Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there some way to add files to an encrypted archive without providing the password for that archive?

For example, if you are using dropbox which has a TrueCrypt encrypted file on it, it is easy to use TrueCrypt in portable mode to mount that file and then add to it. But if you are working on a computer that is not fully trusted, that involves not just entering the password but actually permitting that computer at least temporary access to the unencrypted archive. That may not be desirable, but you may need to add files to that archive from the not fully trusted computer.

My suspicion is that not only is there no current way to do this, but that there can be no way of doing it, but I would like to know if I am missing something.

share|improve this question
No you are not missing anything. It might be more useful for you to ask for a solution to your problem, instead of asking for confirmation of what you already knew. But the only way to be 99.99% sure is to boot the insecure computer from a live-cd or from a USB. – Nifle Dec 21 '11 at 22:36
The last 0.01% is that nagging worry that they have a hardware-key-logger installed. – Nifle Dec 21 '11 at 22:40
@iglvzx Ironically, while I suspect its impossible digitally, I think you could do it physically. Just look at package drops in a post office. It is easy to deposit a package, but hard to retrieve one without going through the locked door to the area it deposits into. Of course, on a high security safe, adding such an entry may make it less secure than otherwise, but properly designed it could still provide a reasonable amount of security. – TimothyAWiseman Dec 21 '11 at 23:04
@iglvzx: The solution is, of course, to invent a one-way wall. – grawity Dec 21 '11 at 23:06
@TimothyAWiseman good analogy, look at the safe in a convience store, things go in , and it is VERY secure still. – Psycogeek Dec 21 '11 at 23:13
up vote 4 down vote accepted

With traditional symmetric encryption, this is impossible – you need to encrypt a file with exactly the same key it'll be decrypted with.

What you're looking for is asymmetric, or "public-key based" cryptography, as used in PGP and SSL. In asymmetric algorithms, you have a pair of keys, one for encryption (public), other for decryption (private). The encryption key can be made publicly available and anyone could use it. (It's how HTTPS works, by the way.)

Unfortunately, I'm not aware of any "archive"/"container"-type programs that work this way, mostly because it's somewhat tricky to create append-only archives reliably – either you have to store the metadata unencrypted, or you run into serious data corruption risks. However, it works well if you only have one output file per input, such as...

...One possibility is to install portable GnuPG, a free PGP implementation, and write a script to automatically encrypt files into a "temporary" folder. Later at a secure location, you could decrypt these files with GnuPG again and move them into your TrueCrypt container.

For example, this .cmd script would encrypt all files drag-and-dropped on it:

@echo off & setlocal
:: I assumed a USB stick, so here %~d0 will expand to the drive letter.
:: Where this script looks for GnuPG
set GNUPGDIR=%~d0\Apps\GnuPG
:: Where GnuPG looks for its keyrings
set GNUPGHOME=%~d0\Private\GnuPG
:: Where the encrypted files are put
set DESTDIR=%~d0\Private\Encrypted
:: Your PGP key ID or email

if not exist "%DESTDIR%" mkdir "%DESTDIR%"
    if "%~1"=="" goto :eof
    echo Encrypting "%~1"
    "%GNUPGDIR%\gpg" -r "%RECIPIENT%" -e -o "%DESTDIR%\%~nx1.gpg" "%~1"
    goto :loop
share|improve this answer
I should have thought of it, since I have in the past used GnuPG for e-mail, it just didn't occur to me for this purpose. It isn't exactly what I hoped for, but it is good enough for all practical purposes since it lets me encrypt without ever exposing the decryption key or other encrypted contents. Thank you! – TimothyAWiseman Dec 21 '11 at 23:09
So, if you were to only use TrueCrypt, you would simply create a new encrypted volume. Then, later (after decrypting both volumes) move the contents of the new volume to the old volume? – iglvzx Dec 21 '11 at 23:34
I don't think that would achieve the entire goal. I would still have to type my decryption password (meant to be secret) into the partially trusted machine (say the ones in the computer lab at the university). With GnuPG and Gravvity's excellent script, I need only reveal a public password that I could freely distribute to everyone in the world. – TimothyAWiseman Dec 21 '11 at 23:47

In case you don't want to set gpg infrastructure, and just want to encrypt file using public/private key pair, the following tool could be of use: . You will need mono on linux to run it.

It will use AES256 to encrypt file, and the key will be encrypted using 4096 bit RSA.

I wrote this tool, and it is specifically for the type of case you described: when you need something to encrypt files and be unable to decrypt it back.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .