in short I'm learning GUI programming in python and thought it could be interesting to make a small GUI for symmetric encryption. Not being mad/mathematical/experienced (take your pick) enough to try to implement ciphers myself I figured I could create a GUI that just sits on top of an existing program (on Linux). So I found gpg and mcrypt.

I have been googling like mad but finding very little information about mcrypt other than it is "a replacement for the old crypt program in Linux". Also mcrypt seems to list Rrijndael in stead of AES (so guessing it is the Rrijndael cipher rather than the AES implementation of it?)

Now, save that mcrypt has an implementation of Serpent and gpg comes with the ability to sign/verify the encrypted file, is there any great differences or advantages/disadvantages to one or the other? currently finding mcrypt fascinating.

Any thoughts would be appreciated.

Improve this question
$\endgroup$
1
  • $\begingroup$ I can't speak to mcrypt, but my suggestion would be to stick to gpg or openssl. If you want to get ideas of how someone else implemented the same thing, take a look at pyrite. $\endgroup$ – rsaw Aug 20 '14 at 21:14
1
$\begingroup$

GPG is an implementation of OpenPGP, which is a higher level protocol than e.g. mcrypt. So use GPG for PGP compatibility and mcrypt or related libraries for more direct - lower level - access to algorithms.

AES is Rijndael for a block size of 128 bits and the 128, 192 or 256 bit key sizes. So you are OK there. Learn about modes of operation and something about key management before creating the GUI. Possibly take a look at Password Based Key Derivation Functions such as PBKDF2 if you want to use a pass phrase.

Improve this answer
$\endgroup$
7
  • $\begingroup$ Note that the mcrypt C library has had little maintenance over the years although apparently the developers are planning a new release. $\endgroup$ – Maarten Bodewes♦ Aug 19 '14 at 6:50
  • $\begingroup$ Thank you for the answer and comment. At least I have a general idea for v0.1a of the GUI. What of using openssl for encryption? seems like that is a possibility as well. $\endgroup$ – Aaron W. Aug 19 '14 at 20:30
  • 1
    $\begingroup$ Certainly, you should in that case preferably use the EVP_ "higher" level API of OpenSSL. $\endgroup$ – Maarten Bodewes♦ Aug 19 '14 at 21:23
  • $\begingroup$ Hmm.. I've got a lot of reading and playing around to do. Just as a last question (not exactly related but if you feel like it): Do you know of any good security reviews of CAST256/CAST6? It just caught my eye (reading through ye olde AES selection documents). While rounds != security it did seem interesting that it uses even more rounds than serpent. Anyway, thank you again. $\endgroup$ – Aaron W. Aug 20 '14 at 15:23
  • $\begingroup$ Mainly my work focusses on AES (in all it's forms) and 3DES. Unfortunately I therefore don't know much about CAST. Serpent has a good rep. though (as does AES, of course). $\endgroup$ – Maarten Bodewes♦ Aug 20 '14 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.