Transcrypt

Abstract

1. Introduction

transcrypt is in the same vein as existing projects like git-crypt and git-encrypt, which follow Git's documentation regarding the use of clean/smudge filters for encryption. In comparison to those other projects, transcrypt makes substantial improvements in the areas of usability and safety.

transcrypt protects your data when it's pushed to remotes that you may not directly control (e.g., GitHub, Dropbox clones, etc.), while still allowing you to work normally on your local working copy. You can conveniently store things like passwords and private keys within your repository and not have to share them with your entire team or complicate your workflow.

The _decryption -> encryption_ process on an unchanged file must be deterministic for everything to work transparently. To do that, the same salt must be used each time we encrypt the same file. Rather than use a static salt common to all files, transcrypt first has OpenSSL generate an HMAC-SHA256 cryptographic hash-based message authentication code for each decrypted file (keyed with a combination of the filename and transcrypt password), and then uses the last 16 bytes of that HMAC for the file's unique salt. When the content of the file changes, so does the salt. Since an HMAC has been proven to be a PRF, this method of salt selection does not leak information about the original contents, but is still deterministic.

2. Objective

transparently encrypt files within a git repository

This project demonstrates how Shell can be applied to a real-world Cybersecurity & Ethical Hacking problem.

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Linux / macOS terminal or WSL on Windows
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/elasticdog/transcrypt.git
cd transcrypt

1. column command (on Ubuntu/Debian install bsdmainutils)
2. if using OpenSSL 3+ one of: xxd (on Ubuntu/Debian is included with vim)
3. GnuPG - for secure configuration import/export
4. Arch Linux
5. Heroku (via Buildpacks)
6. OS X (via Homebrew)

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by elasticdog and published on GitHub under the MIT License. Please follow the license terms and credit the original author when you use or modify this code.