Access Denied: A Basic File Encryption Tool

I need a basic file encryption tool so that I can FTP and email files to business partners with whom no VPN is available. Does Windows provide any built-in utilities for encrypting files?

You apparently already realize that Encrypting File System (EFS) won't help you because EFS protects files while they're on your hard disk but decrypts them before they're transmitted. No built-in commands are available, but a COM interface called CAPICOM.dll provides easy-to-use, high-level access to Windows' CryptoAPI. Moreover, sample scripts that use the interface and let you encrypt and decrypt files from the command prompt are available in the Microsoft Platform Software Development Kit (SDK). These VBScript scripts are easy to modify, although you probably won't need to change them. You can learn more about CAPICOM at http://www.microsoft.com/msdownload/platformsdk/sdkupdate/default.htm?p=/msdownload/platformsdk/sdkupdate/psdkredist.htm, and you can download the SDK from http://www.microsoft.com/msdownload/platformsdk/sdkupdate.

After you install the SDK, look in the C:Program FilesMicrosoft SDKSamplessecuritycapicomvbs folder. Two scripts, cencrypt.vbs and cdecrypt.vbs, let you encrypt and decrypt a file from the command line, respectively. You can specify the password from which the encryption key is generated, the encryption algorithm, and the key length, as well as the input and output file names. To get help for either utility, simply enter the command followed by the -? parameter. The following sample command uses Advanced Encryption Standard (AES) to encrypt a file called transactions.txt:

cscript cencrypt.vbs encrypt  -alg AES -length MAX  transactions.txt  e-transactions.txt  sk343jf92k3j43023hgsl

To decrypt e-transactions.txt to a file named d-transactions.txt, use the command

cscript cencrypt.vbs decrypt  e-transactions.txt  d-transactions.txt  sk343jf92k3j43023hgsl

The only gotcha with cencrypt.vbs is that it works only on text files--it doesn't handle other files, such as spreadsheets, databases, or files that contain non-ASCII characters. You can work around this limitation simply by converting the file to Base64-encoded format before you encrypt it, then backing out of Base64 encoding after you decrypt the file.

A public-domain utility called base64 can help; the utility is available at http://www.fourmilab.ch/webtools/base64. Written by John Walker, one of the original authors of AutoCAD, the base64 utility is simple and works well. The example below illustrates how to use Cencrypt and Base64 together.

base64 /e transactions.db  b64-transactions.dbcscript cencrypt.vbs encrypt   -alg AES -length MAX  b64-transactions.txt  e-transactions.txt  sk343jf92k3j43023hgslcscript cencrypt.vbs decrypt  e-transactions.txt  b64-transactions.txt  sk343jf92k3j43023hgslbase64 /d b64-transactions.db  transactions.db

After running the commands, you can use the Comp command to verify that the original file (transactions.db) and the decrypted file (d-transactions.db) match.

To use Cencrypt on a computer, simply ensure that Windows Script Host (WSH) is installed and register CAPICOM.dll. WSH is installed by default on most Windows systems. To register CAPICOM.dll, simply install the downloaded file in %winroot% and run the command

regsvr32 capicom.dll