3

Yesterday I decided to encrypt my diary since it has some info that is private. My diary was a plain text doc called diary. There was no file called d so I did the following:

$ vi -x d
Enter password: **********
Repeat password: **********
:r diary
:wq
$ vi d
Enter password: **********
:set cm=blowfish2
:wq
$ mv d diary

All seemed fine, but today I tried vi diary and entered the same password, and I get garbage. What in the world could have happened?!

I doubt I could have mistyped my intended password 3 times (see above). But perhaps I did... so I ran a script (https://gist.github.com/lnolte/4135705) that generated about 65 perturbations of my password in case I somehow mistyped it. Then I tried all of these variants with a script I wrote, but nothing worked. I also tried renaming diary back to d to see if the filename itself somehow mattered.

I know that the above sequence of commands is really what I typed because they are still in my bash history. What else could be wrong?! Perhaps the file is corrupted, but that's hard to imagine.

VIM - Vi IMproved 8.0 (2016 Sep 12, compiled Nov 29 2017 18:37:46)
Mac OS X
Improve this question
5
  • 2
    Have you been able to reproduce the problem, using eg. the exact same filenames in another directory?
    – JigglyNaga
    Sep 17, 2018 at 10:15
  • I have not been able to do this, no. I have encrypted several other files with the same technique as shown in my question, but each of those files is still decipherable.
    – Fixee
    Sep 17, 2018 at 14:39
  • I'm not sure if this is a variation you've tried, but ... did you maybe have caps-lock on by mistake? Renaming a file doesn't break the encryption here, either. Possibly try an OS/filesystem-level undelete utility ASAP; you didn't do a secure erase of the plaintext file, so that may well work.
    – derobert
    Sep 19, 2018 at 21:50
  • @derobert That's a great suggestion (caps-lock) but I did try it to no avail. Also, I tried the "grep string-known-to-be-in-file /dev/disk1s1" but that isn't allowed on a Mac apparently (even with sudo). And "undelete" works only with a union filesystem (which I am not using).
    – Fixee
    Sep 20, 2018 at 1:01
  • @Fixee there is probably some way to do it (and also I'd guess undelete programs), probably the Apple Stack Exchange would know more.
    – derobert
    Sep 20, 2018 at 4:38

1 Answer 1

Reset to default
3

With Blowfish2, you may well be screwed. While the zip cryptmethod has been shown to be relatively insecure, Blowfish2 is almost certainly going to be much harder.

If you can't figure out which password you used, my only suggestion would be to revert to your most recent backup and go from there. And, if you don't have a backup, use this as a learning opportunity (sorry if I sound harsh here, it's not my intent).

Mac OS (which you appear to be on) make this very easy by providing Time Machine for exactly this purpose, and setting this up with a 1TB external drive was the first thing I did when my son broke my heart by wanting a Mac for his school work :-)

At the bare minimum, it would have been wise to keep the unencrypted file for a few day.

Improve this answer
1
  • Thanks for the answer; I know which password I used since I use only one for this type of thing. And I've now tried thousands of variants (but I can't imagine I typed it wrong three times). I'm now reading vim source to see if I can find a weakness (it's SHA-256 for password derivation, then blowfish with CFB mode symmetric encryption). I have an Nvidia GTX 1080 that can generate about 35 MHashes/sec. But my pwd was length 10; hashing all length 10 printable passwords on my graphics card will take about 760 years. :)
    – Fixee
    Sep 19, 2018 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.