How do I determine encryption method via command line?

Question

I have files which are encrypted by vim.

From the command line, how can I determine which encryption method was used on a given file?

Answer 1

I looked at the source code of vim and figured that a header is written to encrypted files that specify the encryption method in the form of a code like 'VimCrypt~01!' for 'zip' and so on.

So here is a bash script to print the filenames and encryption methods of all given files:

print_enc_method() {
  local enc_method
  local file_header=$(head -c 12 "$1")

  case "$file_header" in
    'VimCrypt~01!')
      enc_method=zip
      ;;
    'VimCrypt~02!')
      enc_method=blowfish
      ;;
    'VimCrypt~03!')
      enc_method=blowfish2
      ;;
    'VimCrypt~04!')
      enc_method=xchacha20
      ;;
    *)
      enc_method='no match (not encrypted?)'
      ;;
  esac
  printf "%s: %s\n" "$1" "$enc_method"
}

for f in "$@"; do
  print_enc_method "$f"
done

You can run it like ./script.sh file1 file2 file3 or use globbing:

cd ~/Documents/super_secret_notes/
./script.sh *

And it should print something like:

file1: blowfish2
file2: zip
file3: no match (not encrypted?)

Answer 2

After doing a little research, It doesn’t look like they is any really good way to determine file encryption, since there are so many different methods of encryption.

If a file has headers, using the file command may identify some types of encryption, as per this answer.

I hope this helps!