Decrypting Files
| | |
| ||
| ||
To gain access to the data in an encrypted file, decrypt the file using the DECRYPT command. Follow these steps:
Specify the same key used to encrypt the file.
See if you need to redefine the key using the ENCRYPT /CREATE_KEY command. For example, if the key was in the process key storage table and the process logged out, the key is no longer defined.
Specify the algorithm with the /KEY_ALGORITHM qualifier, if you did not encrypt the file with the default algorithm.
DECRYPT file-spec key-name [ qualifiers ]
where
| file-spec | is the name of the file. |
| key-name | is the name of the key. |
| qualifiers | are options that control the decryption process or the selection of files you want to decrypt. |
See the following example:
|
|
|
For the ciphertext file, which is the file to be decrypted, specify a file that resides on disk and that is not a directory file.
To specify multiple input files to the DECRYPT command, use wildcard characters in the file specification. To control file selection, specify the appropriate DECRYPT command qualifiers. Do not use wildcard characters to specify directory files or files containing bad blocks.
The result of the decryption operation is a plaintext file. One plaintext file is created for each input file that is decrypted. By default, the DECRYPT command writes each plaintext file to a separate output file with a file specification that defaults to the input file specification with a version number that is one higher than that of the input file.
You can specify an alternate output file specification with the /OUTPUT qualifier. When specifying the /OUTPUT qualifier, you specify those parts of the file specification that you want to be different from the defaults. You do not need to specify an entire file specification; any fields omitted in the file specification default to the input file specification.
For example, the following DCL command selects for decryption all files in the current directory matching the wildcard file specification of *.ENC. The /OUTPUT qualifier specifies that any output files created have a file type of COM.
|
|
|
By default, information about the decryption operation is not displayed on SYS$COMMAND. To display this information, use the /SHOW qualifier. The /SHOW qualifier has the format:
/SHOW=keyword
or
/SHOW=keyword-list
Specify one or more of the following keywords:
FILES
STATISTICS
Use the FILES keyword to display the input and output file specifications as decryption proceeds. For example, /SHOW=FILES in the following command specifies that each input and output file specification be displayed as it is decrypted.
|
|
|
Use the STATISTICS keyword to display encryption stream statistics after the completion of each file decryption operation. The statistics displayed are:
Bytes processed
Internal records processed
CPU time consumed within the encryption algorithm
The following command specifies that the decryption stream statistics be displayed on SYS$COMMAND.
|
|
|
You can use the DECRYPT command to specify multiple input files by using wildcard characters in the input file specification. The command also provides the following qualifiers for selecting files:
/BACKUP
/BEFORE
/BY_OWNER
/CONFIRM
/EXCLUDE
/EXPIRED
/MODIFIED
/SINCE
The following sections describe these qualifiers.
The /BACKUP qualifier selects files for decryption according to the date of their most recent backup. This qualifier is meaningful only when used with either the /BEFORE or the /SINCE qualifier. The /BACKUP qualifier has the format:
/BACKUP /BEFORE[=time]
/BACKUP /SINCE[=time]
where
time is an OpenVMS time.
If you do not specify a time, TODAY is used. TODAY is the current day, month, and year at 00:00:00.
The following command selects for decryption all files in the current directory matching the wildcard file specification of *.COM that had backup copies made before 00:00:00 15-APR-2009.
|
|
|
Do not use the /BACKUP qualifier with either the /EXPIRED or the /MODIFIED qualifier.
The /BEFORE qualifier selects files for decryption that have a creation date before the time specified with the qualifier. The /BEFORE qualifier has the format:
/BEFORE[=time]
where
time is an OpenVMS time.
If you do not specify a time, TODAY is used. TODAY is the current day, month, and year at 00:00:00.
The following command selects for decryption all files in the current directory matching the wildcard file specification of *.COM that were created before 00:00:00 15-APR-2009.
|
|
|
Use the /BY_OWNER qualifier to select files for decryption that have a particular owner User Identification Code (UIC). If no UIC is specified with the qualifier, the UIC of the current process is used. The /BY_OWNER qualifier has the format:
BY_OWNER=uic/
where
uic is the UIC of the owner of the file.
By default, all input files specified on the command line are processed without confirming that each file is selected for decryption. Use the /CONFIRM qualifier if you want a prompt with the name of each file selected for decryption. Your response controls whether or not a particular file is decrypted.
You can choose any of the following responses:
| Response | Meaning |
|---|---|
| YES | Decrypt the file. |
| NO or RETURN | Do not decrypt the file. This is the default. |
| QUIT or Ctrl/Z | Do not decrypt the file or any subsequent files. |
| ALL | Decrypt the file and all subsequent files. |
The following command selects all files in the current directory matching the wildcard file specification of *.COM for decryption. Because the /CONFIRM qualifier is specified, the user is prompted on a file-by-file basis to confirm that each file is to be decrypted. Because the prompt is answered in the affirmative for the file MOVE.COM;3, the output file MOVE.COM;4 is created.
|
|
|
Use the /EXCLUDE qualifier to exclude one or more files from a decryption operation. If a file matches the file specification provided with the qualifier, the file is not decrypted. The /EXCLUDE qualifier has the format:
/EXCLUDE=((file-spec)[,...])
where
file-spec is the file specification of the file to remain encrypted.
When specifying only one file, you can omit the parentheses. Wildcard characters are allowed in the file specification. With the /EXCLUDE qualifier, there is no default for the file specification.
Since directory files are never encrypted, you need not specify them with the /EXCLUDE qualifier. However, if you do specify /EXCLUDE=*.DIR, you will not get the warning message %ENCRYPT-W-FILNODIR, file encryption of directories is not supported, filename.dir.
The following command selects for decryption all files in the current directory that match the wildcard file specification of *.COM, except LOGIN.COM, which is specified with /EXCLUDE.
|
|
|
The /EXPIRED qualifier selects files for decryption according to the dates on which they expire. (The expiration date is set with the SET FILE/EXPIRATION_DATE command.) This qualifier is meaningful only when used with either the /BEFORE or the /SINCE qualifier. The /EXPIRED qualifier has the format:
/EXPIRED /BEFORE[=time]
/EXPIRED /SINCE[=time]
where
time is an OpenVMS time.
If you do not specify a time, TODAY is used. TODAY is the current day, month, and year at 00:00:00.
The following command selects for decryption all files in the current directory matching the wildcard file specification of *.COM that expire after 00:00:00 15-APR-2009.
|
|
|
Do not use the /EXPIRED qualifier with either the /BACKUP or the /MODIFIED qualifier.
The /MODIFIED qualifier selects files for decryption according to the dates on which they were last modified. This qualifier is meaningful only when used with either the /BEFORE or the /SINCE qualifier. The /MODIFIED qualifier has the format:
/MODIFIED /BEFORE[=time]
/MODIFIED /SINCE[=time]
where
time is an OpenVMS time.
If you do not specify a time, TODAY is used. TODAY is the current day, month, and year at 00:00:00.
The following command selects for decryption all files in the current directory matching the wildcard file specification of *.COM that were modified after 00:00:00 15-APR-2009.
|
|
|
Do not use the /MODIFIED qualifier with either the /BACKUP or the /EXPIRE qualifier.
The /SINCE qualifier selects files for decryption that have a creation date after the time specified with the qualifier. The /SINCE qualifier has the format:
/SINCE[=(time)]
where
time is an OpenVMS time.
If you do not specify a time, TODAY is used. TODAY is the current day, month, and year at 00:00:00.
The following command selects for decryption all files in the current directory matching the wildcard file specification of *.COM that were created after 00:00:00 15-APR-2009.
|
|
|
By default, the input file is retained after a file is decrypted and written to the resulting output file. To save space, after you have decrypted a file, you may want to remove the encrypted file from your disk.
You can use the DCL DELETE command with the /ERASE qualifier to remove the contents of the file from the disk, or you can use the /DELETE and /ERASE qualifiers with the DECRYPT command.
The /DELETE qualifier deletes the input file after the decryption operation completes and the output file is written and closed. If you have multiple versions of the input file, they are not all deleted. /DELETE acts on only the version of the input file that you encrypted.
The following command specifies that the SAVEDMAIL.MAI file be decrypted using the TWENTYFIVECENTS encryption key. Because the /DELETE qualifier is specified, the input file is deleted after the output file is written.
|
|
|
To prevent disk scavenging, use the /ERASE qualifier with the /DELETE qualifier. For example, the following command decrypts the SAVEDMAIL.MAI file using the TWENTYFIVECENTS encryption key, erases the input file with the data security pattern, and deletes the file.
|
|
|
With the following command, the SAVEDMAIL.MAI file is decrypted using the TWENTYFIVECENTS encryption key, but the input file is not erased with the data security pattern before being deleted.
With the following command, the SAVEDMAIL.MAI file is decrypted using the TWENTYFIVECENTS encryption key, but the input file is not erased with the data security pattern before being deleted.
|
|
|
The algorithm qualifier you use to encrypt determines the correct decryption procedure:
If you use the /DATA_ALGORITHM qualifier to encrypt, do not specify this algorithm when you decrypt.
If you use the /KEY_ALGORITHM qualifier to encrypt, specify this algorithm when you decrypt.
The /KEY_ALGORITHM qualifier has the format:
/KEY_ALGORITHM=(algorithm)
where
algorithm is one of the following values:
DESCBC (the default)
DESECB
DESCFB
For example, if SAVEDMAIL.MAI is encrypted with /KEY_ALGORITHM=DESCFB, decrypt the file with the same /KEY_ALGORITHM=DESCFB qualifier, as follows:
|
|
|