fernetrest 🔐

fernetrest is a Python package and CLI utility designed to provide secure, authenticated symmetric file encryption for Data at Rest using Fernet (AES-128-CBC + HMAC-SHA256) and key derivation via PBKDF2-HMAC-SHA256.

🛡️ Security Architecture

1. Key Derivation (PBKDF2-HMAC-SHA256):
   • Passwords are never used directly as cipher keys.
   • A unique 16-byte cryptographically random salt (os.urandom(16)) is generated per encryption to defeat rainbow table attacks.
   • 600,000 iterations of PBKDF2 stretch the password, mitigating brute-force and GPU dictionary attacks.
2. Authenticated Symmetric Encryption (Fernet):
   • Confidentiality: AES-128 in CBC mode with PKCS7 padding.
   • Integrity & Authenticity: HMAC-SHA256 signatures guarantee that files cannot be modified or tampered with without immediate detection upon decryption.
3. Format:
   • Output files (.enc) prepend the 16-byte salt directly to the Fernet ciphertext:

     ┌──────────────────────┬──────────────────────────────────────────┐
     │ Salt (First 16 Bytes)│ Ciphertext / Encrypted Content (Fernet)  │
     └──────────────────────┴──────────────────────────────────────────┘
     

🚀 Installation

pip install fernetrest

💻 CLI Usage

Once installed, you can use fernetrest directly from your command line!

1. Interactive Menu

Simply run:

fernetrest

2. Command Line Arguments

# Encrypt a file (prompts securely for password without echoing)
fernetrest encrypt secret_doc.pdf

# Specify custom output destination
fernetrest encrypt secret_doc.pdf -o /path/to/backup.enc

# Decrypt a file
fernetrest decrypt secret_doc.pdf.enc

# Specify custom decrypted output
fernetrest decrypt secret_doc.pdf.enc -o restored_doc.pdf

🐍 Python Library Usage

You can also use fernetrest inside your own Python projects:

from fernetrest import encrypt_file, decrypt_file

# Encrypt a document or media file
encrypted_path = encrypt_file("confidential.txt", password="MySecretPassword123")
print(f"Encrypted file saved to: {encrypted_path}")

# Decrypt the file
original_path = decrypt_file("confidential.txt.enc", password="MySecretPassword123")
print(f"Decrypted file restored to: {original_path}")

📄 License

This project is licensed under the MIT License.