Contents

Puffer Overview

Toolbar

Blowfish Key Size

Output Format

Registration

Order Form


Puffer Overview

  Puffer is a password-based, data file and e-mail encryption tool for Windows.  You can use Puffer to keep your personal or business data private and you can use Puffer to transmit sensitive data over insecure e-mail systems.  Three different output formats are supported by Puffer.  In addition to the normal binary archives, you can make self-extracting Puffer files to give to people who do not have a copy of Puffer.  You can also create text-based, uuencoded files for e-mailing encrypted binary files across 7-bit systems like the Internet.  All three formats support multiple file encryption so you may encrypt and store up to 1000 files into a single Puffer file.  Puffer also has a secure, three-pass file wipe function so you can permanently erase your original (plaintext) files.

Puffer uses the Blowfish algorithm for encryption and the Secure Hash Algorithm (SHA) for key generation.  Due to U.S. export restrictions, only the 32-bit key option is available in the shareware version of Puffer.  Registered users who are citizens of the U.S. or Canada will receive a version that supports the more secure 160-bit key option.

Puffer is copyrighted software marketed as shareware and may be freely distributed.  You are granted a limited 30 day license to see if Puffer will meet your needs.  You must purchase the registered version from the author or an authorized dealer if you wish to use this product past the 30 day evaluation period.  See Registration for more information.

Puffer was developed with Borland's Delphi compiler.

Contact the author at:

Kent Briggs

109A Romana Circle

Hewitt, TX  76643

Internet: kbriggs@execpc.com

CompuServe: 72124,3234

World Wide Web page: http://execpc.com/~kbriggs


Toolbar

The toolbar consists of 7 buttons that perform the same functions as their corresponding selections on the pull-down menu.

  Click the Add button to add files to the file list for encryption and/or wiping.  A file selection dialog box will appear.  You can select a range of files by holding down the Shift key while clicking.  You can select additional files outside of a continuous range by holding the Ctrl key down while clicking.  Up to 1000 files can be placed in the file list at one time.

  Click the Remove button to remove selected files from the file list.  The Remove button will be grayed out if no files in the list are selected.

  Click the Clear button to remove all files from the file list.

  Click the Encrypt button to encrypt all files in the file list.  Be sure the desired key size and output format is selected before clicking the Encrypt button.  A file dialog box will appear.  Enter the name of a file to create.  An extension of .PUF will be added by default for the Binary (PUF) and Text (PUF) formats.  An extension of .EXE will be added for the self-extracting Binary (EXE) format.  You will be prompted for a password.  The password can be any word or phrase up to 55 characters in length.  The password is not case sensitive.  Asterisks will echo as you type.  You will be asked to enter the password a second time for confirmation.  If you are creating a Text file, you will be prompted for a split file size.  If you accept the default setting of 900 lines, then the split files created will not exceed 60,000 bytes.  For example, if you specified a file name of 'TEST' then the first file created will be called TEST.PUF.  The second file will be named TEST.P02, the next TEST.P03, etc.

  Click the Decrypt button to decrypt a Puffer file.  The decrypt function is not affected by files in the file list.  A file selection dialog box will appear.  Select a file.  Puffer will display a list of encrypted files inside the PUF file.  You may select one or more files for decryption.  Click the All button to select all files.  Click the OK button and enter the password for the file.  If the correct password is entered, the file(s) will be decrypted into the current directory.  Self-extracting Puffer files (.EXE's) cannot be decrypted from within Puffer.  To decrypt these files, execute them from the Program Manager, File Manager, or DOS command line.

  Click the Wipe button to permanently erase all files in the file list.  A confirmation dialog box will appear before files are wiped.  Use this function with caution!  You cannot recover wiped files, even with an unerase program.  The files are first renamed to PWIPED$$.TMP and then wiped using a three pass process.  On pass #1, the files are overwritten with a random byte string.  On pass #2, the files are overwritten with the inverse (1's compliment) of the first string.  On pass #3, the files are overwritten with binary zeros.  The Wipe function is normally used to erase plaintext files after they are encrypted.

  Click the Exit button to quit the Puffer program.


Blowfish Key Size

Casual: this setting will convert the user password to a 32-bit binary key for encryption.

Secure: this setting will convert the user password to a 160-bit binary key for encryption.

Puffer uses Blowfish for file encryption.  Blowfish, a variable size key block-encryption algorithm, was developed by Bruce Schneier, author of "Applied Cryptography" (Wiley), and presented in the April 1994 edition of Dr. Dobb's Journal.  Mr. Schneier was generous enough to place the algorithm in the public domain, unpatented, so that it can be freely used by anyone.

Puffer's implementation of Blowfish differs from the original specification in two areas.  First, instead of initializing the s-boxes with the hexadecimal digits of pi, Puffer uses the output of a pseudo-random number generator.  This eliminates the need for a separate 4k data file.  The PRNG equation used is: rng(i)=rng(i-1)*134775813+1 where rng is a 32-bit variable initialized to ffffffff hex.  Second, PCs with Intel CPUs store data in little endian format (least significant byte first in a multi-byte word).  The original specification converts each block to big endian format before encrypting and back to little endian format before saving.  Since this only slows encryption and does not change the security of the algorithm, Puffer skips the endian conversions.

Puffer uses the Secure Hash Algorithm (SHA) to generate the session key.  The SHA was developed by The National Institute of Standards and Technology (NIST), along with the National Security Agency (NSA).  The SHA is considered by many cryptography experts to be one of the most secure one-way hash algorithms available.  Puffer takes the user's pass phrase, converts it to uppercase, and runs it through the SHA.  This results in a 160-bit message digest, or hash value.  When using the casual key size option, Puffer only uses the 32 most significant bits for the session key.  When using the secure key size option, all 160 bits are used.  Because of the efficient design of the Blowfish algorithm, there is no speed penalty when using the secure key option.

Unfortunately, because the U.S. government classifies strong encryption software as "munitions" and restricts its export, the secure key option is only available in the registered version sent to citizens of the U.S. and Canada.  Registered users in other countries receive the international registered version that only has the casual key option.  The 32-bit key still provides over 4 billion combinations that should keep your friends out of your private files, assuming you did not use a password or pass phrase that could be easily guessed.  On the other hand, the 160-bit key has over 10^48 (10 raised to the 48th power) combinations.  Assuming a brute force attack is the best way to break it, a trillion supercomputers, each trying a trillion keys per second, would take about 463 trillion centuries to try all combinations.  In either case, don't call me if you forget a password.  I have no method of recovering encrypted files without the password.  Puffer leaves the original plaintext file in place so if you want it permanently erased, use Puffer's built-in Wipe command.


Output Format

Binary (PUF) file: this setting will produce the normal 8-bit encrypted data file.  Puffer will create a new file with the name you specify and a default extension of .PUF.  You can encrypt up to 1000 files into a single PUF file.  You cannot add files to an existing PUF file, however.  You can extract and decrypt individual files from the PUF file.  The names and sizes of the files are not encrypted, only their contents are.  If you send a PUF file to another person, they will need a copy of Puffer and the password to decrypt any files.  If you use the 160-bit key option with the registered version of Puffer, then the recipient will also need the registered version to decrypt the files.

Binary (EXE) file: this setting will produce a self-extracting executable file with an EXE extension.  Like the PUF format, you can encrypt up to 1000 files into a single EXE.  Registered users can produce both 32-bit and 160-bit key EXE's.  Use this format to send encrypted files to people who do not have a copy of Puffer.  To decrypt a self-extracting Puffer file, simply run it from the DOS command line, or pick File/Run in Program Manager, or double click it from File Manager.  The program will prompt the user for the password and decrypt itself.  You cannot extract individual files from the EXE but you can skip over files that already exist in the directory.  The overhead of decryption code is less than 3K in the EXE file.  Self-extracting Puffer files can be distributed royalty-free by registered users.

Text (PUF) file: this setting will produce a 7-bit text file consisting of normal keyboard characters. Use the text format when you need to send encrypted data through the Internet e-mail system or any other system that does not support binary file transfers.  The text format also uses a default extension of .PUF and supports multiple file encryption and 32/160-bit key sizes.  Puffer uses a technique similar to uuencoding that converts every 3 binary bytes to 4 text bytes.  Since most email systems cannot handle files over 64K, Puffer will automatically split the PUF file into smaller files.  The default split size is 900 lines of data.  Puffer outputs 64 character lines plus a carriage return and a line feed for a total of 66 bytes per line.  With the file headers, the default split file size will be just under 60,000 bytes.  The first file will retain the PUF extension.  The remaining split files will have numbered extensions starting with .P02, .P03, etc. up to .P99.  When decrypting a text format PUF file, Puffer will ignore any headers and footers placed in the file by the e-mail system.  Puffer can also handle files that had their carriage returns stripped out by Internet e-mail systems.  Puffer only looks for the line feed character at the end of each line.  A comment is placed at the beginning of each split file telling the recipient how to name the files so that Puffer can decrypt them in the proper order.


Registration

Three ways to order

1. Order with your credit card (Visa/MC/Amex/Disc) from the Public (software) Library by calling 1-800-242-4775 or 1-713-524-6394.  Ask for item #14046.  PsL will notify us on the day of the order and we will ship your order via the U.S. Postal Service (USPS).  PsL is an order service only.  They have no information on order status, technical support, product options, etc.  You must contact the author directly for this type of information.

2. Order on-line from CompuServe.  GO SWREG and follow the instructions given.  Puffer's Registration ID is 5939.  You will be billed on your regular CompuServe account.  CompuServe will notify us by e-mail and we will ship your order via USPS.

3. Order direct from the author by check or money order (drawn on U.S.A. banks only) by completing and mailing in the Order Form.  Orders are shipped via USPS.

Three types of licenses

1. Single user license ($20) - Allows you to install one copy of the software on a single PC.  Additional installations can be made if you are the sole user of all the PCs involved.

2. Network server license ($125) - Allows a network administrator to install one copy on a single network server.  All workstations connected to the server may use the program.

3. Unlimited user site license ($500) - Allows an organization to install the software on any PC based at the site, including portables.  A site is defined as one or more buildings on a contiguous area of land.

Shipping / Sales Tax

U.S.A. and Canada customers must add $1.00 for shipping.  All others must add $3.00.  Texas residents must add 8.25% sales tax.

Registered Version

Registered users will receive the fully-licensed version of Puffer on a disk with the "Unregistered" notice removed.  All documentation is contained in the on-line help system.  Customers in the  U.S.A. and Canada will also be able to use the 160-bit encryption key.  Due to export restrictions, international customers are limited to the 32-bit key option.


Order Form

                             Puffer 1.0a

                             Order Form

   Item                              Qty    Each    Amount

   ===============================   ====   ====    ======

   Single user license               ____    $20   $______

   Network server license            ____   $125   $______

   Unlimited user site license       ____   $500   $______

                                                   $______  Shipping *

         Disk size (check one):

         [ ] 3.5"   [ ] 5.25"                      $______  Subtotal

                                                   $______  Sales Tax **

   * Shipping: $1.00 for U.S.A./Canada

               $3.00 for all others                $______  Total

   ** Sales tax: 8.25% for Texas residents

                 0.00% for all others

        Send check or money order to:   Kent Briggs

        (U.S.A. banks only)             109A Romana Cir.

                                        Hewitt, TX  76643  U.S.A.

       Name: ___________________________________________________________

    Company: ___________________________________________________________

    Address: ___________________________________________________________

             ___________________________________________________________

       City: _______________________________  State: ___  Zip: _________

    My copy of Puffer came from (circle one):

    BBS   Disk Distributor   CD-ROM   Internet Site   User Group   Other

    Source Name & Location: ____________________________________________

    Suggestions for improvement: _______________________________________

    ____________________________________________________________________

    ____________________________________________________________________

    ____________________________________________________________________