Introducing Kestrel

Over three years ago, I wrote about the issues with our currently available file encryption tools. They are difficult to use and have widely varied and insufficient security guarantees. I have spent my spare time over the past three years attempting to tackle this issue, and I am proud to announce the result.

Kestrel is command-line file encryption application that makes it easy to encrypt files using either public keys or passwords. It features modern, secure algorithms with strong security guarantees. It is meant to "just work" and provides security without surprises.

Kestrel is written in Rust and uses X25519, ChaCha20-Poly1305, and the Noise Protocol.

The Noise Protocol in particular has been an absolute joy to use. It is extremely elegant and powerful. It's like the lightsaber of cryptography, and it should be no surprise that tools like Wireguard are able make great use of Trevor Perrin's excellent work.

This is my first real-world Rust application. Rust has grown to become my new favorite programming language and it seems to deliver on its promise of helping to create robust software. There were a number of instances when working on the application where I would return to the code to fix an edge case that I thought I had forgotten, only to find that Rust's error handling mechanisms had already forced me to handle the error. Good error handling and strong compile-time guarantees have been a huge boon to productivity. In general, I am super happy with the Rust experience, although reducing the number of required transitive dependencies has been a struggle.

The design of Kestrel went through a huge number of revisions before landing on something that worked. Cryptography is hard. And it is essential to be able to stand on the shoulders of giants. In these past few years my journey to learn as much as possible about cryptography has been long but also extremely exciting and rewarding. I read a ton of books and resources on the subject, and I even managed to find a vulnerability in the JDK.

One of the resources that took Kestrel in the right direction was Neil Madden's excellent blog series Public key authentication encryption and why you want it. I also greatly enjoyed Jean-Philippe Aumasson's Serious Cryptography as well as Dan Boneh and Victor Shoup's A Graduate Course in Applied Cryptography and especially the chapter on signcryption.

I have happily replaced my personal use of GPG with Kestrel, and I consider the application to be feature complete. However, it has not yet reached version 1.0, and I am looking for as much feedback as possible. Feel free to contact me. I am dedicated to continued features, bug-fixes, and documentation improvements as the project matures.

Please view the source code or download the application. Enjoy!