Unix file encrypt accessible to Windows

This doesn't really meet your requirements since it doesn't encrypt individual files. I thought I'd mention it because it works on Windows and Linux and encrypts container files and disk partitions. Maybe you can think of a way to work this into your security model.

http://en.wikipedia.org/wiki/TrueCrypt

For example, if the container file were available via a Windows share then you could access it over the network and then use TrueCrypt to mount the container file on the client computer as a data volume in decrypted mode. That would mean that the container file would only be decrypted on the machines and by the people that were authorized to access it. In fact, since the encryption and decryption happens on the client computers then the data going over the network would be encrypted. Sweet.

You might try using GPG (GnuPG), an open source encryption tool very similar to the infamous PGP. It handles more than one type of encryption, including PGP encryption. There are Perl modules in CPAN that will encrypt/decrypt in the GPG/PGP idiom. There are Windows variants of GPG that you can use, as well, so you don't have to write encryption/decryption scripts in Perl. There are also Windows versions of the tar utility, so you could manage .tar.gz compressed archives on the Windows machine. The easy way to set it up would be to write a shell script or similar (Perl might be a good idea, just because of its cross-platform homogeneity for both Windows and Unix) that simply calls the GPG encryption utility and the tar utility.

Another alternative is to simply install PuTTY, a free remote access tool, which installs on Windows and can act as an SSH client to log into a remote Unix system. Your backup administrator could log in via SSH using PuTTY, then run a prewritten shell script that uses the tar and GPG utilities on the Unix system where you're storing backups.

Here are a couple of articles I've written that may offer ideas about how to proceed:

http://articles.techrepublic.com.com/5100-3513-6096973.html

http://articles.techrepublic.com.com/5100-1035-6050168.html

Hopefully that'll get you moving in the right direction.

ActivePerl. I don't think the install was done right, but I can execute perl from the desktop. That's why I consider the cpan modules a valid option.

In that I'm contracting or am temporary, I am uncomfortable suggesting that they install new software on their desktops. All though, I think I could win the issue of a cpan module. I'm looking around for something maybe we can compile to that Mac server too. Maybe something that is compatible with winzip with regard to password. Mac is basically a modified bsd box anyway, so I'm going to look that way also.

Dan

There are a lot of "free" solutions available for encrypting data but the time it takes to install, learn and configure their operation makes $1800 seem like a bargain.? ZIP is the best format for storing data across any platform. I'd suggest sticking with a ZIP solution since you can archive, compress, secure and send in a single command that fits easily into any script.? This is a lot easier than messing with tar, gzip, and pgp especially across the range of platforms you describe, and the files can be decrypted by WinZIP.

Also, PKZIP has a feature that allows you to use both password encryption and certificate encryption in the same step.? If your user is not technical, you can easily apply a simple password encryption method that should be simple enough for that user to manage while also adding a certificate at the same time so you, as the administrator, can always be certain you can recover the data.? Certificates are available from VeriSign for about $19. If the value of the data in your CVS repository is significant to your company, then it makes sense to invest in a solution that is secure, easy to implement and easy to use.

Jim Peterson
Chief Scientist
PKWARE INC

I'll grant you that PKWare appears to be a good product. More about that later. My point is that the PKWare salesman is making incorrect statements to support his argument that using PKWare is better than using a free software solution. I see this tactic used a lot in advertising. I think that the people who create these kinds of ads are depending on their readers not thinking about the claims that are being made. They say things like "since a=2 and b=3 then a+b=23". Product ads are full of this kind of misrepresentation.

The PKWare person is trying to say that PKWare is a better choice compared to free solutions because of the investment of time required to use them. I pointed out that PKWare has the same investment of time plus the bonus of costing $1800. Then I said that I don't see how that makes PKWare better than a free solution.

When I read your post I researched to see if there are any reported problems with the PKWare encryption. I could not find any problems. I learned that PKWare uses AES encryption. Excellent choice. No problems there. AES file encryption is also available through free software. So that isn't an advantage gained by using PKWare.

One valid advantage of PKWare is that it has software products that run on Windows and Unix and Linux. That is part of the original poster's requirements. Another valid advantage of using PKWare is that it would allow, as I mentioned with TrueCrypt, to make the encrypted file available on the network and have it decrypted on the clients that use the data. So the data is sent over the network in encrypted form.

These are two valid reasons to consider PKWare. They are not unique to PKWare but they are good to have. The PKWare salesman didn't mention these items, and tried to suggest that PKWare didn't require time to install, configure, and learn. That being the case, the cost of the product cannot be considered a bargain, which the PKWare salesman said that it was.

So let's summarize:
1) Various security web sites have nothing bad to say about PKWare. That's good.

2) PKWare uses AES encryption. That's good.

3) PKWare has versions of its software that run on Windows, Unix, and Linux. That's good and it was stated as a requirement by the original poster.

That's the good news. Now for the bad, which was the focus of my criticism.

1) The PKWare salesman said that PKWare was better than free software because free software requires that someone take time to install and configure and learn how to use the free software. In point of fact, free and commercial solutions share this requirement so it cannot be a point used to say that one solution is better than another.

2) The PKWare salesman said that since free solutions require time to install, configure, and learn that paying for PKWare is a bargain. Again. False. If anything, the commercial solution shares all of the overhead of the free software PLUS the cost of the commercial software.

From your original post, I drew the conclusion there was already familiarity with ZIP, at least
on the windows platforms since that was the system you mentioned you would like to use WinZIP
for your your non-technical user(s). It still seems to make sense to stick with ZIP to avoid changing methods on your PC when it may not be necessary, and to avoid over-complicating the process for that user. Also, if you've already used ZIP on both PC and mainframe systems, it seems to make business sense to leverage that knowledge.

Given that there are many options to choose from, the best choice may be the one that reduces the time, complexity, and overall change needded to your existing systems to solve the problem.

Jim
PKWARE