ClatsGuard Heavy

Changelog

v1.03 Latest Release

The release of ClatsGuard Heavy was a huge step forward in file encryption. However, I improved upon it, and now we have version 1.03.

Security Enhancements

• Deterministic Nonces for ChaCha20

  • Replaced random secrets.token_bytes() nonces with a deterministic per-segment counter (_nonce_for_chacha(seg_index)) to eliminate risks of nonce reuse.

• Secure File Deletion

  • Introduced _secure_delete which overwrites files with random data before removal, reducing recovery risk compared to plain os.remove().
  • Integrated _secure_delete into the "Delete after encryption" option.

• Tighter AES-GCM-SIV Validation

  • Refined ciphertext length validation during decryption from CHUNK_SIZE + TAG_LENGTH + NONCE_LENGTH down to CHUNK_SIZE + TAG_LENGTH, preventing acceptance of malformed segments.

User Experience Improvements

• Weak Passphrase Warning
  • Added a prompt when a passphrase shorter than 10 characters is entered, warning the user and requiring confirmation to proceed.

Additional Changes

• Added _nonce_for_chacha utility for deterministic nonce derivation.
• Added _secure_delete utility for secure file wiping.

ClatsGuard-Heavy

CHANGELOG

This release is a major step forward in protecting your most important files FOR FREE!!! No paying for AxCrypt, no logins, no fuss. Just a simple to use, sophisticated executable file. Python file will be released by 2025-09-29.

-MASSIVE INCREASE IN SUPPORTED FILE EXTENSIONS!!: ClatsGuard Heavy now supports an additional 49 file extensions, namely: '.xltm', '.xltx', '.dll', '.bat', '.exe', '.tif', '.tiff', '.bmp', '.gif', '.png', '.jpg', '.jpeg', '.mkv', '.wmv', '.avi', '.mp4', '.mp3', '.wav', '.wma', '.csv', '.zip', '.rar', '.7z', '.sys', '.ini', '.log', '.js', '.html', '.htm', '.css', '.iso', '.json', '.epub', '.psd', '.ai', '.svg', '.ico', '.tar', '.gz', '.vhd', '.vhdx', '.msi', '.reg', '.lnk'

• Hybrid Encryption Scheme: Implements a robust hybrid cascade encryption system using ChaCha20-Poly1305 + AES-GCM-SIV + HMAC-SHA512, combined with advanced key derivation via Argon2id or scrypt, and metadata embedding for enhanced security via a defense-in-depth approach.
• Streamed File Processing: Processes files in chunks for memory-efficient handling of large files, with atomic writes to ensure safety against interruptions and avoid partial files.
• Security Enhancements: Includes memory zeroing to prevent leaks, constant-time comparisons, misuse-resistant modes, integrity checks, key stretching, AEAD modes, HKDF for subkeys, and stronger KDFs (Argon2id preferred over PBKDF2) tuned to be memory-hard against brute-force attacks.
• Cancellation and Input Management: Adds support for operation cancellation, input validation, automatic clipboard clearing, and post-operation clearing of sensitive inputs like passphrases or hex keys.
• UI Improvements: Features a more polished user interface with options such as deleting originals, restricting file types, a progress bar, toggles for showing/hiding passphrases/hex keys, random key generation, and various key modes.
• Expanded File Support: Broadens compatibility to include more extensions, such as media files (.mp4, .jpg).
• Modular Architecture: Highly modular design with added security-focused utilities and modules, including JSON for metadata, struct for binary packing, HMAC-SHA-512 for integrity, constants for chunking and versioning, and stream methods for efficient operations.

ClatsGuard

Changelog

[1.01] - 2025-02-13

Changed

• Refactored the code into a class-based structure (ClatsGuardApp) to improve modularity and reduce global state.
• Consolidated duplicate key-handling logic into a single helper method (get_key()).
• Introduced constants for header (HEADER), nonce (NONCE_LENGTH), and salt (SALT_LENGTH) for improved maintainability.
• Enhanced error handling and input validation across encryption and decryption workflows.
• Updated the user interface for a cleaner layout, including clearer messaging and organized component placement.
• Updated branding and version information in the UI.

Fixed

• Resolved potential global state conflicts by encapsulating functionality within the application class.
• Improved decryption flow to correctly handle files encrypted with an embedded salt and header.

ClatsGuard

A file encrypter that uses AES-256-GCM.