PrivaCrypt

A secure hybrid file encryption system built in Python using AES-256-GCM and RSA-2048 OAEP, featuring a full desktop GUI, integrity verification, secure deletion, and RAM-only decryption.

---

Overview

PrivaCrypt is a desktop-based encryption system designed to securely encrypt and decrypt files using a hybrid cryptographic model. It combines:

• AES-256-GCM for fast symmetric encryption of file data
• RSA-2048 OAEP for secure key exchange
• SHA-256 for integrity verification

The application is built with a modular architecture separating cryptographic logic (backend) from the graphical interface (Tkinter frontend).

---

Key Features

🔐 Encryption & Decryption

• Encrypt any file format using AES-256-GCM
• Secure AES key wrapping using RSA-2048 OAEP
• Decrypt .vault files with password-protected private keys

📦 Batch Processing

• Encrypt multiple files or entire directories
• Recursive folder support with configurable depth
• Progress tracking with real-time logs

🧠 RAM-Only Decryption

• Decrypt files directly into memory
• Prevents plaintext from being written to disk
• Secure buffer discard after use

🧪 Integrity Verification

• SHA-256 hash validation
• AES-GCM authentication tag verification
• Detects any tampering or corruption

🗑 Secure Deletion

• 3-pass overwrite mechanism using random data
• Reduces forensic recovery risk (HDD optimized)

📜 History Logging

• Tracks all operations (encrypt, decrypt, delete, verify)
• Stored in structured JSON logs

🔑 Key Management

• RSA-2048 key pair generation
• Private key encrypted with AES-256-CBC password protection
• Enforces 365-day key rotation policy (NIST SP 800-57 aligned)

---

System Architecture

Backend

Handles all cryptographic operations:

• AES / RSA encryption & decryption
• Key generation and storage
• File parsing and .vault construction
• Integrity verification
• Secure deletion logic

Frontend (Tkinter GUI)

Provides user interaction layer:

• Multi-tab interface (Lock, Unlock, Batch, Integrity, Keys)
• Drag-and-drop file support
• Progress bars and live logs
• Password-protected dialogs

---

Cryptographic Design

Hybrid Encryption Flow

1. Generate random 256-bit AES session key
2. Encrypt file using AES-256-GCM
3. Encrypt AES key using RSA-2048 OAEP
4. Store all components inside .vault file

---

AES-256-GCM

• Mode: Authenticated Encryption (AEAD)
• 12-byte nonce per file
• 16-byte authentication tag
• Ensures confidentiality + integrity

---

RSA-2048 OAEP

• Public-key encryption for AES key wrapping
• OAEP padding with SHA-256
• Resistant to chosen ciphertext attacks

---

SHA-256 Integrity Layer

• Stored plaintext hash before encryption
• Verified after decryption
• Adds second independent integrity check

---

.vault File Format

Each encrypted file is stored as a self-contained binary archive:

Field	Size	Description
Magic Header	8 bytes	File identifier (VAULT002)
Timestamp	19 bytes	Encryption time
RSA Key Length	4 bytes	AES key size indicator
Encrypted AES Key	variable	RSA-OAEP ciphertext
Nonce	12 bytes	AES-GCM nonce
Filename Length	4 bytes	Original filename size
Filename	variable	UTF-8 encoded
SHA-256 Digest	64 bytes	Integrity hash
Ciphertext	variable	Encrypted file data

---

Key Management Policy

• RSA key rotation enforced every 365 days
• Based on NIST SP 800-57 recommendations
• Expired keys block encryption only (decryption remains allowed)
• Key metadata stored in vault_keyinfo.json

---

Secure Deletion

Implements a 3-pass overwrite strategy:

1. Overwrite file with random data
2. Flush buffers (fsync)
3. Remove file from filesystem

⚠️ Note: SSDs may bypass overwrite due to wear-leveling. Full-disk encryption is recommended for SSD environments.

---

Threading Model

• All encryption/decryption operations run in background threads
• GUI remains responsive during heavy computation
• Safe UI updates via Tkinter after() mechanism

---

Dependencies

Package	Purpose
cryptography	AES & RSA cryptographic operations
tkinter	GUI framework (standard library)
tkinterdnd2	Drag-and-drop support

---

Two-Machine Security Model

Machine A (Sender)

• Uses recipient’s public key
• Encrypts file into .vault
• Sends encrypted file only

Machine B (Receiver)

• Holds private key securely
• Decrypts .vault file locally
• Private key never leaves device

This mirrors real-world systems like PGP and TLS.

---

Security Principles Implemented

• Hybrid encryption (AES + RSA)
• Authenticated encryption (GCM mode)
• Password-protected private keys
• Integrity verification (SHA-256 + GCM tag)
• Key lifecycle enforcement
• Secure deletion mechanisms
• RAM-only sensitive data handling

---