Custom Bash Encryption Functions: Generate Keys, Encrypt/Decrypt Strings and Files, with another encoding layer on top of it

encrypt-decrypt.sh

#!/bin/bash
#
#		DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE#			Version 2, December 2004
#	    Copyright (C) 2024 Andreas Nilsen <[email protected]>
#
#   Everyone is permitted to copy and distribute verbatim or modified
#   copies of this license document, and changing it is allowed as long
#   as the name is changed.
#
#		DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
#	  TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
#
#   0. You just DO WHAT THE FUCK YOU WANT TO.
#
#--------------------------------------------------------
function generate_rsa_keys() {
    local key_size=4096
    local private_key="~/.private_key.pem"
    local public_key="~/.public_key.pem"

    # Generate private key
    openssl genpkey -algorithm RSA -out "$private_key" -pkeyopt rsa_keygen_bits:$key_size
    # Extract public key from private key
    openssl rsa -pubout -in "$private_key" -out "$public_key"
    echo -e "RSA keys generated: $private_key (private) and $public_key (public)"
}

function encrypt_string() {
    local input="$1"
    local public_key="~/.public_key.pem"
    # Check if public already key exists
    if [ ! -f "$public_key" ]; then
        echo -e "Public key not found. Generating 4096 bits RSA keys..."
        generate_rsa_keys
    fi
    # Convert string to binary and encrypt with public key, and encode to base64
    local encrypted=$(echo -n "$input" | openssl rsautl -encrypt -pubin -inkey "$public_key" | base64)
    echo -e "$encrypted"
}

function decrypt_hash() {
    local encrypted_hash="$1"
    local private_key="~/.private_key.pem"

    # Check if private key exists
    if [ ! -f "$private_key" ]; then
        echo -e "Error: Private key not found." >&2
        return 1
    fi

    # Decode from base64 and decrypt with private 4096 bit key
    local decrypted=$(echo -e "$encrypted_hash" | base64 --decode | openssl rsautl -decrypt -inkey "$private_key")

    echo -e "$decrypted"
}

function encrypt_file() {
    local input_file="$1"
    local public_key="~/.~/.public_key.pem"

    # Check if public key exists
    if [ ! -f "$public_key" ]; then
        echo -e "Public key not found. Generating RSA keys..."
        generate_rsa_keys
    fi

    # Generate a random AES-256 key
    local aes_key=$(openssl rand -base64 32)
    local aes_iv=$(openssl rand -base64 16)

    # Encrypt the file with AES
    openssl enc -aes-256-cbc -salt -in "$input_file" -out "${input_file}.enc" -base64 -K "$aes_key" -iv "$aes_iv"

    # Encrypt the AES key and IV with RSA public key
    local encrypted_key=$(echo -n "$aes_key" | openssl rsautl -encrypt -pubin -inkey "$public_key" | base64)
    local encrypted_iv=$(echo -n "$aes_iv" | openssl rsautl -encrypt -pubin -inkey "$public_key" | base64)

    # Combine encrypted key, IV, and file hash into a single hash
    local hash="$encrypted_key:$encrypted_iv:$(basename "${input_file}.enc")"
    echo -e "$hash"
}

function decrypt_file() {
    local hash="$1"
    local private_key="~/.private_key.pem"

    # Check if private key exists
    if [ ! -f "$private_key" ]; then
        echo -e "Error: Private key not found." >&2
        return 1
    fi

    # Split the hash into its components
    IFS=':' read -r encrypted_key encrypted_iv encrypted_file <<< "$hash"

    # Decrypt and decode the AES key and IV with RSA private key and base64
    local aes_key=$(echo "$encrypted_key" | base64 --decode | openssl rsautl -decrypt -inkey "$private_key")
    local aes_iv=$(echo "$encrypted_iv" | base64 --decode | openssl rsautl -decrypt -inkey "$private_key")

    # Check if the encrypted file actually exists
    if [ ! -f "$encrypted_file" ]; then
        echo -e "Error: Encrypted file was not found." >&2
        return 1
    fi

    # Decrypt the file with AES
    local output_file="${encrypted_file%.enc}"
    openssl enc -aes-256-cbc -d -in "$encrypted_file" -out "$output_file" -base64 -K "$aes_key" -iv "$aes_iv"

    echo -e "File decrypted to: $output_file"
}