<img width="150" align="right" src="./resources/enigma_efs_logo.png" alt_text="[https://www.flaticon.com/free-icon/folder_3500732](https://www.flaticon.com/free-icon/folder_3500732)"></img>

Enigma EFS

<p align="justify"><b>Enigma EFS</b> is a WPF MVVM application written in C# that simulates an Encrypted File System. The motivation behind this project was a better understanding of cryptography, different security protocols and encryption algorithms.</p>

Table of contents

• Enigma EFS
  • Table of contents
  • Acronyms
  • Name origin
  • Usage
    • Register
    • Login
      • Login attempt limit
      • Nuclear switch
    • Private key import
    • File import
    • Add folder
    • File export
    • Create and import a new .txt file
    • Remove file
    • File sharing
    • File unsharing
    • File updating
    • .txt file updating
    • File reading
    • Changing the Current Password
  • Database
  • Encrypted file
    • File encryption
    • File decryption
    • File naming
    • Enigma EFS Encrypted File Attribute Types
      • Layout of the Standard Information
      • Layout of the Security Descriptor
      • Layout of the Data
  • Algorithms
    • Symmetric algorithms
    • Asymmetric algorithm
    • Hashing algorithms
  • Username
  • Passwords and keys
    • Password guidelines
    • Password Entropy
    • Passphrase
    • Password protection and storage
      • Key stretching
    • RSA key encryption and hiding
      • Needle in a Haystack Steganography
        • Haystack structure
  • Certificate policies
  • Limitations and restrictions
  • Potential problems and known security and other bugs
  • To-Do List
  • References
    • Books
    • Links
    • Github projects

Acronyms

<table> <tr> <td>NIST</td> <td>National Institute of Standards and Technology</td> </tr> <tr> <td>SHA</td> <td>Secure Hash Algorithm</td> </tr> <tr> <td>KDF</td> <td>Key Derivation Function</td> </tr> </tr> <td>PBKDF2</td> <td>Password-Based KDF 2</td> </tr> <tr> <td>MAC</td> <td>Message Authentication Code</td> </tr> <tr> <td>HMAC</td> <td>Keyed-hash Message Authentication Code</td> </tr> <tr> <td>PRNG</td> <td>Pseudorandom Number Generator</td> </tr> <tr> <td>CSPRNG</td> <td>Cryptographically Secure PRNG</td> </tr> <tr> <td>ECB</td> <td>Electronic Codebook</td> </tr> <tr> <td>CBC</td> <td>Cipher Block Chaining</td> </tr> <tr> <td>CFB</td> <td>Cipher Feedback</td> </tr> <tr> <td>OFB</td> <td>Output Feedback</td> </tr> <tr> <td>IV</td> <td>Initialization Vector</td> </tr> <tr> <td>PKI</td> <td>Public Key Infrastructure</td> </tr> <tr> <td>PKIX</td> <td>Public Key Infrastructure X.509</td> </tr> <tr> <td>FS</td> <td>File System</td> </tr> <tr> <td>EFS</td> <td>Encrypted FS</td> </tr> <tr> <td>2FA</td> <td>Two-factor Authentication</td> </tr> <tr> <td>MFA</td> <td>Multi-factor authentication</td> </tr> <tr> <td>RSA</td> <td>Rivest-Shamir-Adleman algorithm</td> </tr> <tr> <td>AES</td> <td>Advanced Encryption Standard</td> </tr> <tr> <td>3DES</td> <td>Triple Data Encryption Standard</td> </tr> </table>

Name origin

<p align="justify">While learning about the history of cryptography and cryptanalysis, I've learned more about the <a href="https://en.wikipedia.org/wiki/Enigma_machine">Enigma machine</a> and <a href="https://en.wikipedia.org/wiki/Alan_Turing">Alan Turing</a>. Naturally, I choose to name this project Enigma and encrypted files have an extension <code>.at</code>.</p>

Usage

Register

<p align="justify">To use the application, a user first needs to register. The user needs to provide a unique <i>Username</i>, <i>Password</i> and his <i><a href="">X.509</a> Public Certificate</i>. The user's <i>Username</i>, hashed <i>Password</i> value and his public <a href="https://en.wikipedia.org/wiki/RSA_(cryptosystem)">RSA</a> key extracted from the provided certificate will be stored in Enigma's database.<br><br>When registering, the user has an option to have his password created for him. The passwords are generated by <a href="https://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator">CSPRNG</a> and are guaranteed to have high <a href="https://en.wikipedia.org/wiki/Password_strength#Entropy_as_a_measure_of_password_strength">entropy</a>. The user can also choose to use a random <a href="https://en.wikipedia.org/wiki/Passphrase">passphrase</a> generated by Enigma based on <a href="https://en.wikipedia.org/wiki/Diceware">Diceware</a>. </p>

NOTE:

No two users can have the same certificate.

Login

<p align="justify">To access <b>Enigmas EFS</b> a user needs to log in first. Login process is realized through <a href="https://en.wikipedia.org/wiki/Multi-factor_authentication">2FA</a>. At first, user only needs to provide his certificate (something only the user has). If the entered certificate exists in the Enigma's database, the user will be prompted to provide his <i>Username</i> and <i>Password</i> (something only the user knows). If the entered password matches the hash value stored for the current user in the database, the user's certificate will be subjected to different tests. When the given certificate matches the public key stored in the database, it is subjected to further verifications. At the end, if the login attempt is successful, the user is granted access to EFS.</p> <p align="center"><img src="./resources/successful-sign_in.gif?raw=true" width="450" title="successful sign in" align="centar" hspace="5" vspace="5">

Login attempt limit

<p align="justify">Every user has a total of three opportunities to enter his password. After three failed attempts, a "nuclear switch" is turned on and user's data is deleted. The emphasis is placed on security of data above anything else. User is prepared to lose his data forever if that means that the attacker won't get his hands on files.</p> <p align="center"><img src="./resources/unsuccessful-sign_in.gif?raw=true" width="450" title="failed login" align="centar" hspace="5" vspace="5">

Nuclear switch

<p align="justify">This functionality is implemented to add more security to user's files. In addition to deleting user files, user's account is locked, preventing him to log in to Enigmas EFS. Only an admin can unlock a user account. Unlocking process is followed with a mandatory user password change.</p>

Private key import

<p align="justify">If a user wants to access his files and use other <b>Enigma EFS</b> options, he needs to import his private RSA key first. If the key's password is correct, the user is granted access to EFS. With successful key import, the program's MFA is completed successfully.</p> <p align="center"><img src="./resources/successful-key-import.gif?raw=true" width="450" title="successful sign in" align="centar" hspace="5" vspace="5">

File import

<p align="justify">User can add files from FS to <b>Enigma EFS</b> by selecting a path to the original file, encryption and hashing algorithm. Files need to be added one at the time because batch import isn't supported. When adding a new file, the user can choose to either delete or keep the original file.</p> <p align="center"><img src="./resources/file-import.gif?raw=true" width="450" title="file import" align="centar" hspace="5" vspace="5">

Add folder

<p align="justify">User can add a new folder to EFS by entering the folder's name. Folder is added at the current path.</p> <p align="center"><img src="./resources/folder-create.gif?raw=true" width="450" title="add folder" align="centar" hspace="5" vspace="5">

File export

<p align="justify">User can export any file from his EFS to a selected location on FS.</p> <p align="center"><img src="./resources/file-export.gif?raw=true" width="450" title="file export" align="centar" hspace="5" vspace="5">

Create and import a new <code>.txt</code> file

<p align="justify">User can add simple <code>.txt</code> files to <b>Enigma EFS</b> by using a built-in application text editor.</p> <p align="center"><img src="./resources/txt-file-create.gif?raw=true" width="450" title="txt file create and import" align="centar" hspace="5" vspace="5">

Remove file

<p align="justify">Users can simply delete their files without any restrictions.</p> <p align="center"><img src="./resources/file-delete.gif?raw=true" width="450" title="file delete login" align="centar" hspace="5" vspace="5">

File sharing

<p align="justify">Every user can share their file with other users. For no other reason than simply wanting to put a limit, a user can share his files with up to three other users. When sharing a file with another user, the file's Key is encrypted using a shared user's