encryptFile

#!/bin/bash

# See also decryptFile

# SETUP --------------------------------------------------------------

ENCKEY=''
KDF='pbkdf2'
ITER='5555555' # iterations for key derivation # ~6 seconds @ Intel(R) Xeon(R) CPU E3-1230 v3 @ 3.30GHz
CIPHER='aes-256-cbc'
DIGEST='sha256'

# --------------------------------------------------------------------

set -ueo pipefail

SUFFIX=".$KDF.$ITER.$CIPHER.$DIGEST.enc"

# pv
BLOCKSIZE=16

if [ $# -lt 1 ]; then
	APP=${0##*/}
	echo "Encrypt a file."
	echo
	echo "KDF:         $KDF"
	echo "Iterations:  $ITER"
	echo "Cipher:      $CIPHER"
	echo "Digest:      $DIGEST"
	echo
	echo "Usage: $APP <input> [<output>]"
	echo
	echo "If <output> is - then output is redirected to STDOUT"
	echo "If <output> is empty '$SUFFIX' is appended to input file name"
	echo
	exit 1
fi >&2

if [ ! -e "$1" ]; then # -f does not catch FIFOs
	echo -e "Error: File '$1' not found.\n" >&2
	exit 1
fi

checkBinarys() {
	#http://stackoverflow.com/a/677212/568737
	BINS=("$@")
	for BIN in "${BINS[@]}"; do
		hash "$BIN" 2>/dev/null || {
			echo -e "Error: Binary '$BIN' is missing.\n" >&2
			exit 1
		}
	done
}

# Check if all needed binarys are present
checkBinarys "openssl" "pv" "stat"

if [ -z "${ENCKEY:-}" ]; then
	read -r -s -p "Enter password: " ENCKEY
	echo
	[ -z "$ENCKEY" ] && echo && exit 1
	read -r -s -p "Repeat password: " ENCKEY2
	echo
	if [ "$ENCKEY" != "$ENCKEY2" ]; then
		echo
		echo "Error: Passwords not matching."
		echo
		exit 1
	fi >&2
fi

CMD=("openssl" "$CIPHER" "-salt" "-$KDF" "-iter" "$ITER" "-md" "$DIGEST" "-k" "$ENCKEY" "-in" "$1")

if [ "${2:-}" == "-" ]; then
	# STDOUT
	echo "Encrypting: $1" >&2
	"${CMD[@]}"
else
	# OUTPUT to FILE
	[ -z "${2:-}" ] && set "$1" "$1$SUFFIX"
	# TODO Check if destination file already exist
	echo "Encrypting: $1 --> $2"
	"${CMD[@]}" | pv -bper -s $(( ($(stat -c%s "$1") + BLOCKSIZE) / BLOCKSIZE * BLOCKSIZE + BLOCKSIZE)) > "$2"
	echo
fi