Iro - Secure Encrypted Archiver

中文文档

Iro is a modern, secure, and efficient file archiver built with Rust. It is designed as a workspace containing a shared core library, a command-line interface (CLI), and a desktop application.

It protects your sensitive data with state-of-the-art cryptography and obfuscation techniques, making it extremely resistant to brute-force attacks and reverse engineering.

Project Architecture

The project is organized as a Rust Cargo workspace with three main members:

1. iro-core (/core)

The heart of the application. This library contains all the business logic for file processing.

• Compression: Uses zstd for high-performance compression.
• Encryption: Implements ChaCha20Poly1305 for state-of-the-art security.
• Abstraction: Defines the ProgressCallback trait to allow both the CLI and Desktop apps to report progress in their own way.

2. iro-cli (/cli)

A lightweight command-line interface for power users and automation.

• Interface: Built with clap for robust argument parsing.
• Feedback: Uses indicatif for beautiful terminal progress bars.
• Usage: Perfect for scripts, servers, or quick operations without a GUI.
• Read CLI Documentation

3. iro-desktop (/desktop)

A modern, cross-platform desktop application.

• Backend: Built with Tauri v2, leveraging the iro-core library for heavy lifting.
• Frontend: Built with React 19, TypeScript, and Tailwind CSS v4.
• Features: Drag & Drop, Theme Support, Native Integration.
• Read Desktop Documentation

Features

• Strong Encryption: Uses ChaCha20-Poly1305 (AEAD) for authenticated encryption.
• Secure Key Derivation: Uses Argon2id to derive keys from passwords, preventing GPU/ASIC brute-force attacks.
• Obfuscation:
  • String Obfuscation: All sensitive strings in the binary are encrypted at compile time.
  • Header Obfuscation:
    • Stealth Magic: The file signature is a truncated SHA-256 hash, appearing as random bytes to standard tools.
    • Random Padding: Adds variable-length random padding (0-255 bytes) to the header to prevent file size analysis.
  • Dynamic Nonce: Each data chunk uses a unique, dynamically calculated nonce.
• Memory Security:
  • Zeroize: Passwords and encryption keys are automatically wiped from memory immediately after use or when dropped.
• Compression: Uses Zstd for high-performance compression.
• Usability:
  • Progress bars for packing, unpacking, and verifying.
  • List contents without unpacking.
  • Verify archive integrity without unpacking.
  • Adjustable compression levels.
• Stream Processing: Handles large files efficiently with low memory footprint.

Getting Started

Prerequisites

• Rust: Latest stable version.
• Node.js: Version 18 or higher (for Desktop).
• Build Tools: VS C++ Build Tools (Windows) or Xcode Command Line Tools (macOS).

Building the Project

To build the entire workspace (Core, CLI, and Desktop backend):

cargo build --release

To run the desktop application in development mode:

cd desktop
npm install
npm run tauri dev

Usage

Please refer to the specific documentation for each component:

• CLI Usage: See CLI README
• Desktop Usage: See Desktop README

Quick CLI Example

# Pack
iro-cli pack ./my_folder -o archive.iro

# Unpack
iro-cli unpack archive.iro -o ./output

Security Design

1. Key Derivation: User password + Random 32-byte Salt -> Argon2id (tuned for high memory usage) -> 32-byte Key.
2. Header Protection:
   • Stealth Magic: The file signature is a truncated SHA-256 hash, appearing as random bytes.
   • Random Padding: Variable-length random padding (0-255 bytes) is added to obscure file size.
3. Encryption: The data is compressed with Zstd, then split into 1MB chunks. Each chunk is encrypted with ChaCha20-Poly1305 using the derived Key and a unique Nonce (Base Nonce XOR Chunk Index).
4. Integrity: Poly1305 tags ensure that any modification to the ciphertext is detected, and decryption is aborted immediately.
5. Memory Safety: The zeroize crate is used to wipe sensitive data (passwords, keys, buffers) from memory as soon as they are no longer needed.

License

MIT