diff --git a/README.md b/README.md index 21ea0d9..444e423 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,8 @@ Why should you use Picocrypt, instead of Bitlocker, NordLocker, VeraCrypt, or 7-
  • Picocrypt is portable and tiny (just 3MB!). It's much lighter than NordLocker (>100MB) and VeraCrypt (>30MB). The raw Python file can run any machine and the standalone .exe can run on any Windows PC from 7 and up. Picocrypt floats your boat without any bloat.
  • It's infinitely easier to use than VeraCrypt (no need to create volumes) and a 5-year-old could probably use Picocrypt. All you need to do is select a file and enter a password.
  • Picocrypt is built for security, using modern standards and secure settings. See Security below for more info.
  • -
  • It supports file integrity checking through Poly1305, which means that you would know if a hacker has maliciously modified your data.
  • +
  • It supports file integrity checking through Poly1305, which means that you would know if a hacker has maliciously modified your data. This is useful for transfering sensitive data where authenticity is crucial.
  • +
  • Picocrypt supports anti-corruption through Reed-Solomon. Unlike other encryption tools, Picocrypt can actively protect your files by adding extra Reed-Solomon bytes, so if your file gets corrupted (ie. hard drive failure), Picocrypt can still fix the errors and decrypt your files. None of Bitlocker, NordLocker, VeraCrypt, or 7-Zip has this ability.
  • # Instructions @@ -27,7 +28,7 @@ Picocrypt is about as simple as it gets. Just select a file, enter a password, a @@ -54,12 +55,15 @@ I did not write the crypto for Picocrypt. Picocrypt uses two Python libraries, <
  • If decrypting, compare the derived key with the SHA3-512 hash of the correct key stored in the ciphertext. If encrypting, compute the SHA3-512 of the derived key and add to ciphertext.
  • Encryption/decryption start, reading in 1MB chunks at a time. For each chunk, it is first encrypted by XChaCha20, and then a CRC (using SHA3-512) is updated.
  • +
  • If anti-corruption is checked, the 1MB chunk will be split into 128 byte chunks and 13 additional Reed-Solomon (parity) bytes will be added. If decrypting, decode the encoded 1MB chunk to get the raw data.
  • If 'Secure wipe' is enabled, CSPRNG data is written over the original file in chunks of 1MB to securely wipe the file.
  • When encryption/decryption is finished, the MAC tag (Poly1305) will be added to the ciphertext or verified, depending on if you're encrypting or decrypting. If 'Secure wipe' is enabled, the original file is deleted.
  • Similar to above, the CRC is either checked or added to the ciphertext depending on the operation.
  • -
  • If decrypting, both the CRC and the MAC tag are securely verified using constant-time comparison. If either don't match, decryption is unsuccessful and an error message will be displayed. Otherwise, decryption is considered successful and the process is done.
  • +
  • If decrypting, both the CRC and the MAC tag are verified. If either don't match, decryption is unsuccessful and an error message will be displayed. Otherwise, decryption is considered successful and the process is done.
  • +Note: the list above is heavily simplified. A lot more is actually happening. + # Limitations