Copyright: Interscope BlackBox Japanese 1.0. Copyright (c) 2000, Interscope Ltd. All rights reserved.


Displays the edition of this copy of Interscope BlackBox.


Displays the version and build number of this copy of
Interscope BlackBox.

Use these numbers when you ask for help or when you refer to Interscope BlackBox in a defect report.


Shows the ID number of this application.
Use this number when you ask for help or when you refer to Interscope BlackBox in a defect report.


Goes to the Interscope BlackBox homepage, where you can find the latest information about Interscope BlackBox and where you can download new encryption engines, the latest fixes, patches and new releases.


Displays information about your license for this copy of Interscope BlackBox.


Interscope BlackBox copyright information.


Dismisses the about dialog box.


Goes to the Interscope BlackBox online registration page, so that you can securely register your copy of Interscope BlackBox.


Dismisses the registration dialog and postpones the registration (in case your trial period has not expired yet).
You should use the Register button to register your copy of Interscope BlackBox.


Enter here the password that protects your data.


Re-enter here the password that will protect your data,
to ensure that you did not mistyped it.


The algorithm (encryption engine) that will be
used to encrypt your data.


The size in bits of the keys used by the currently
selected algorithm (encryption engine).


Check this box if you wish to create a self-extracting file that will contain all the selected files and/or folders in encrypted form.
When the generated self-extracting file will be run, it will prompt for the password and then (assuming the correct password was supplied) it will extract the files and/or folders, optionally restoring the original directory tree (if any).

  Tip

•	Self-extracting encrypted archives are useful for safely sending information over insecure mediums (such as the Internet). They offer the possibility to send more then one file in the same package, or even whole directory structures.


The name of the self-extracting file you wish to store the selected files and/or folder into.


Use this button to browse for a file you wish to make a self-extracting file that will contain all the selected files and/or folders in encrypted form.


Use this button to encrypt the selected files and/or folders.
Encryption requires that you supply a password and confirm it correctly.


Use this button to bring up the Options dialog, where you can configure how Interscope BlackBox operates.


Use this button to bring up the About dialog which displays information about your copy of Interscope BlackBox as well as about your license or status of the trial period.


Cancels encryption of the selected files and/or folders


Use this button to decrypt all selected files and/or folders.
Decryption requires that you supply the correct password (the one that was used to encrypt the files).


Use this button to skip the file shown on the left and continue with decryption of the rest of the files and/or folders. This file will remain encrypted.


The file for which you should type in the password, in order to successfully decrypt it.


Cancels decryption of the selected files and/or folders. In case you already decrypted some of these files and/or folders, it cancels the decryption of the remaining ones.


Select this option if you want to see the same icon for all encrypted files (files with .xen, des and .ibx extension) in Windows Explorer and on the desktop, no matter what type the file was before it was encrypted.


Select this option if you want encrypted files (files with .des and .ibx extension) to have the same icon as the had before encryption, but with a small overlapped key (showing that they are encrypted), in Windows Explorer and on the desktop.


Check this box if you want to see summary tool tips (showing the algorithm the file is encrypted with, its original size, etc.) when you hover your mouse over and encrypted file in Windows Explorer.

  Note

This feature only works on Windows 98 and Windows 2000. On all other platforms, Internet Explorer 4.0 or later must be installed and Active Desktop enabled.


Check this box if you want to have an item My Safe on the desktop, useful for quick drag-and-drop encryption and decryption. Dropping encrypted files on this item will decrypt them, dropping plain files on it will encrypt them and if you drop both encrypted and plain files on it you will be asked what operation you want to perform.


Check this box if you want all encryption-related items Interscope BlackBox adds in context menus of file system objects (files and folders) to be grouped in a submenu. This is highly recommended, since it helps keeping the context menus of Windows Explorer clean.


Clear this box if you do not want to see banners in the password dialogs.


Check this box if you want to exclude files with system attribute from encryption.

This will cause the items Encrypt… and Add to security set not to appear in the context menu when such a file is right-clicked. Also, when encrypting whole folders, files having this attribute set will be ignored.


Check this box if you want to exclude files with hidden attribute from encryption.

This will cause the items Encrypt… and Add to security set not to appear in the context menu when such a file is right-clicked. Also, when encrypting whole folders, files having this attribute set will be ignored.


Check this box if you want to (also) use exception rules for specifying what files should be excluded from encryption.


In this edit box you should enter a new exclusion rule that you want to add in the exclusion list.


Use this button to add a new exclusion rule in the list.

  Tip

You can modify an existing exclusion rule easily by selecting it in the list (this will cause it to appear in the New exclusion rule edit box), editing it and then pushing Add. Please note, however, that this will not replace the original rule, instead it will add a new one.


This list shows all the exclusion rules in effect.

  Tip

Since the exclusion rules are searched in the order that they appear in this list, you should move the rules that refer to files and paths that you use most often to the top of the list. This will result in the context menus to appear faster.


Use this button to remove the currently selected exclusion rule from the list.


Use this button to move the currently selected exclusion rule one position up.


Use this button to move the currently selected exclusion rule one position down.


Use this button to reset the content of the exclusion list to a default exclusion rule set.


If this box is checked, when an attempt is made to encrypt a file that is already encrypted by Interscope BlackBox, the file will be encrypted again. This means that both (or all) passwords are needed to obtain the original file in order to access data in it.


If this box is checked, when an attempt is made to encrypt a file that is already encrypted by Interscope BlackBox, the file will be ignored. This keeps each file encrypted only once, so that the owner of a file only needs one password (for the very first encryption) to access the data.


Check this box to process files in-place, by directly modifying their content.

This means that while going through a file and encrypting or decrypting its content, at some point part of the file is already transformed and the rest is only going to be processed. If at this point, the user cancels encryption/decryption, the machine hangs or power fails, that file will be trashed.

  Note

You should use this option only when you must encrypt or decrypt files and there is not enough temporary space.


Check this box to process files through temporary files.

This means that when a file needs to be encrypted or decrypted, first a temporary copy is made then that copy is processed. When the whole temporary file is processed, the original is replaced with it. This ensures that your data will not be trashed, damaged or lost during processing even if the machine is powered off, but requires some temporary disk space.

  Note

This is the recommended operating mode.


Check this box to use in-place processing only if there is not enough temporary space available.


Check this box to process file through temporary files, but enable in-place processing in case there is not enough disk space available for the temporary file(s), and also ask for confirmation before performing any in-place processing.


Clear this box if you do not want your user name to be stored in the files you encrypt.


This is a list of all Interscope BlackBox compliant encryption engines that are installed on this computer. The selected engine will be used to encrypt new files.


Check this box if you want to be able to download and install the required algorithms (encryption engines) when you attempt to decrypt a file for which there is no suitable engine installed yet.

  Note

You will be asked for confirmation before downloading required encryption engines.


Use this button to go to the Interscope BlackBox encryption engine library now. This will allow you to get and install new algorithms to use to encrypt files.


Check this box to see an icon in the system tray that provides information about the status of the security set (empty, locked, unlocked, being processed) and the number of the objects in the security set.


Check this button to have an item Add to security set appear in context menus of objects in Windows Explorer and on the desktop. You can then use this item to include files and folders in the security set without opening this options dialog.

  Note

The item Add to security set will not appear for files and/or folders that are excluded from encryption.


This list shows all objects that are included in the security set, their type (file or folder) as well as their status (locked or unlocked).


Use this button to bring up a dialog that will allow you to select files to include in the security set.


Use this button to bring up a dialog that will allow you to select a folder to include in the security set.


Use this button to delete the currently selected object from the security set.


Use this button to reset the content of the security set. This will remove all files and folders from the set.


Check this box if you want an item Wipe Out to appear in the context menus of objects in Windows Explorer and on the desktop. You can then delete files and folders securely, wiping their content before deletion so that they cannot be recovered.


Check this box if you want to see the shredder on the desktop. If the shredder is visible on the desktop, you can drag files and folders onto it to delete them so that they cannot be recovered.


Check this box if you want to see a Shredder item in the Send To menu. You can then send files and folder to the shredder, using the Send To menu, to delete them so that they cannot be recovered.


Check this box if you want files and/or folders to be simply deleted when dragged onto the shredder.


Check this box if you want files and/or folders to be wiped (overwritten with random patterns) before being deleted when dragged onto the shredder.


You can enter here the number of wipe steps to perform on each file when they are being wiped out.


Check this box if you want that after adding files into a self-extracting encrypted archive, the files that were encrypted (packed into the self-extracting file) remain in their original form.


Check this box if you want that after adding files into a self-extracting encrypted archive, the files that were encrypted (packed into the self-extracting file) remain on the disk encrypted.


Check this box if you want that once files are added in a self-extracting encrypted archive, they be destroyed.

  Note

The files will actually be destroyed using the shredder. This means that the settings of the shredder will affect how files are deleted or wiped.


Check this box if you want to ignore exclusion rules when creating self-extracting archives.
This means all selected files will be added to the self-extracting encrypted archive (and possibly altered or destroyed afterwards).


Check this button if you want to compress files before adding them into a self-extracting encrypted archive.

  Tip

Compressing files before encryption will reduce the size of the archive and will result in easier and faster distribution of the self-extracting file (e.g. over the Internet).


Select the compression type to use when creating new self-extracting encrypted archives.
You can favor compression speed (choose Faster),
size reduction (choose Maximum) or a balance between
the two (choose Normal).


The encryption algorithm used to encrypt this file.

You will need an encryption engine installed that implements this algorithm, in order to decrypt this file. To get new encryption engines, click Library…


The tool used to encrypt this file.

  Note

•	Files encrypted by Interscope BlackBox 1.3 or earlier with Fast DES can only be decrypted by version 1.3 or earlier.

•	Files encrypted by BlackBox 1.x (with DES in ECB mode) or by BlackBox 2.x (with DES in CBC mode) can be decrypted by BlackBox 3.x.

•	Files encrypted by BlackBox 3.0 with any other algorithm than the default (built-in) DES, can be decrypted by BlackBox 3.x if the respective algorithm (encryption engine) is installed.


The size of the file before encryption.

Note that after a file is encrypted it grows with a few bytes needed for signature, encryption parameters and password authentication data.


The name of the user who encrypted this file.

This is based on the username provided by the operating system for the currently logged on user when the file was encrypted. On Windows NT and Windows 2000, it will also display the domain name that hosts the respective user (e.g. \\WARZONE\BillG).

  Tip

You can configure Interscope BlackBox so that when you encrypt files your username is not saved in the encrypted file. See the Processing options page for details.


Use this button to decrypt this file.

You will be asked the password used for encrypting this file, to make sure that only the owner of the file or authorized persons (who know the password) have access to the data.


Use this button to browse the encryption engine library.

From the Interscope BlackBox engine library you can download and install new encryption engines or upgrade the encryption engines you already have. Also, you can get the BlackBox SDK to write your own custom engines.


Consolidates the security set, using the specified settings.


Cancels consolidation of the security set.


The destination folder of the consolidate operation. All files and folders in your security set will be copied or moved here.

  Tip

You can quickly reuse the paths where you consolidated the security set previously by clicking on the right-side down arrow. Interscope BlackBox will remember the last ten folders you used.


Use this button to browse for a folder you want to use as the destination of the consolidate operation.


If you want to copy the files in your security set to the destination folder, select this radio button.

  Note

Both the old and the new copies of the files and folders will be included in the security set when consolidation is complete.


If you want to move the files in your security set to the destination folder, select this radio button.

  Note

In case of error during moving objects in your security set, the files or folders that cannot be moved will remain in your security set.


Check this box if you want to retain the directory structure of all files and folders that are included in your security set. If you clear this box, all the files (including files in folders from your security set, as well as from all their subfolders) will end up in the destination folder.


This is the official Interscope Logo.
We invite you to visit our site at
http://www.essentialdetails.com

 Go to the Interscope BlackBox homepage

 Go to the Interscope homepage


Use this button to obtain help for this dialog


This is the current content of the clipboard. You can edit this text and then click Update to put the modified text back on the clipboard.


If checked, the editor will use a monospace font (has all characters of the same width). Such fonts are useful for editing source code or other text that require all characters to be of the same width.


Saves the content of the clipboard to a file, letting you choose the file where you want to save.


Updates the clipboard with the text that is currently in the editor.


Dismisses this dialog, but does not modify the clipboard.


The name of the file where you want your encrypted data to be stored.


Use this button to browse for a file you wish to use to store your encrypted data.


Use this button to encrypt the data on the clipboard or from your current window. Encryption requires that you supply a password and confirm it correctly.


Cancels encryption of data from your current window or currently on the clipboard.


Cancels decryption of data from your current window or currently on the clipboard.


Use this button to decrypt the data on the clipboard or from your current window. Decryption requires that you supply the correct password (the one that was used to encrypt the data).


Bring up a dialog displaying the content of the clipboard after successful decryption.


Apply new interface scheme


New interface level


Register or unregister the Microsoft Word 2000 add-in


Register or unregister the Microsoft Outlook 2000 plug-in


Starts or stops the Outlook Express 5.x plug-in


Selects one of the preference pages


Displays the registered user’s e-mail address


Allow you to select folder names to be added to the exclusion list instead of files names. This can be useful when you want to include the complete content of a folder in the exclusion list.


This is a list containing all the encryption engines that can be used for encrypting the self-extracting archives.


Check this box if you want the Encrypt option to be shown in explorer’s context menus.


Check this box if you want the Encrypt and Send… option to be shown in explorer’s context menus.


Check this box if you want the Decrypt option to be shown in explorer’s context menus.


Check this box if you want the Add to Security Set option to be shown in explorer’s context menus.


Check this box if you want the Wipe option to be shown in explorer’s context menus.


Check this box if you want the Wipe Free Space option to be shown in explorer’s context menus.


If this checkbox is checked the Clipboard encrypt/decrypt operations are enabled when using system tray icon.


If this checkbox is checked the Current Window encrypt/decrypt operations are enabled when using system tray icon.


If this checkbox is checked the Security Set operations are enabled when using system tray icon.


Selects from a predefined set of levels of security or the custom set level, which can be adjusted to the personal needs.


Pushing this button applies the selected level of security.


Displays and allows the modification of the method used for wiping the files


You can enter here the first custom byte used for overwrite


You can enter here the second custom byte used for overwrite


You can enter here the third custom byte used for overwrite


Check this if you need the second custom overwrite byte to be used


Check this if you need the third custom overwrite byte to be used


Use the current file-wiping configuration for free space wiping.


If this checkbox is checked the file slack space is also wiped when a free space wipe method is employed.


If this checkbox is checked, when the system will be shutdown, the swap file will be overwritten.


Empty folders will be included in the self-extracting encrypted archive.


Places the content of the self-extracting archive in the same folder as the previous self-extracting decryption operation.


Places the content of the self-extracting-archive in the same folder as the archive.


Places the content of the self-extracting-archive in My Documents folder.


Interscope BlackBox will derive the default name of the self-extracting archive from the file names added to the archive.


If this checkbox is checked the Encrypt and Send operation is enabled in explorer’s context menus.


The update is only initiated when user is manually requesting it.


The update is automatically initiated at specified interval.


Select the desired auto-update interval.


If this checkbox is checked the user-defined keyboard shortcuts can be used.


Select a Interscope BlackBox command to be associated with a keyboard shortcut.


Enter in this edit a combination of keys to be assigned to the selected Interscope BlackBox command.


Assigns the current keyboard shortcut to the current selected Interscope BlackBox command.


Deletes the current keyboard shortcut.


Shows the command to which is assigned the current keyboard shortcut.


 About Interscope

	Interscope develops software applications for Windows 95, Windows 98, Windows NT, Windows 2000 and DOS platforms. We provide multilingual software products that help people access, protect and distribute electronic information in environments ranging from home desktops to corporate and Internet-wide use.
   Products

Interscope organizes its array of products into three main lines:

•	Internet Tools: enable users to easily locate, access, retrieve, and view information on the Internet.

•	Security Tools: help people enhance the security of their data by encryption and by controlling access to the data.

•	Information Distribution: allows a broad range of people, from average users to power developers, to effectively create and deploy any kind of electronic content via the Web, CD-ROM, and LAN environments.

   Services

Interscope offers offshore software design and development services and is ready to provide you with high-quality solutions for:

•	Turnkey setup solutions

•	Internet/Intranet based applications

•	Client/server systems

•	Network and system software

•	Web site development

We can either develop entire applications or implement only specific components you need to integrate into and/or build your applications from. We also have experience with Microsoft BackOffice server programming as well as with integrating different types of servers.

  Go to Interscope homepage

  More information on Interscope products

  More information on Interscope services

  Feedback


About Interscope BlackBox?
 About Interscope BlackBox

Interscope BlackBox is an extensible encryption suite that smoothly integrates into the Windows operating system and provides users with solutions for data security, secure data distribution and disposal. It runs on Windows 95, Windows 98, Windows NT 4.0 and Windows 2000 platforms and extends the Windows Explorer and the desktop with items and tools specific to data security.

   Main Features

Using BlackBox users not only can encrypt and decrypt files, but then can also encrypt and decrypt whole directory structures at once (possibly with several passwords) and make use of an exclusion list to protect files and folders that they do not want to accidentally encrypt. They can even compress and encrypt directory trees into self-extracting encrypted archives which can then be distributed or sent over unsecured mediums (such as the Internet). The receiving party can then extract files from such archives by simply running it, provided they know the password used for encryption.

BlackBox also includes a shredder that can delete (actually, destroy) files so that they cannot be recovered and a user-specific security set which enables quick and easy encryption of a set of files, possibly spread in the directory structure of the user’s hard drives. The status of the security set can be monitored with an icon in the system tray.

BlackBox was designed to be as easy to use and user friendly as possible. All its features can be accessed from more than one place (e.g. the Start Menu, the desktop, the Send To menu, the system tray, file and folders context menus, etc.) and most tasks can be performed in several ways.

  Go to Interscope BlackBox homepage

  Feedback


 Welcome to Interscope BlackBox

Welcome to Interscope BlackBox, the simplest answer to everyday file security. Interscope BlackBox extends the Windows platforms with items and tools specific to data security. This help will guide you through everything you need to know about BlackBox and its features and will teach you how to use it most efficiently.

   Quick Start

Interscope BlackBox is an extensible encryption tool that smoothly integrates into the Windows operating system and it lets users quickly secure the data in their files. For a quick start, you can use one of the links below:

•	Introducing Interscope BlackBox

•	What is new?

•	Tutorial

•	Exploring the features

•	On-line support

•	How to register?

   Help Layout

This help is organized into four main categories:

•	About: here you can find out about us and about BlackBox.

•	Getting Started: this section contains an introduction to encryption.

•	Getting Results: this section provides a detailed description of every setting you can toggle in BlackBox. When you do not know what a button or a control does, you look it up here. It also contains step-by-step procedures for solving the most common tasks.

•	Technical Support: here you can find out how you can register your copy of BlackBox and then how you can get technical support.

  Go to Interscope homepage

  Go to Interscope BlackBox homepage

  Feedback


What's new?
 What’s new?

This version of Interscope BlackBox comes with many new and exciting features and enhancements of existing features, most of them inspired by your feedback and feature requests:

   New Features

•	Current Window and Clipboard encryption. Plain text in random windows or clipboard can now be encrypted using the new BlackBox modules. Text encryption allows you to encrypt the content of the clipboard and any window on your system (including your e-mail composing window, regardless of the e-mail client you are using).

•	Plug-ins for integration with Word, Outlook and Outlook Express.

•	Powerful and easy-to-use file wiping and free space wiping.

•	Newly designed user interface

•	BlackBox evolved into an open framework for file encryption. It now supports encryption engine plug-ins that implements modular data encryption. By default, BlackBox comes with the traditional 56-bit DES engine, but additional engines (Blowfish, RC4, IDEA etc.) are available from our website.

•	New BlackBox Engine SDK for writing your own encryption engine is now available. All encryption engines are based on COM technology and this lets anyone write its own, using any development tool (C, C++, Java, Visual Basic, Delphi etc.). BlackBox will then recognize all installed engines without any additional configuration or reinstallation.

•	New context menu item Encrypt and Send... that will let you encrypt and send by e-mail your files, in one simple step.

•	It is now possible to compress the files you add into a self-extracting archive, extremely useful for Internet distribution.

•	New consolidate security set operation which can gather all files and folders in your security set to a single folder, with only two clicks.

•	It is now possible to avoid storing the owner’s login name in encrypted files.

   Better Security

•	The cryptosystem, in both Interscope BlackBox and the autonomous self-extractor archives it creates, is now implemented using Triple DES. The files that are encrypted with previous versions of BlackBox can still be decrypted.

   Faster Processing

•	The processing speed was improved due to the fact the threads Interscope BlackBox uses for compression and encryption are recycled.

•	You can now install faster algorithms than DES into Interscope BlackBox (e.g. RC4).

   Interface Improvements

•	Completely redesigned Setting dialog, icons and menus

•	Interscope BlackBox now displays a tool tip when a .des or .ibx file is selected in Windows Explorer. The tool tip shows the encryption details (encryption algorithm used to encrypt the file, original size, etc.) that you can also see on the Encryption page in the file properties dialog.

•	All encryption-specific items in file and folder context menus can now be grouped in a submenu, thus reducing pollution of the Windows Explorer context menus.

For a complete reference of all new features please see New Features in BlackBox 4.0.

  Get new Interscope BlackBox engines

  Get the Interscope BlackBox SDK

  Feedback


 New Features in Interscope BlackBox 4.0

Interscope BlackBox 4.0 brings you some new improvements and new features along with an improved user interface. Here are some of the new features:

•	Clipboard Encryption

•	Current Window Encryption

•	Microsoft Outlook Integration

•	Microsoft Outlook Express Integration

•	Auto Update

•	Automatically download and install new encryption engines

•	Keyboard shortcuts

•	Command Line


Interscope welcomes any comments, suggestions or feature requests you may have. More generally, we would like to hear everything you have to say about Interscope BlackBox, so we can improve this product further on.

Please write to us at BlackBox@essentialdetails.com.


URL (universal resource locator)

It represents an universal network name used to reference resources such as web pages, user addresses etc. Examples of URLs are http://www.essentialdetails.com and mailto:InstallMaster@essentialdetails.com.

For more information on URLs, see the RFC 1738, RFC 1808 and the HTTP protocol 1.1 or newer.


HDD (hard disk drive)

Hard disk drives are non-removable mass storage devices.


IRC (Internet relay chat)

IRC is a real-time chat network. You can find channels with almost any subject out there.


DLL (dynamically linked library)

This is an executable file, which contains code that can be loaded and executed by multiple applications at the same time. It can also contain various types of resources.


SDK (Software Development Kit)

Specifications and documentation for development of software in a specific area.


COM (Component Object Model)

COM (formerly known as OLE, aka Object Linking and Embedding) is a unified environment of object-based services with the capability of both customizing those services and arbitrarily extending the architecture through custom services, with the overall purpose of enabling rich integration between components.

COM offers an extensible service architecture, and in addition to the architecture, COM itself provides a number of key customizable services, one of which in turn provides for the creation of custom services of any complexity that extend the environment within the same architectural framework. All services, regardless of their complexity, point of storage, point of execution and implementation, are globally usable by applications, by the operating system and by any other services.

The collective term to refer to all services is component. A component is a reusable piece of code and data in binary form that can be plugged into other components (possibly from other vendors) with relatively little effort. Software components must adhere to an external binary standard, but their internal implementation is completely unconstrained. They can be built using any programming language or object-oriented framework.

   Tip

For more information on OLE (COM) see the excellent books
Inside OLE  by Kraig Brockschmidt, 2nd edition (ISBN 1-55615-843-2) and
Essential COM  by Don Box (ISBN 0-201-63446-5)


encryption

Encryption is the process of transforming text or data into an unintelligible form called cipher. Reversing the process of encryption and transforming the cipher back into its original form is called decryption.

Encryption and decryption comprise the science of cryptography as it is applied to the modern computer.


confidentiality

Confidentiality refers to the accidental or intentional disclosure of data to an unauthorized individual.


integrity

Integrity refers to data which has not been exposed to accidental or malicious alteration or destruction.


algorithm

An algorithm is a set of rules or steps for performing a desired operation.


FIPS PUB

Federal Information Processing Standard Publications are issued by the National Institute of Standards and Technology after approval by the Secretary of Commerce pursuant to Section 111(d) of the Federal Property and Administrative Services Act of 1949, as amended by the Computer Security Act of 1987, Public Law 100-235 USA.

For more info visit http://www.nist.gov/itl/div897/pubs/.


Interface Schemes are a set of predefined appearance elements grouped together. Each scheme contains different user interface options that helps you to quickly apply different settings.


 Why register?

Interscope encourages you to download Interscope BlackBox for free in order to evaluate it for a 30 day period. After this period, you will only be able to decrypt files. Encryption will be disabled. You can unlock encryption again by registering your copy of BlackBox.

Interscope BlackBox is not free software. You can download it, try it and then if you like it and want to use it we will ask you to pay for it by registration. So, please do not use it illegally. We have invested a lot of money and effort in it, and we know that you all understand that otherwise we won’t be able to develop new versions, correct any possible defects and improve the product as a whole.

  Go to Interscope homepage

  Go to Interscope BlackBox homepage

  Feedback


 How to register?

You can register your copy of Interscope BlackBox by going to the secure Interscope on-line shop and paying the registration fee. Click on Buy, choose a shop (e.g. Kagi or Digital River) select the product(s) you want to buy and then fill out the purchase form. It is all extremely simple, just have your credit card handy.

Alternatively, you can download a small registration program, which will let you register by encrypted e-mail, fax or phone at Kagi.

As soon as we receive your payment confirmation, we will issue a license for you and will send it by e-mail.

  Register Interscope BlackBox on-line

  Download registration program

  Go to Interscope homepage

  Go to Interscope BlackBox homepage

  Feedback


 On-line support

Interscope will support Interscope BlackBox by e-mail, and if it is required, by telephone. For support through e-mail write to BlackBox@essentialdetails.com specifying your registered name in the body of the message.

For development and programming issues relating to the BlackBox SDK and development of custom encryption engines, please write to technical@essentialdetails.com.

  BlackBox technical support

  Development technical support

  Feedback


Overview of section Getting Started
 Overview

The Getting Started section introduces security, explains basic security concepts, introduces the DES encryption algorithm and walks you through a tutorial about how to protect your files. In just a few minutes, you will be able to encrypt, decrypt and destroy files securely.

  Feedback


 Why do I need security?

Within the last decade, there has been a vast increase in the accumulation and communication of digital computer data in both the private and public sectors. Much of this information has a significant value, either directly or indirectly, and requires protection (security).

This is why in these paranoid times of globally interconnected computer networks, the issue of security preoccupies individual users as well as large organizations. Cryptography, virus detection, authentications, auditing, certificates, permissions, access control, digital signatures and firewalls are but a few of the issues discussed under the topic of security. Interscope BlackBox uses cryptography for achieving security.

Cryptography (encryption) has historically been used to protect sensitive information. It can be used for protecting computer data stored by computers on different media (storage devices) and/or data transmitted between computers. Data is encrypted before it is written on the storage device or it is transmitted and decrypted before it is subsequently read or after it is received, respectively.

  Feedback


 How can BlackBox help?

Interscope BlackBox focuses on protecting the confidentiality and integrity of the data. These goals are achieved by using encryption.

Data on a computer system is stored on storage devices of miscellaneous types. Physical data (streams of 0s and 1s) are organized logically into files. So, from the user’s point of view, the data is stored in files. To protect user’s data means to somehow protect the content of the files in a computer system. This is what Interscope BlackBox is designed for.

Interscope BlackBox uses encryption to secure data in user’s files. When data is stored on a computer system, to be secure, it is stored (converted to) its cipher form and transformed to plaintext (original form) only when it is to be processed within the computer.

  Feedback


 Transmission threats

Encryption can be used to prevent the disclosure of data and to detect the modification of transmitted data. Encryption will not combat the threats of accidental or deliberate destruction. Encrypted data can be lost or destroyed as easily as unencrypted data. Adequate backup facilities or copies must be provided to recover from the destruction of either encrypted or unencrypted data. In addition, destruction or loss of the key used to encrypt data is equivalent to the loss or destruction of the data itself.

The following is a list of threats that are countered with the encryption of transmitted data:

•	Spoofing: Spoofing is the threat of accepting a false claim of identity. Spoofing by a computer system penetrator is a serious threat at many places in a computer system. The computer's data communication system is especially vulnerable to spoofing. The identities of terminals, computers, and users can often be simulated so that the receiving device cannot discern a true identity from a falsely claimed identity. Data encryption can be used for authentication by requiring that a unique encryption key be associated with each identity. Successful communication using this key mutually authenticates the holders of the key (provided that the key has not been compromised) and thus prevents spoofing. If the key is not known, false messages cannot be correctly generated and entered into the system and hence message spoofing is prevented.

•	Misrouting: The threat of misrouting is directly proportional to the complexity of the communication system and inversely proportional to the reliability of its components. A simple message routing indicator scheme combined with encryption of the routing indicator may be used to detect misrouting, but prevention can only be accomplished with dedicated lines and permanent connections. In any but geographically local systems, the prevention of misrouting is not economically feasible. However, data encryption can prevent the unauthorized use of misrouted data.

•	Passive Wiretapping (Monitoring): Monitoring of messages during data transmission can occur all along the transmission path in any of several ways. Wiretapping or radio reception of the transmitted data are the most common methods. The transmission is not delayed or altered, only monitored or copied. This threat is difficult to combat in any way other than physically protecting the transmission path or encrypting the data. Plaintext is also vulnerable to monitoring due to radiation, conduction, and acoustic pickup during input and output operations. These threats are prevalent in high voltage CRT terminals, electrically connected devices, and mechanical printing or punching devices. Encryption protects the plaintext from disclosure. The encryption devices should be designed to be an integral part of the original source equipment and the final destination equipment whenever possible. The data encryption devices themselves must be physically protected and designed to minimize electronic emanations.

•	Active Wiretapping: With this type of communication threat the communication line is broken, a high speed receiver-transmitter is installed, and the intercepted data is retransmitted unchanged until a special "looked for" event causes the tapping mechanism to modify the data so as to have false information accepted as valid. Communications will be slightly delayed while the data is being modified but this delay is often not detectable because other variable length delays are already in the communication system. Encryption prevents the penetrator from intelligently modifying the cipher so that the decrypted plaintext is ungarbled (i.e., readable and acceptable). Special precautions must be utilized to prevent either the playback threat or the substitution threat. The former consists simply of copying a valid encrypted message and playing it back (retransmitting it) to the unsuspecting receiver. If the key has not been changed, the receiver will correctly decrypt the message and may accept it. For certain types of messages (funds deposits, merchandise orders, etc.), this could have disastrous results. The substitution threat consists of replacing blocks or characters of ciphertext with other blocks or characters without actually deciphering the data or having the key. The perpetrator substitutes the cipher of known plaintext. This can be accomplished in the block mode if each block is totally independent from all others, and no other block or message authentication system is used.

   Note

•	Interscope BlackBox addresses transmission threats by allowing users to build single-file self-extracting encrypted archives, which can then be sent securely (this means that the files in the respective archive are being sent securely) over unsecured routes (such as e-mail, Internet, etc.).

  Feedback


 Storage threats

In addition to combating threats to computer data security during transmission among terminals and computers, cryptography may be used effectively for protecting computer data during storage. The main difference between the two scenarios is that in the transmission case, the cryptographic key must be available at the two participating locations simultaneously and may be destroyed when that transmission is complete. In the storage case, the key need be at only one location but must be retained for reuse when the data is to be retrieved and used. The computer system or the user must be able to provide the key at the appropriate place and at the appropriate time.

The following is a list of threats that are countered with the encryption of stored data:

•	Theft: Encryption of stored computer data provides protection against the disclosure of stolen data. Data may be stolen from on-line devices (disks, mass storage devices, etc.) by unauthorized access, or from off- line devices (magnetic tape, cards, disk packs, etc.) by physically removing the device and reading it on another computer system. In addition if there is a threat of a computer data storage facility or a computer center being taken over by force, bulk encryption of all data using a common key which is easily erased from the encryption device effectively renders the data unreadable and unusable by destroying the key. This key must be kept in a physically secure location (safe, etc.) so that it may be reentered into the encryption device when the facility has been made secure again. User controlled encryption of private data files renders the data unreadable to other system users.

•	Residue: Data that is left on magnetic media and not erased after it is no longer needed is called residue. Erasing computer data on magnetic storage media may be a very time consuming process. Overwriting data which is to be discarded in a shared system can use a significant amount of input and output time if done as standard practice. Data recovered by simply reading discarded data that was not destroyed is considered to be "scavenged." If sensitive data is always stored on the media in an encrypted form, tapes and disk packs may be returned to their supplier when no longer needed or the "scratched" data tapes may be reused without erasing. Merely destroying the key precludes use of the data. System failures during the erasing of magnetic media are no longer a concern if the media are encrypted. Encryption of stored data with the user's private key obviates the need for clearing temporary storage after use.

•	Remanence: Remanence is the magnetic flux remaining in a magnetic substance after the magnetic force has been removed. In some magnetic storage media, data stored for a long period of time on the media can remain at a lower signal intensity level even after the media have been erased. Encryption of all sensitive data stored on such media removes this threat and such storage media may be released for general usage rather than destroyed. It should be noted that for unclassified computer data, this is a very insignificant threat and encryption should not be justified for this reason alone.

•	Addressing Failure: Random access magnetic storage media have a physical addressing mechanism which positions the data under the reading heads and transfers the data. Software data access methods generally have a complex data structure associated with the stored data to optimize access to it. Both of these mechanisms have a small, but non zero, probability of failure. Encrypting the data by combining the location of the data with the key can prevent accidental reading of the wrong data. Applications of this type in the system will depend greatly on the implementation of the encryption device in the proper place in the system architecture.

   Note

•	Interscope BlackBox has its main design goal the solving of storage threats. Particularly, it addresses theft and residue threats.

  Feedback


 Data encryption

Interscope BlackBox counters both storage and transmission threats by using data encryption.

Data encryption is a process used to hide the true meaning of data. The word "encryption' has been coined from the word "cryptography" which was derived from the ancient Greek words "kryptos" (hidden) and "graphia" (writing).

Data encryption is achieved through the use of an algorithm that transforms data from its intelligible form to cipher. The cipher is protected by a cryptographic key, which is necessary to recover the original data from the cipher. Keeping the key secret ensures the confidentiality of the data. There are many different encryption algorithms, with miscellaneous strengths and weaknesses.

  Feedback


 Wiping

Interscope BlackBox also addresses some variations of storage threats (namely, residue) by using wiping to achieve secure deletion of files and folders.

Wiping is the process of destroying the content and other information stored for each file before deleting them from the file system, making sure that no recovery is possible. This is achieved by overwriting the file’s content and also resetting name, attributes and size of the file before deletion.

  Feedback


 Algorithms

There are two basic types of cryptography: symmetric key and public key.

Symmetric key algorithms are the quickest and most commonly used type of encryption. These algorhythms require that the sender and receiver of a message share a secret key. Each side must know what the secret key is in order for this to work. In symmetric key cryptography, the algorithm used to scramble a message needn't be kept secret. It's the unscrambling function--the secret key-- that needs to be safeguarded. Examples of symmetric key algorithms include Data Encryption Standard (DES), Blowfish, RC2, RC4, IDEA, Cast and SkipJack.

In public key cryptography, there is no shared secret key. Instead, two keys, called key pairs, are created at the same time. These key pairs are mathematically related and are created by using very, very large prime numbers. By knowing one side of the pair, you cannot realistically determine the other number in the key pair. The pair contains a public key and a private key. The public key is the key that you give out; the private key is the key that you keep to yourself, usually on the machine that generated the key. If a private key is used to encrypt a message, only the public key can decrypt the message; if a public key is used to encrypt a message, only the private key can decrypt the message. Public key cryptography is much slower than symmetric key cryptography, so it isn't effective for bulk encryption. Examples of public key algorithms are RSA and PGP.

Many cryptography schemes use a combination of both symmetric key and public key encryption. One typical scenario is using public key encryption to exchange symmetric pairs, and then using symmetric key encryption to exchange data.

  Feedback


 Introduction to DES

The Data Encryption Standard (DES) specifies a FIPS (Federal Information Processing Standard) approved cryptographic algorithm as required by FIPS 140-1.

DES implements a mathematical algorithm for encrypting (enciphering) and decrypting (deciphering) binary coded information. Encrypting data converts it to an unintelligible form called cipher. Decrypting cipher converts the data back to its original form called plaintext. The algorithm used by DES performs both enciphering and deciphering operations which are based on a binary number called a key.

A key consists of 64 binary digits ("0"s or "1"s) of which 56 bits are randomly generated and used directly by the algorithm. The other 8 bits, which are not used by the algorithm, are used for error detection. The 8 error detecting bits are set to make the parity of each 8-bit byte of the key odd, i.e., there is an odd number of "1"s in each 8-bit byte. Authorized users of encrypted computer data must have the key that was used to encipher the data in order to decrypt it. The unique key chosen for use in a particular application makes the results of encrypting data using the algorithm unique. Selection of a different key causes the cipher that is produced for any given set of inputs to be different. The cryptographic security of the data depends on the security provided for the key used to encipher and decipher the data.

Data can be recovered from cipher only by using exactly the same key used to encipher it. Unauthorized recipients of the cipher who know the algorithm but do not have the correct key cannot derive the original data algorithmically. However, anyone who does have the key and the algorithm can easily decipher the cipher and obtain the original data. A standard algorithm based on a secure key thus provides a basis for exchanging encrypted computer data by issuing the key used to encipher it to those authorized to have the data.

Data that is considered sensitive by the responsible authority, data that has a high value, or data that represents a high value should be cryptographically protected if it is vulnerable to unauthorized disclosure or undetected modification during transmission or while in storage. A risk analysis should be performed under the direction of a responsible authority to determine potential threats. The costs of providing cryptographic protection using this standard as well as alternative methods of providing this protection and their respective costs should be projected. A responsible authority then should make a decision, based on these analyses, whether or not to use cryptographic protection and this standard.

   Note

•	A more complete description of the strength of this algorithm against various threats is contained in FIPS PUB 74 (Guidelines for implementing and using the NBS Data Encryption Standard).

  Feedback


Characteristics of DES
 Characteristics

The DES algorithm is a recirculating, 64-bit, block product cipher whose security is based on a secret key. DES keys are 64-bit binary vectors consisting of 56 independent information bits and eight parity bits. The parity bits are reserved for error detection purposes and are not used by the encryption algorithm. The 56 information bits are used by the enciphering and enciphering operations and are referred to as the active key. Active keys are generated (selected at random from all possible keys) by each group of authorized users of a particular computer system or set of data. Each user should understand that the key must be protected and that any compromise of the key will compromise all data and resources protected by that key.

In the encryption computation the 64-bit data input is divided into two halves each consisting of 32 bits. One half is used as input to a complex nonlinear function, and the result is exclusive OR'ed to the other half. After one iteration, or round, the two halves of the data are swapped and the operation is performed again. The DES algorithm uses 16 rounds to produce a recirculating block product cipher. The cipher produced by the algorithm displays no correlation to the input. Every bit of the output depends on every bit of the input and on every bit of the active key.

The security provided by the DES algorithm is based on the fact that, if the key is unknown, an unauthorized recipient of encrypted data, knowing some of the matching input data, must perform an unacceptable effort to decipher other encrypted data or recover the key. Even having all but one bit of the key correct does not result in intelligible data.

An important characteristic of the DES algorithm is its flexibility for usage in various data processing applications. Each cipher block is independent of all others allowing encryption or decryption of a single block in a message or data structure. Random access to encrypted data is therefore possible. The algorithm may be used in this straightforward way to form a block cipher or alternatively used with chaining in which the output of the algorithm depends on previous results of the algorithm. The first technique is called the Electronic Codebook (ECB) mode and the chaining technique has two examples (discussed in these guidelines) called the Cipher Block Chaining (CBC) mode and the Cipher Feedback (CFB) mode. In addition, DES may be used in the Output Feedback (OFB) mode to generate a pseudorandom stream of bits which is exclusive ORed to the plaintext bits to form cipher.

The DES algorithm is mathematically a one-to-one mapping of the 2" possible input blocks onto all 264 possible output blocks. Since there are 256 possible active keys, there are 256 possible mappings. Selecting one key selects one of the mappings.

The input to the algorithm is under complete specification of the designer of the cryptographic system and the user of the system. Any pattern of 64 bits is acceptable to the algorithm. The format of a data block may be defined for each application. In the ECB mode, the subfields of each block may be defined to include one or more of the following: a block sequence number, the block sequence number of the last block received from the transmitter, error detecting/correcting codes, control information, date and time information, user or terminal authentication information, or a field in which random data is placed to ensure that identical data fields in different input blocks will result in different cipher blocks. It is recommended that no more than 16 bits be used for known constant values. For example, the same 32-bit terminal identification value should not be used in every block. If it is desired that data blocks in the ECB mode display a sequence dependency, a portion of the last sent or last received block may be incorporated into the block, either as a subfield or exclusive ORed to the block itself.

The DES algorithm is composed of two parts: the enciphering (encryption) operation and the deciphering (decryption) operation. The algorithms are functionally identical except that the selected portion of the key used for rounds 1,2,...,16 during the encryption operation are used in the order 16,15,...,1 for the decryption operation. The algorithm uses two 28-bit registers called C and D to hold the 56-bit active key. The key schedule of the algorithm circularly shifts the C and D registers independently, left for encryption and right for decryption. If the bits of the C register are all zeros or all ones (after Permuted Choice 1 is applied to the key) and the bits of the D register are all zeros or all ones, then decryption is identical to encryption. This occurs for four known keys:

0101010101010101

FEFEFEFEFEFEFEFE

1F1F1F1F0E0E0E0E

E0E0E0E0F1F1F1F1

   Note

•	The parity bits of the key are set so that each 8-bit byte has odd parity.

It is likely that, in all other cases, data encrypted twice with the same key will not result in plaintext (the original, intelligible data form). This characteristic is beneficial in some data processing applications in that several levels of encipherment can be utilized in a computer network even though some of the keys used could be the same. If an algorithm is its own inverse, then an even number of encryptions under the same key will result in plaintext.

There are certain keys such that for each key K there exists a key K' for which encryption with K is identical to decryption with K' and vise versa. K and K' are called dual keys. Keys with duals were found by examining the equations which must hold in order for two keys to have reversed key schedules. Keys having duals are keys which produce all zeros, all ones, or alternating zero-one patterns in the C and D registers after Permuted Choice 1 has operated on the key. These keys are listed below:

No.	Key	Dual
1	E001E001F101F101	01E001E001F101F1
2	FE1FFE1FFE0EFE0E	1FFE1FFE0EFE0EFE
3	E01FE01FF10EF10E	1FE01FE00EF10EF1
4	01FE01FE01FE01FE	FE01FE01FE01FE01
5	011F011F010E010E	1F011F010E010E01
6	E0FEE0FEF1FEF1FE	FEE0FEE0FEF1FEF1
7	0101010101010101	0101010101010101
8	FEFEFEFEFEFEFEFE	FEFEFEFEFEFEFEFE
9	E0E0E0E0F1F1F1F1	E0E0E0E0F1F1F1F1
10	1F1F1F1F0E0E0E0E	1F1F1F1F0E0E0E0E

The first 6 keys have duals different than themselves, hence each is both a key and a dual giving 12 keys with duals. The last four keys equal their duals, and are called self-dual keys. These are the four previously discussed keys for which double encryption equals no encryption, i.e., the identity mapping. The dual of a key (which has a dual) is formed by dividing the key into two halves of eight hexadecimal characters each and circular shifting each half by two characters. No other keys are known to exist which have duals.

Data may be decrypted first and then encrypted (rather than encrypted and then decrypted) and result in plaintext. Plaintext may be encrypted several times and then decrypted the same number of times with the same key and result in plaintext. Similarly, data maybe encrypted successively by different keys and decrypted successively by the same keys to produce the original data, if the decryption operations are performed in the proper (inverse) order. If D1(E1(P)) = P is read "Encrypting plaintext with Key 1 and then decrypting the result with Key 1 yields the plaintext," then the following are true:

•	1. E1(D1(P))= P

•	2. E1(E1(P))= P for self-dual keys

•	3. D1(D1(E1(E1(P))))= P

•	4. E1(E1(D1(D1(P))))= P

•	5. D1(D2(E2(E1(P))))= P

•	6. D1(D2(...(Dj(Ej...(E2(E1(P)...) = P

•	7. E1(E2(...(Ej(Dj...(D2(D1(P)...) = P

•	8. E2(E1(P)) = P for dual keys

•	9. D2(D1(P)) = P for dual keys

but in general the following is not true:

•	10. D2(D1(E2(E,(P))))= P.

  Feedback


Strength of DES
 Strength

The cryptographic algorithm used by DES transforms a 64-bit binary value into a unique 64-bit binary value based on a 56-bit variable. If the complete 64-bit input is used (i.e., none of the input bits should be predetermined from block to block) and if the 56-bit variable is randomly chosen, no technique other than trying all possible keys using known input and output for the DES will guarantee finding the chosen key.

As there are over 70,000,000,000,000,000 (seventy quadrillion) possible keys of 56 bits, the feasibility of deriving a particular key in this way is extremely unlikely in typical threat environments. Moreover, if the key is changed frequently, the risk of this event is greatly diminished.

However, users should be aware that it is theoretically possible to derive the key in fewer trials (with a correspondingly lower probability of success depending on the number of keys tried) and should be cautioned to change the key as often as practical. Users must change the key and provide it a high level of protection in order to minimize the potential risks of its unauthorized computation or acquisition.

   Note

•	The feasibility of computing the correct key may change with advances in technology.

  Feedback


 DES modes

The DES algorithm specifies a mathematical transformation of a 64- bit input block to a 64-bit output block using a key. Specific examples of this transformation are given in NBS Special Publication 500-20.

EK(I) = O  and  DK(O) = I  are read "Enciphering the input I using key K results in output O" and "Deciphering the output O using key K results in input I." Given the same I and K, the same O always results. Likewise, given the same O and K, the same I results.

If the input at time t is called It, then the output is called Ot. A sequence of input blocks to the DES may be denoted as I1, I2, I3, ...On. The outputs are similarly denoted as O1, O2, O3,...On.

The DES specifies only the functions E and D. Other considerations will define the input and how the output is used. Many different possibilities exist but the application generally dictates which ones are feasible. In order to provide compatibility between devices which are able to communicate, four modes of operation are specified in FIPS PUB 81 (DES Modes of Operation).

  Feedback


 Electronic Codebook (ECB) mode

The simplest mode of operation, the Electronic Code book (ECB), is the DES algorithm specified in FIPS PUB 46. In the ECB mode of operation, the algorithm is independent of time and is called a memoryless system. Given the same data and the same key, the resultant cipher will always be the same. This characteristic should be considered when designing a cryptographic system using the ECB mode. The output block Ot is not dependent on any of the previous inputs, I1, 12 ...,It-1. It is important to note that the full 64-bits of the Ot must be available in order to obtain the original input it.

A general guideline for using the DES in this mode is that all possible inputs should be allowed and used whenever possible. Since the security of the data in this mode is based on the number of inputs in the code book, this number should be maximized whenever possible. In particular this mode should never be used for enciphering single characters (e.g., 8-bit ASCII characters by entering them in a fixed 8- bit position and filling the other 56 bits with a fixed number). Two to the 64th inputs are possible in this mode and as large a subset as feasible should be used. Random information should be used to pad small blocks and the random information discarded when the block is deciphered.

Data should be entered into the input register so that the first character of input appears on the left, the second character to the right of it, etc., and the last character on the far right. Using shift register technology, the characters should enter on the right and be shifted left until the register is full. Similarly, the output of the DES should be taken from left to right when being transmitted or stored in character serial mode. Using shift register technology, the characters should exit from the left and the register shift left until the register is empty.

  Feedback


 Cipher Block Chaining (CBC) mode

A method of using the DES algorithm in which the blocks of cipher are chained together is called the Cipher Block Chaining (CBC) mode. The input to the DES at time t is defined to be the exclusive or (represented by (+) ) of the data at time t and the cipher at time t-1. The cipher at time O is defined to be a quantity called the initialization vector or W. The CBC mode requires complete blocks of 64 bits until the final block is to be enciphered.

The final (terminal) data block of a message or record may not contain exactly 64 bits when processing in the CBC mode. When this occurs, either the terminal block must be padded to 64 bits or the terminal block must be enciphered in a way that yields the same number of bits as the input. The first technique is called padding and the second is called truncation.

When a sequence of characters is being enciphered and the terminal block contains less than the maximum number of characters (e.g., eight in the case of 8-bit characters), then padding may be used to format the final input block in the following way. Suppose P padding characters are needed to fill out the block. If P equals one, the character representing the number one should be put in the last byte position. If P is greater than one, the character representing the number P should be put in the last byte and zeros should be put in the remaining P-1 byte positions. In most coding schemes, the last three bits of the character representing a digit are the same as the binary representation of the digit (e.g., the ASCII representation of the character 4 is a hexadecimal 34). One bit may be used in the header block of a message packet to signify a padded message (i.e., that the final block of the packet is padded) or some other method must be devised.

Truncation may be used in the CBC mode when the number of cipher bits must be the same as the number of input bits. It may be necessary that an enciphered tape contain the same number of records and the same number of characters per record as the unenciphered tape. This requirement also occurs in some message switching systems in which the record length is fixed. In these cases the following method can be used to encipher the terminal block which does not contain 64 bits.

The short terminal block is enciphered by encrypting the previous cipher block in the ECB mode and exclusive OR'ing the result to the terminal data block. The receiver must detect the short cipher block and perform the same operation, i.e., encrypt the previous complete cipher block and perform the exclusive OR operation to obtain the original plaintext block. If a short terminal block contains B bits, then the leftmost B bits of the enciphered cipher block are used. This technique normally provides adequate security for the final block, but it should be noted that if the last B bits of plaintext are known to an active wiretapper, he or she may alter the last B bits of cipher so that they will decrypt to any desired plaintext. This is because, if only the last B bits are altered, the same value will be exclusive OR'ed to the short cipher block upon decryption.

One or more bit errors within a single cipher block will affect the decryption of two blocks (the block in which the error occurs and the succeeding block). If the errors occur in the tth cipher block, then each bit of the tth plaintext block will have a average error rate of 50 percent. The (t+1)st plaintext block will have only those bits in error which correspond directly to the cipher bits in error, and the (t+2)nd plaintext block will be correctly decrypted. Thus, the CBC mode synchronizes itself one block after the error.

  Feedback


 Cipher Feedback (CFB) mode

The Cipher Feedback (CFB) mode of operation may be used in applications which require chaining to prevent substitution or where blocks of 64 bits cannot be used efficiently. Most computer data that are to be transmitted or stored are coded in 6- to 8-bit codes. FIPS PUB 1 requires the use of the 7-bit ASCII code for interchange. In many communications protocols the units of data are bits or characters rather than blocks. The Cipher Feedback Mode of using the DES satisfies a requirement for encrypting data elements of length K where 1 < K < 64.

In CFB mode, the input to the DES algorithm is not the data itself but rather the previous 64 bits of cipher. The first encryption uses an initialization vector (IV) as its I0 input. In the CFB mode both the transmitter and the receiver of data use only the encryption operation of the DES. The output at time t is the 64-bit block Ot. The cipher at time t is produced by exclusive OR'ing the K bits of plaintext Pt to the leftmost K bits of Ot. This cipher Ct is transmitted and also is entered on the right-side of the input register after the previous input is shifted left K bit positions. The new input is used for the next encipherment.

A 64-bit IV is generated at time O and put into the input register. From that time on, the cipher text will depend on this initial input. In order to fill the receiver's input register, one of two events must occur:

•	The receiver must independently generate the identical initial fill.

•	The transmitter must transmit sufficient data to fill the receiver's input register.

A guideline is that the transmitter generates a pseudorandom number (48 to 64 bits) and transmits it as the IV. The transmitter and the receiver shall use this number (with the high order bits of the 64. bit DES input padded with "0" bits if necessary) as the 64-bit IV. Using a higher number of bits provides higher security but also results in higher transmission overhead. It is desirable that no two messages enciphered with the same key use the same IV. The DES may be used as a pseudorandom number generator to generate the IV. Start-stop (asynchronous) communications devices should transmit the IV as characters with appropriate start-stop bits appended.

In the CFB mode, errors within a K-bit unit of cipher will affect the decryption of the garbled -cipher and also the decryption of succeeding cipher until the bits in error have been shifted out of the DES input block. The first affected K-bit unit of plaintext will be garbled in exactly those places where the cipher is in error. Succeeding decrypted plaintext will have an average error rate of 50 percent until all errors have been shifted out of the input block. Assuming no additional errors are encountered during this time, the correct plaintext will then be obtained. Thus, the CFB mode is self-synchronizing.

The CFB mode of operation is also useful for the encryption of stored data. For maximum efficiency 64-bit data elements are used. If the terminal data block does not contain a full 64 bits of data, the remaining bits are padded before encryption. However, the cipher block may be truncated so that only the cipher bits corresponding to the unpadded bits are used. In this case the number of cipher bits will equal the number of data bits.

When using the K-bit CFB mode the last K bits of cipher can be altered by an active wiretapper who knows the last K bits of plaintext so that the final K bits will decrypt to any desired K bits of plaintext. This is the same threat that applies to the CBC mode with terminal block truncation. If this is a significant threat, it is recommended that the final K bits of plaintext be a function of the previous plaintext bits (i.e., a parity or sum check).

  Feedback


 Output Feedback (OFB) mode

The Output Feedback (OFB) mode, like the CFB mode, operates on data units of length K where K is an integer from l to 64. However, the OFB mode does not chain cipher from one time to the next. A one bit error in cipher text causes only one bit of the decrypted plaintext to be in error. Therefore, this mode can be useful in applications where no error propagation is required.

The output of the OFB mode is independent of both plaintext and cipher. Therefore, the OFB mode does not have the self-synchronization property of the CBC and CFB modes. If synchronization is lost then a new IV must be established between the transmitter and receiver.

  Feedback


 Relationship of CBC and 64-bit CFB

Like CBC, the CFB mode of operation can be used to encrypt 64-bit blocks. In this case the entire 64 bits of Ot are exclusive ORed with 64 bits of plaintext at each encryption time. This is called the 64-bit CFB mode of operation.

Let M1 be a 64-bit CFB machine with key schedule, KS = (K1,K2,..., K16), on each of the 16 encryption rounds. In CFB mode the same schedule is also used for decryption. Let M2 be a CBC machine with a key schedule of KR =(K16,K15,...,K1) for encryption (i.e., the DES decipher operation), and (K1,K2,..., K16) for decryption (i.e., the DES encipher operation). If M1 encrypts the 64-bit plaintext blocks P1, P2, and P3 with initialization vector IV to form cipher C1, C2, and C3; then M2 will encrypt P3,P2, and P1 with initialization vector C3 to form cipher C22, C1, IV. Similarly while M1 will decrypt C1, C2, and C3 (using initialization vector IV) to P1, P2, and P3; M2 will decrypt C2, C1, and IV (using initialization vector C3) to P3, P2, and P1. Thus by reversing (IV,C1,C2,C3) to (C3,C2,C1,IV) we may decrypt cipher generated by M1 with M2.

To see that the above statements are true let E[S](X) represent the encryption of X in the ECB mode using key schedule S, and let D[S](X) be the ECB decryption of X under schedule S. Note that S is the key schedule and not the key itself. Decryption uses the key schedule in the reverse order of encryption. Thus, E[KS](X) = D[KR](X). The encryption of P1, P2, and P3 by M1 using IV may be described by three equations:

•	P1(+) E[KS] (IV) = P1(+) O1 = C1

•	P2(+) E[KS] (C1) = P2(+) O2 = C2

•	P3(+) E(KS] (C2) = P3(+) O33 = C3

O1, O2, and O3 represent ECB encryption, with key schedule KS, of inputs IV, C1, and C2 respectively. (+) is a 64-bit exclusive or operator. The encryption of P3, P2, and P1 by M2 using C3 as the initialization vector may also be described by three equations:

•	E[KR] (P3 (+) C3) = E[KR] (O3) = D[KS] (O3) = C2

•	E[KR] (P2 (+) C2) = E[KR] (O2) = D[KS] (O2) = C1

•	E[KR] (P1 (+) C1) = E[RR] (O1) = D[KS] (O1) = IV

By reversing the key schedules, the inputs, and the outputs we have obtained equivalent machines. Similar equations may be derived for decryption, and the relationship holds for an arbitrary length stream of 64-bit plaintext blocks.

  Feedback


 CBC and CFB for data authentication

The DES can be used for data (message) authentication. A Message Authentication Code (MAC) is computed as a Cryptographic function of the data (message). The MAC is then stored or transmitted with the data. Only those knowing the secret key can recompute the MAC for the received data and verify that the data has not been modified by comparing the computed MAC with the stored or transmitted MAC. An unauthorized recipient of the data who does not possess the key cannot modify the data and generate a new MAC to correspond with the modified data.

This technique is useful in applications which require maintaining data integrity but which do not require protecting the data from disclosure. For example, computer programs may be stored in plaintext form with a computed MAC appended to the program file. The program may be read and executed without decryption. However, when the integrity of the program is questioned, a MAC can be computed on the program file and compared with the one stored in the file. If the two MACs compare, and the cryptographic key used to generate the MAC has been protected, then the program file has not been modified.

A MAC may be computed using either the CBC or the CFB mode. In CBC authentication, a message is encrypted in the normal CBC manner but the cipher is discarded. If the number of data bits is not a multiple of 64, then the last data bit is appended with zeros on the right to form an integral number of blocks. The most significant M bits of the final output block are used as the MAC.

In CFB authentication, a message is encrypted in the normal CFB manner except that the cipher text is discarded. After encrypting the final K bits of data and feeding the resulting cipher text back into the DES input block, the DES device is operated one more time and the most significant M bits of the resulting DES output block are used as the MAC.

In both CBC and CFB authentication, a MAC should be used that is as long as practical. Since a MAC is an error detection code (which is computed using Cryptographic techniques), a long MAC is desirable. Bit manipulation within a message will be detectable with a probability of 1 1/2M) Saying that a message is authentic or concluding that it has not been modified is based upon this probability. The proposed Federal Standard 1026 requires M to be at least 24 for Federal telecommunication applications. Financial transaction application standards are recommending M to be 32. Application designers should select M to optimize security and efficiency requirements.

In ADP communications security applications a message numbering and verifying system should be used to detect the insertion of false messages, the deletion of valid messages, and the replay of previously valid messages. The combined use of a Message Identifier (MID) and a MAC achieves these security objectives and protects against modification. If the data source MAC and the data destination MAC are in agreement and if the MID ages with the value expected by the receiver, then the message is accepted. The MID should be unique and deterministic for each message transmitted between a sender and receiver. The uniqueness may be achieved through the use of a non-repeating binary counter

  Feedback


More information on DES
 More information

You can find more information about the DES (Data Encryption Standard) encryption algorithm in the following documents:

•	Federal Information Resources Management Regulations (FIRMR) subpart 201.20.303, Standards, and subpart 201.39.1002, Federal Standards.

•	FIPS PUB 31, Guidelines to ADP Physical Security and Risk Management.

•	FIPS PUB 41, Computer Security Guidelines for Implementing the Privacy Act of 1974.

•	FIPS PUB 65, Guideline for Automatic Data Processing Risk Analysis.

•	FIPS PUB 73, Guidelines for Security of Computer Applications.

•	FIPS PUB 74, Guidelines for Implementing and Using the NBS Data Encryption Standard.

•	FIPS PUB 81, DES Modes of Operation.

•	FIPS PUB 87, Guidelines for ADP Contingency Planning.

•	FIPS PUB 112, Password Usage.

•	FIPS PUB 113, Computer Data Authentication.

•	FIPS PUB 140-1, Security Requirements for Cryptographic Modules.

•	FIPS PUB 171, Key Management Using ANSI X9.17.

•	Other FIPS and Federal Standards are applicable to the implementation and use of this standard. In particular, the Code for Information Interchange, Its Representations, Subsets, and Extensions (FIPS PUB 1-2) and other related data storage media or data communications standards should be used in conjunction with this standard. A list of currently approved FIPS may be obtained from the National Institute of Standards and Technology, Computer Systems Laboratory, Gaithersburg, MD 20899.

•	Feistel, Horst, Cryptography and Computer Privacy, Scientific American, Vol. 228 No. 5, May 1973, pages 15-23.

•	Data Encryption Algorithm (DEA), American National Standards Institute ANSI X3.92

  Feedback


 Tutorial: Before you begin

This tutorial will walk you through a few basic steps and will show you how to encrypt, decrypt and delete (destroy) files using Interscope BlackBox.

The operations involved in securing data in your files are the following:

•	Encrypt files

•	Decrypt files

•	Destroy files

   Note

•	Although Interscope BlackBox will keep your files safe once they are encrypted, it was only designed to provide passive security. This means that you should only use it to encrypt files in trusted environments (free of keyboard spies and the like).

  Feedback


 Tutorial: Encrypting files

This tutorial you will teach you to quickly secure data in your files, by using encryption and wiping:

•	Encrypt files

You can encrypt files, or even whole directory structures, easily by selecting them in Windows Explorer or on the desktop, right-clicking them and the selecting [image] Encrypt… You will be prompted for a password and then all the selected files will be encrypted. If you also selected folders, then all content of (files in the) folder will be encrypted recursively (including all subfolders).

Be sure that you do not lose or forget your password, since if you do you will not be able to access the data in the encrypted files.

In case exclusion rules are in effect, the item [image] Encrypt… might not appear in context menus of some files and/or folders. Also, some settings might affect the files which will actually be encrypted or the way how they will be processed.

•	Decrypt files

•	Destroy files

  Feedback


Tutorial: Decrypt files
 Tutorial: Decrypting files

This tutorial you will teach you to quickly secure data in your files, by using encryption and wiping:

•	Encrypt files

•	Decrypt files

After you have some encrypted files (either encrypted by yourself or received from other users also running Interscope BlackBox), you can access the original content of the respective files by first decrypting them. To decrypt files you will need the password that was used to encrypt them.

You can decrypt files, or even whole directory structures, easily by selecting them in Windows Explorer or on the desktop, right-clicking them and the selecting [image] Decrypt… You will be prompted for the password and then all the selected files will be decrypted. If you also selected folders, then all content of (files in the) folder will be decrypted recursively (including all subfolders).

The item [image] Decrypt… will only appear for files that were actually encrypted with Interscope BlackBox or for folders containing encrypted files. Also, some settings might affect the way how they will be processed.

•	Destroy files

  Feedback


Tutorial: Destroy files
 Tutorial: Destroying files

This tutorial you will teach you to quickly secure data in your files, by using encryption and wiping:

•	Encrypt files

•	Decrypt files

•	Destroy files

To delete files securely, so that nobody can recover the sensitive information in you files, you must not delete it using the normal Windows or DOS deletion commands. This will only remove the file’s name from the file system so that you will no longer see it in Windows Explorer or using the command dir, but it will leave the file’s old content on the disk.

Instead, right-click the files and/or folders you want to securely delete (destroy) either in Windows Explorer or on the desktop, and select [image] Wipe Out. This will wipe the files first then delete them, assuring that no recovery is possible. Be very careful with this feature.

You can control the way how files are wiped from the settings dialog.

  Feedback


 Interscope BlackBox expired

Sorry for the inconvenience but your copy of Interscope BlackBox trial software has expired. To buy your own copy of the software you visit our website.


Overview of section Getting Results
 Overview

The Getting Results section goes through every feature in the Interscope BlackBox and provides detailed instructions on how you can use the respective feature. Here you can also find step-by-step guides designed to accomplish a specific security related task.

  Feedback


 Encrypting files and folders

	You can encrypt files or whole directory structures by simply selecting the files and/or folders that you want to encrypt, either in Windows Explorer or on the desktop, right-click them and select [image] Encrypt… You will then be prompted for a password and after you supply it all selected files and folders will be encrypted with the specified password. If you also selected folders, then all content of (files in the) folder will be encrypted recursively, including all subfolders. Be sure that you do not lose or forget your password(s), because if you do you will not be able to access the data in the files you encrypted.    Tip • You can create a single self-extracting archive file containing all the selected files and folder in encrypted form.
   Notes

•	It is possible that for some files you will not see the item [image] Encrypt… in the context menu. This is either because exclusion rules are in effect or because the respective file is already encrypted by BlackBox and you did not allow multiple encryption.

•	If you selected both files that are already encrypted and ones that are not, and also multiple encryption is disabled, then you will be allowed to perform encryption the files but all files that are already encrypted will be ignored.

•	You will have to enter the password twice, once for confirmation, so that you can be sure that you did not accidentally mistyped it.

•	You can alter the way files are processed by changing the processing settings.

  Feedback


How to encrypt files multiple times
 Encrypt files multiple times

It is possible to encrypt files multiple times. This essentially means that after a files is encrypted (protected) with a password it can be encrypted again with another password. You can think of it as levels of protection.

	To enable or disable multiple encryption, go to the Processing settings page and select the radio button Encrypt again or Ignore file, respectively.

When a file is encrypted multiple times, you can get the original data only if you decrypt it as many times (in inverse order) as many encryption steps were applied to that respective file.

   Note

•	When multiple encryption is enabled, even if only you (more exactly, only who knows the password used to encrypt) can access data in your encrypted files, any other user can apply another encryption step to those files, thus rendering them inaccessible to you too (unless of course you find out the new password). Thus, you should set BlackBox not to encrypt files multiple times.

  Feedback


How to encrypt large files when disk space is tight
 Encrypt large files when disk space is tight

Normally, Interscope BlackBox processes (encrypts and decrypts) files using temporary files. This means that before a file is encrypted or decrypted, BlackBox will make a temporary copy of it, process that copy, and then replace the original file with the processed temporary copy. This also makes sure that in case a power failure occurs, the computer hangs or other fatal system errors occurs, your original data will be preserved.

However, if you must encrypt large files and there is not enough temporary disk space, BlackBox will be unable to make a temporary copy of the file. In this case, you can set BlackBox to process files in-place (encrypting directly the original file, without making a temporary copy).

	To set BlackBox to encrypt files in-place, go to the Processing settings page and select the radio button In-place encryption/decryption always. You can also configure BlackBox to perform encryption using temporary files, and only process files in-place when there is not enough disk space (this mode is highly recommended).

   Tip

•	If you configure BlackBox to perform encryption using temporary files, and only process files in-place when there is not enough disk space, you should also check the box Ask for confirmation before in-place processing, so that you get notified before files will be processed in-place.

   Notes

•	Processing files via temporary copies is more fault-tolerant but less secure since data is duplicated (however, after it finishes using the temporary copies, BlackBox will wipe them using the shredder). Processing files in-place requires no additional disk space, but if the machine is powered off or hangs during processing, the data in the file currently being processed is lost (corrupted).

•	If processing files in-place, encryption cannot be cancelled using the Stop button in the progress dialog.

  Feedback


How to exclude files and folders from encryption
 Exclude files and folders from encryption

Encrypting files that are part of the operating system or files which are vital parts of the operating system itself or of some application can result in Windows (or some applications) failing to boot or function correctly. Interscope BlackBox supports exclusions rules, so that you can make sure that the files you specify will not get encrypted.

You can exclude files from encryption based on their attributes or their names.

	To exclude files from encryption, based on their attributes (hidden and system), go to the Exclusions settings page and check the buttons corresponding to the attributes you want (the button System files if you do not want to encrypt files with the “system” attribute set, respectively the button Hidden files if you do not want to encrypt files with the “hidden” attribute set).
	To exclude files based on their path and/or names, go to the Exclusions settings page, check the box Files and folders that are in the exclusion list below, then add an exclusion rule for every file, folder or group of files and/or folders that you want to exclude from encryption.

   Tips

•	You can use wildcards in the exclusion rules. The wildcards supported in exclusion rules are ? (stands for any character) and * (stands for any group containing 0 or more characters). You can use up to 10 wildcards in each exclusion rule.

•	If you exclude a folder from encryption, this means that the respective folder cannot be encrypted, no file in that folder can be encrypted nor any file or folder in any subfolder (at any depth) of that folder can be encrypted.

•	You should at least exclude from encryption the operating system folders (usually C:\Windows and C:\Windows\System) and the BlackBox application folder (usually C:\Program Files\Interscope BlackBox\2.0). Interscope BlackBox has a default exclusion list which includes these three folders and which you can restore anytime by pushing the button Default in settings page Exclusions.

  Feedback


How to create self-extracting encrypted archives
 Create self-extracting encrypted archives

Interscope BlackBox can create single file self-extracting encrypted archives that can contain one or more files, or even whole directory structures, protected by a password.

	To pack files and or folders in single-file encrypted archives, select the files and/or folders you want to be contained in the archive, right-click them, and select [image] Encrypt…. Then, in the password dialog check the box Encrypt to self-extracting file and provide a filename (with .exe extension) where you would BlackBox to create the archive in the File edit box. After making these settings, pushing Encrypt will create your archive.

   Tips

•	Because you cannot add files into a self-extracting archive, once it is created, if you want to add files from more than one folder into a self-extracting file, you should create a temporary folder, copy there all the files and folders you want to pack up, select them all in Windows Explorer and follow the procedure described above.

•	You can extract the content of a self-extracting encrypted archive by running it. If the archive contains folders, the original directory structure can  be also restored (optional).

•	To reduce the size of your archives, you can compress files before adding them into self-extracting encrypted archives. You can configure the compression Interscope BlackBox will use from the Self Extractor settings page.

  Feedback


How to encrypt files in multiple folders at once
 Encrypt files in multiple folders at once

If you want to encrypt files and/or folders from multiple locations (paths) at once, you can use the security set, First add all the files and/or folders in your security set, then lock them.

   Note

•	When you lock the security set you will only be asked one password. This means that all objects in the security set will be encrypted with the same password.

  Feedback


How to send encrypted files by e-mail
 Send encrypted files by e-mail

You can encrypt and send your files by e-mail in a single, easy, step.

	To e-mail your files securely, select the files and/or folders you want to send, right-click them and select [image] Encrypt and Send… This will encrypt your selection, then bring up a message window where you should enter the destination address in the To: field and click Send. The encrypted files will be inserted in the message as attachments.

   Notes

•	To be able to send files by e-mail, you will need to have a MAPI compliant messaging system (such as Microsoft Exchange or Microsoft Outlook) installed.

•	You can encrypt your files normally or to a self-extractor archive. If you create a self-extractor archive, only this singe self-extractor will be attached to the message, otherwise all the selected files will be attached.

•	If you also selected folders, then you must create a self-extractor archive, otherwise Interscope BlackBox cannot include all selected files (from all selected folders and their potential subfolders) in the message.

  Feedback


How to see information on encrypted files
 See information on encrypted files

You can see encryption-specific information for files that were encrypted with Interscope BlackBox (.des or .ibx). Simply open the file properties dialog (right-click the file in Windows Explorer) and go to the Encryption property page.

	To get to the dialog showing properties for a file, select the file you want info about in Windows Explorer or on the desktop, then select Properties… To see information about encryption of the file (only for files encrypted with Interscope BlackBox, that is files with .des or .ibx extension), click the page tab Encryption. Alternatively, you can simply hover your mouse over an encrypted file in Windows Explorer and a tool tip with encryption-related information will be displayed for that file.

   Tip

You can quickly decrypt a file while you are inspecting its encryption info, by pushing the Decrypt button. You will need the password(s) that was used to encrypt the file, though

   Note

•	To be able to see info tips in Windows Explorer, you must be running Windows 98, Windows 2000 or have Internet Explorer 4.0 or newer installed (with Active Desktop enabled).

  Feedback


 Decrypting files and folders

	You can decrypt files or whole directory structures by simply selecting the files and/or folders that you want to encrypt, either in Windows Explorer or on the desktop, right-click them and select [image] Decrypt… You will then be prompted for the password that was used when the files were encrypted. If you know the password and enter it in the password dialog, all selected files and folders will be decrypted to their original form. If you also selected folders, then all content of (files in the) folder will be decrypted recursively, including all subfolders.

   Notes

•	It is possible that some files be encrypted more than once, in which case decrypting them will result in another encrypted file. More generally, you will need a decryption step for each encryption step that was applied to a file. You can disable multiple encryption. from the processing settings. page.

•	If you selected more than one file, it is possible that two or more of the files were encrypted with different passwords. In this case, after supplying a decryption password, BlackBox will try decrypting files with it and if it finds a file for which the password is no good it will ask for another. BlackBox will remember all passwords that you entered (and it will try them on all successive files until it finds one that matches or until it exhausts them and asks for another) until all selected files are decrypted.

•	You can alter the way files are processed by changing the processing settings.

  Feedback


How to decrypt multiply encrypted files
 Decrypt multiply encrypted files

In you have file which were encrypted more than once, decrypting them will result in another encrypted file. You will then need to decrypt the resulting encrypted file, and so on, until you obtain the original file.

	To enable or disable multiple encryption, go to the Processing settings page and select the button Encrypt again or Ignore file, respectively.

When a file is encrypted multiple times, you can get the original data only if you decrypt it as many times (in inverse order) as many encryption steps were applied to that respective file.

   Note

•	When multiple encryption is enabled, even if only you (more exactly, only who knows the password used to encrypt) can access data in your encrypted files, any other user can apply another encryption step to those files, thus rendering them inaccessible to you too (unless of course you find out the new password). Thus, you should set BlackBox not to encrypt files multiple times.

  Feedback


How to decrypt large files when disk space is tight
 Decrypt large files when disk space is tight

Normally, Interscope BlackBox processes (encrypts and decrypts) files using temporary files. This means that before a file is encrypted or decrypted, BlackBox will make a temporary copy of it, process that copy, and then replace the original file with the processed temporary copy. This also makes sure that in case a power failure occurs, the computer hangs or other fatal system errors occurs, your original data will be preserved.

However, if you must decrypt large files and there is not enough temporary disk space, BlackBox will be unable to make a temporary copy of the file. In this case, you can set BlackBox to process files in-place (decrypting directly the file, without making a temporary copy).

	To set BlackBox to decrypt files in-place, go to the Processing settings page and select the radio button In-place encryption/decryption always. You can also configure BlackBox to perform decryption using temporary files, and only process files in-place when there is not enough disk space (this mode is highly recommended).

   Tip

•	If you configure BlackBox to perform decryption using temporary files, and only process files in-place when there is not enough disk space, you should also check the box Ask for confirmation before in-place processing, so that you get notified before files will be processed in-place.

   Notes

•	Processing files via temporary copies is more fault-tolerant but less secure since data is duplicated (however, after it finishes using the temporary copies, BlackBox will wipe them using the shredder). Processing files in-place requires no additional disk space, but if the machine is powered off or hangs during processing, the data in the file currently being processed is lost (corrupted).

•	If processing files in-place, decryption cannot be cancelled using the Stop button in the progress dialog.

  Feedback


How to extract files from a self-extracting archive
 Extract files from a self-extracting archive

Interscope BlackBox can create single file self-extracting encrypted archives that can contain one or more files, or even whole directory structures, protected by a password. You can extract files from such a self-extracting encrypted archive, you simply run it.

	To extract files and/or folders from a self-extracting encrypted archive created by Interscope BlackBox, select the archive in Windows Explorer or on the desktop and run it (double click it or right-click it and select Open). You will be asked the password that was used to protect (encrypt) files in this archive and a path where to extract the files. After providing these, pushing Extract will extract the files (provided the password is correct).

   Tip

•	If the self-extracting encrypted archive you are about to extract objects from contains folders, and you want to also restore the original directory structure, check the box Restore directory structure before clicking Extract.

  Feedback


How to decrypt files in multiple folders at once
 Decrypt files in multiple folders at once

If you want to decrypt files and/or folders from multiple locations (paths) at once, you can use the security set, First add all the encrypted files and/or folders containing encrypted files in your security set, then unlock them.

  Feedback


How to open and edit an encrypted document
 Open and edit an encrypted document

If you have encrypted documents (files that can be edited by using some application) you can open them for editing using a single click.

	To open an encrypted document for editing, select it in Windows Explorer or on the desktop, and click it as you would do if the file would not be encrypted. You will warned that the file is encrypted and asked if you want to decrypt it for editing. If you confirm this, you will be asked the password necessary to decrypt the file and then the file will be decrypted and opened for editing with its associated application.

   Note

•	After you finish editing a document, do not forget to encrypt it again, so that it stays safe. Interscope BlackBox will not do this for you automatically.

  Feedback


 Destroying files and folders

	To delete files securely, so that nobody can recover the sensitive information in you files, you must not delete it using the normal Windows or DOS deletion commands. This will only remove the file’s name from the file system so that you will no longer see it in Windows Explorer or using the command dir, but it will leave the file’s old content on the disk. Instead, right-click the files and/or folders you want to securely delete (destroy) either in Windows Explorer or on the desktop, and select [image] Wipe Out. This will first wipe the files, then delete them, thus assuring that no recovery is possible. Be very careful with this feature. If you also selected folders, then all content of (files in the) folder will be wiped out recursively, including all subfolders. Alternatively, you can safely destroy files and/or folders by sending them to the Send To menu or by dragging them onto the shredder: • To send objects to the shredder, you must make the shredder appear in the Send To menu. • To be able to drag objects onto the shredder, you must make the shredder to be visible on the desktop.
   Notes

•	It is possible that the item [image] Wipe Out does not appear in context menus of objects in Windows Explorer.

•	The files are wiped by using the shredder. It is possible to configure the shredder so that it only deletes files without doing any actual wiping. This mode is not recommended, tough.

•	You can configure how files are wiped out by changing the shredder settings.

  Feedback


How to display the shredder on the desktop
 Display the shredder on the desktop

You can display the shredder on the desktop, so that users can delete files and folders safely, by simply dragging them from Windows Explorer or from the desktop and dropping them on the shredder.

	To show the shredder on the desktop, go to the Shredder settings page, and check the box Show shredder on desktop.

   Note

•	After showing or removing the shredder on/from the desktop you might need to refresh your desktop before the changes become visible. You can do this by clicking anywhere on the desktop (where in to icon or desktop item) and pressing F5.

  Feedback


How to display the shredder in the Send To menu
 Display the shredder in the Send To menu

You can add the shredder to the Send To menu, so that users can delete files and folders safely, by sending them to the shredder. You can send files and/or folders to the shredder by right-clicking them, selecting Send To, then Shredder.

	To show the shredder in the Send To menu, go to the Shredder settings page, and check the box Show shredder in the Send To menu.
  Feedback


How to show wipe action in object context menus
 Show wipe action in object context menus

You can show the item [image] Wipe Out in context menus of files and folder in Windows Explorer and on the desktop, so that users can safely delete files and/or folders by using the context menu.

	To show an item for wiping in context menus of files and folders, go to the Shredder settings page, and check the box Show item context menus to delete with wipe.
  Feedback


How to make the shredder only delete files
 Make the shredder only delete files

Interscope BlackBox can delete files quickly or safely. You can configure it to delete files quickly by specifying that you do not want files to be wiped out before deletion.

	To configure the shredder to only delete files, without wiping them, go to the Shredder settings page, and select the radio button Delete.

   Note

•	If you do not wipe files before they are deleted, it is possible that files or parts or them be recovered using disk editing tools (such as Norton Utilities). Configuring BlackBox in this mode yields the same effect as deleting the file normally or dropping it onto the Recycle Bin. It is highly recommended that you wipe files before deletion.

  Feedback


How to make the shredder wipe files before delete
 Make the shredder wipe files before delete

Interscope BlackBox can delete files quickly or safely. You can configure it to delete files safely by specifying that you want files to be wiped out before deletion.

	To configure the shredder to wipe files before deleting them, go to the Shredder settings page, and select the radio button Wipe, then delete. You can also specify how many overwrite steps you want to apply to files. The more steps you use the safer is the destruction of the files but it takes more time to wipe. Usually one step is sufficient.

   Note

•	If you do not wipe files before they are deleted, it is possible that files or parts or them be recovered using disk editing tools (such as Norton Utilities). Configuring BlackBox in this mode yields the same effect as deleting the file normally or dropping it onto the Recycle Bin. It is highly recommended that you wipe files before deletion.

  Feedback


 What are exclusion rules?

Exclusion rules are the mans by which you can protect specific files and/or folder from being encrypted (accidentally). You protect files and folders by excluding them from encryption, either by attribute (only by “hidden” and “system” attributes) or by name/path.

  Feedback


How to exclude files and folders from encryption
 Exclude files and folders from encryption

Encrypting files that are part of the operating system or files which are vital parts of the operating system itself or of some application can result in Windows (or some applications) failing to boot or function correctly. Interscope BlackBox supports exclusions rules, so that you can make sure that the files you specify will not get encrypted.

You can exclude files from encryption based on their attributes or their names.

	To exclude files from encryption, based on their attributes (hidden and system), go to the Exclusions settings page and check the buttons corresponding to the attributes you want (the button System files if you do not want to encrypt files with the “system” attribute set, respectively the button Hidden files if you do not want to encrypt files with the “hidden” attribute set).
	To exclude files based on their path and/or names, go to the Exclusions settings page, check the box Files and folders that are in the exclusion list below, then add an exclusion rule for every file, folder or group of files and/or folders that you want to exclude from encryption.

   Tips

•	You can use wildcards in the exclusion rules. The wildcards supported in exclusion rules are ? (stands for any character) and * (stands for any group containing 0 or more characters). You can use up to 10 wildcards in each exclusion rule.

•	If you exclude a folder from encryption, this means that the respective folder cannot be encrypted, no file in that folder can be encrypted nor any file or folder in any subfolder (at any depth) of that folder can be encrypted.

•	You should at least exclude from encryption the operating system folders (usually C:\Windows and C:\Windows\System) and the BlackBox application folder (usually C:\Program Files\Interscope BlackBox\2.0). Interscope BlackBox has a default exclusion list which includes these three folders and which you can restore anytime by pushing the button Default in settings page Exclusions.

  Feedback


How to include files and folders in encryption
 Include files and folders in encryption

If you do not see the [image] Encrypt… item in the context menu of a file or folder, it means that the respective file or folder is excluded from encryption, so that you do not encrypt it accidentally. If, however, you want to encrypt the respective file or folder, you can (re)include it in encryption by removing the exclusion rule which protects it.

	To (re)include files and folders in encryption, go to the Exclusions settings page and look for an exclusion rule that covers the file or folder you want. File system objects can be excluded from encryption based on their attributes or based on their names/paths. You should first look for the most specific rules and then for more general ones. So, first check if in the list Current exclusion list is a rule for the name of the object (only if the box Files and folders that are in the exclusion list below is checked). If not, see if there is a rule for the folder containing the object or for any folder in the path to that respective object. Last you can check if the object you want has the system and/or hidden attribute an clear the boxes System files and/or Hidden files, respectively.

   Tips

•	If you exclude a folder from encryption, this means that the respective folder cannot be encrypted, no file in that folder can be encrypted nor any file or folder in any subfolder (at any depth) of that folder can be encrypted.

•	You should at least exclude from encryption the operating system folders (usually C:\Windows and C:\Windows\System) and the BlackBox application folder (usually C:\Program Files\Interscope BlackBox\2.0). Interscope BlackBox has a default exclusion list which includes these three folders and which you can restore anytime by pushing the button Default in settings page Exclusions.

  Feedback


How to reset exclusion rules to default
 Reset exclusion rules to default

Interscope BlackBox comes with a default exclusion rules list that contains the Windows operating system folders, the folders where BlackBox is installed and the Recycle Bins (among others). You can restore this default exclusion list with a single click, at any time.

	To restore the default exclusion rules, go to the Exclusions settings page and press the Defaults button.

   Tip

•	You should at least exclude from encryption the operating system folders (usually C:\Windows and C:\Windows\System) and the BlackBox application folder (usually C:\Program Files\Interscope BlackBox\2.0). Interscope BlackBox has a default exclusion list which includes these three folders and which you can restore anytime by pushing the button Default in settings page Exclusions.

  Feedback


How to sort exclusion rules
 Sort exclusion rules

Every time you select files using the Windows shell (Windows Explorer, desktop, common file dialogs, etc.) and right-click them to bring up a context menu, Interscope BlackBox has to decide what encryption related operations should be displayed in the context menu. This means that it must check each selected file against the exclusion rules you specified in the Exclusions settings page. BlackBox searches the rules in the exclusion list in the order they appear in the exclusion list on that page.

To speed up the file system operations that involve displaying context menus, you should sort (optimize) the exclusion rules so that the ones that refer to the folders and file names you use most come first.

	To sort exclusion rules, go to the Exclusions settings page, make sure the box Files and folders that are in the exclusion list below is checked, then select the exclusion rule you want and move upper (if the name if refers to is going to be more often used) or lower (if the name it refers to will be less frequently used) in the exclusion list. Repeat this procedure for each rule you want to optimize (make more or less important).

   Note

•	Interscope BlackBox will first check exclusion by attributes before checking the exclusion rules entered in the Current exclusion list control.

  Feedback


 What is the security set?

The security set is a tool designed to facilitate easy and comprehensive encryption/decryption of files, possibly spread among many disk drives and folders. It is essentially a list of files that you can lock (encrypt) or unlock (decrypt) with two mouse clicks and the overhead necessary to type a password.

You can add and remove files and folders from the security set,  its content,  it,  it and  its status (locked, unlocked or being processed and the number of objects in the set) easily.

   Tip

•	You can add all your sensitive files in the security set, and then unlock them in the morning when you arrive at the office, and lock them back again when you leave. This also ensures that you do not forget to lock any file when you leave.

   Note

•	Each user has its own security set. This means that each user can add privates files to the security set without worrying about other users locking/unlocking the files when they log on.

  Feedback


How to add files and folders in the security set
 Add files and folders in the security set

You can add sensitive files in the security set, so that you can lock them all with a single encryption operation. The files in the security set can be spread across multiple folders or even disk drives.

	To add files and/or folders in the security set, select them, either in Windows Explorer or on the desktop, right-click and select [image] Add to security set…. Alternatively, you can add and remove objects in/from the security set by going to the Security Set settings page and using the buttons Add Files… and Add Dir…

   Tip

•	You can include folders in the security set, which will result in all files and subfolders in that folder will be protected. When you lock the security set all child objects will be encrypted, and when you unlock it all child objects will be unlocked. This allows you to create a secure folder on your hard drive, add it to the security set, and then simply copy and delete (wipe) sensitive files and folders in/from it without worrying about encryption. You can then later encrypt or decrypt all these files and/or folders by simply locking or unlocking the security set.

   Note

•	It is possible that the menu item [image] Add to security set…. does not appear in the context menu of some objects in Windows Explorer. This is either because the respective file or folder is excluded (protected) from encryption or because BlackBox is configured not to show this item in context menus.

  Feedback


How to remove files and folders the security set
 Remove files and folders the security set

If you have files which you do not use frequently (so that they don’t need to be locked and unlocked every time you lock and unlock the security set) or which you want to destroy included in the security set, you can remove them from the security set and then process (encrypt, decrypt, edit or delete/wipe) separately.

	To remove files and/or folders from the security set, go to the Security Set settings page, select the  file or folder you want to remove fro the security set and press Delete.

   Notes

•	Removing objects from the security set will not remove them from the disk. Instead, they will remain in the state that the set was in (locked or unlocked) when you removed them.

•	Each time you manipulate the security set, Interscope BlackBox will check that the objects included in the security set still exist on the disk. If any of the items was removed or is inaccessible, your security set will be automatically updated.

  Feedback


How to reset the security set
 Reset the security set

If you want to remove all objects from the security set, you can reset the security set.

	To reset (remove all files and folders from) the security set, go to the Security Set settings page, and press Reset. You will be asked a confirmation prior to resetting the set.

   Note

•	Resetting the security set will not remove the objects included in security set from the disk. Instead, they will remain in the state that the set was in (locked or unlocked) when you reset it.

  Feedback


How to lock the security set
 Lock the security set

You can lock (encrypt) all files and folders included in the security set at once, by locking the security set.

	To lock (encrypt) the objects (files and/or folders) contained in the security set, make sure that the security set monitor is displayed in the system tray, right-click on the security set icon in the tray and select Lock… You will be asked a password to use to protect files in the security set. Alternatively, you can click Start, then Programs, then Interscope BlackBox, then Security Set and then Lock...

   Note

•	When you lock the security set you will be asked only one password, which will be used to encrypt all the files in the set. If you need to have different password for each of your files, you should encrypt and decrypt them manually (one by one).

  Feedback


How to unlock the security set
 Unlock the security set

You can unlock (decrypt) all files and folders included in the security set at once, by unlocking the security set.

	To unlock (decrypt) the objects (files and/or folders) contained in the security set, make sure that the security set monitor is displayed in the system tray, right-click on the security set icon in the tray and select Unlock… You will be asked the password that was used to lock the security set. Alternatively, you can click Start, then Programs, then Interscope BlackBox, then Security Set and then Unlock...
  Feedback


How to consolidate the security set
 Consolidate the security set

You can copy or move all objects (files and folders) in your security set to a single folder, by consolidating the security set.

	To consolidate your security set, make sure that the security set monitor is displayed in the system tray, right-click on the security set icon in the tray and select Consolidate… Then choose a destination folder, adjust the consolidation parameters and click OK. Alternatively, you can click Start, then Programs, then Interscope BlackBox, then Security Set and then Consolidate...
  Feedback


How to show security set action in context menus
 Show security set action in context menus

You can add files and folders in the security set easily from the shell, without having to open the Security Set settings page. You simply right-click files and/or folders you want to include tem in the security set.

	To show the item [image] Add to security set… in context menus of files and folders, go to the Security Set settings page, and check the box Show item context menus to add selection to security set.

   Note

•	The menu item [image] Add to security set…. does not appear in the context menu of objects that are excluded (protected) from encryption.

  Feedback


How to monitor status of the security set
 Monitor status of the security set

Interscope BlackBox constantly monitors all objects (files and folders) that are included in the security set, and if one of these object is changed, renamed or deleted the security set will be automatically updated. In addition, BlackBox can show the status of the security set (locked, unlocked, being processed as well as the number of objects in the set) in the system tray.

	To show the status of the security set in the system tray, go to the Appearance settings page, and check the box Show monitor in system tray.
   Tip

•	When the security set monitor is shown in the system tray you can use it to quickly see the status of the security set (just move your mouse over the icon and a tool tip will appear with info about the security set) and to lock/unlock/configure the security set (right-click the icon and then choose Lock…, Unlock… or Configure… respectively).

  Feedback


Appearance options
 Appearance settings

From this settings page you can configure the appearance of the files encrypted with Interscope BlackBox in Windows Explorer and on the desktop.

	Windows can show the same icon for all files encrypted with Interscope BlackBox (files with .des or .ibx extension) or the original icon of each file with an overlapped key (so that you know that the file is encrypted):
	Check the radio button Same locker icon for all encrypted files if you want Windows to show the same icon for all BlackBox-encrypted files.
	Check the radio button Original file’s icon with and overlapped key image if you want Windows to show the original icon with an overlapped key for encrypted files.
	Check the box Show My Safe on desktop to put an item My Safe on the desktop, which you can use for quick drag-and-drop encryption. If you drop files or folders on this icon, they will be encrypted. If you drop encrypted files on it, they will be decrypted. If you drop both encrypted and plain files on it, you will be asked what to do.
	Check the box Show monitor in the system tray if you want to monitor the status of the security set in the system tray. This will cause an icon to be added to the system tray that you can use to check the status of the set (number of files, if locked or unlocked, etc.). In addition, from the icon on the system try you will also have access to clipboard and current window’s text encryption and decryption.
	Check the box All encryption context menu items in a submenu to have all encryption-related context menu items BlackBox adds in the context menus of files and folders to be grouped together in a submenu. This helps reduce the pollution of the Windows Explorer context menus and keeps encryption out of the way until you need it.
	Check the box Show info tooltips for encrypted files if you want to see tooltips with encryption related information (original size, algorithm, key size, owner, etc.) when you hover your mouse over encrypted files in Windows Explorer or on the desktop.
  Feedback


Processing options
 Processing settings

From this settings page you can configure how files are processed (encrypted and decrypted) and whether users can encrypt the same file multiple times.

	Interscope BlackBox can encrypt files more than once. When files are encrypted multiple times, you can get the original data only if you decrypt them as many times (in inverse order) as many encryption steps were applied to those respective files. You can enable or disable this behavior:
	Check the radio button Ignore file if you want to only allow encryption of files once.
	Check the radio button Encrypt again if you want to allow encryption of files multiple times.
	Interscope BlackBox can process files via temporary files or in-place. Processing via temporary files means that before a file is encrypted or decrypted, BlackBox will make a temporary copy of it, process that copy, and then replace the original file with the processed temporary copy. When processing in-place files will be encrypted/decrypted directly, without making a temporary copy. You can select how BlackBox should operate:
	Check the radio button In-place encryption/decryption always if you want to force in-place processing of files.
	Check the radio button Temporary file if you want to use temporary files when processing data. • Check the box Process in-place when no space for temporary file if you want to use temporary files but also be able to encrypt/decrypt large files when there is not enough disk space for a temporary copy. • Check the box Ask for confirmation before in-place processing if you also want to be notified (and have a chance to cancel) when BlackBox is about to process any file in-place.
	Interscope BlackBox can store the identity of the users (the login name) who own the data that is encrypted into files. You can enable or disable this feature:
	Tick the box Store user identity in encrypted files if you want to save the identity of the owner in encrypted files.

   Notes

•	When multiple encryption is enabled, even if only you (more exactly, only who knows the password used to encrypt) can access data in your encrypted files, any other user can apply another encryption step to those files, thus rendering them inaccessible to you too (unless of course you find out the new password). Thus, you should set BlackBox not to encrypt files multiple times.

•	Processing files via temporary copies is more fault-tolerant but less secure since data is duplicated (however, after it finishes using the temporary copies, BlackBox will wipe them using the shredder). Processing files in-place requires no additional disk space, but if the machine is powered off or hangs during processing, the data in the file currently being processed is lost (corrupted).

•	If processing files in-place, decryption cannot be cancelled using the Stop button in the progress dialog.

  Feedback


Algorithm options
 Algorithm settings

From this page you can select the algorithm to use when encrypting files as well as download and install new encryption algorithms (encryption engines).

	The algorithm (encryption engine that implements the respective algorithm) that will be used to encrypt new files is always highlighted in the engine list. You can change the algorithm to use when encrypting new files:
	In the Installed algorithms list, select the one that you want to use to encrypt new files.
	If you want to be prompted to download and install necessary algorithms when you attempt to decrypt files for which there is no suitable engine installed on your computer, check the box Download and install algorithms on first use.
	To browse the Interscope BlackBox encryption engine library, download and install new algorithms, click Library…

   Notes

•	Changing the encryption algorithm will only affect files that you will encrypt from now on, already encrypted files are not touched. Also, to decrypt files that you already have encrypted or files that you receive from others you will have to install the same algorithm(s) that were used to encrypt the respective files.

•	On systems with many applications installed, it can take some time until BlackBox scans the registry for all installed encryption engines.

  Feedback


Exclusion options
 Exclusion settings

From this page you can specify files and folders that users should not be allowed to encrypt, thus protecting those files and folders.

	You can exclude files and folders from encryptions based on their attributes (hidden and system attributes are considered only), their names or their location (path) in the file system:
	Check the box System files if you want to disallow encryption of files and folders which have the “system” attribute set.
	Check the box Hidden files if you want to disallow encryption of files and folders which have the “hidden” attribute set.
	Check the box if you want to exclude files and folders from encryption based on their names and/or path. Then specify the rules in the list Current exclusion list.
	To add a new exclusion rule in the list, type the rule in the edit box New exclusion rule and then click Insert. Rules can contain the wildcards ? (stands for any character) and * (stands for any group containing zero or more characters).
	To remove an exclusion rule, select it in the list Current exclusion list and then click Remove.
	To sort the exclusion list and make an exclusion rule more important (faster to apply), select it in the list Current exclusion list and click Move Up as many times as necessary. You should move the rules that refer to files and/or folders you use most in front of the list.
	To sort the exclusion list and make an exclusion rule less important, select it in the list Current exclusion list and then click Move Down as many times as necessary.
	To restore the default exclusion rules list, click the button Defaults.

   Notes

•	Interscope BlackBox will first check exclusion by attributes before checking the exclusion rules entered in the Current exclusion list control.

•	To speed up the file system operations that involve displaying context menus, you should sort (optimize) the exclusion rules so that the ones that refer to the folders and file names you use most come first.

  Feedback


Self-extractor options
 Self-extractor settings

From this page you can control how Interscope BlackBox creates single file self-extracting encrypted archives.

	Self-extracting encrypted archives can contain one or more files, or even whole directory structures, protected by a password. When creating such archives, BlackBox can handle the files that it adds in the archive in several ways:
	Check the radio button Leave source files in original if you want to leave the files you add in the encrypted archive on the disk.
	Check the radio button Leave source files encrypted if you want to leave the files you add in the encrypted archive on the disk, but encrypted with the same password that you used to protect the self-extracting archive.
	Check the radio button Delete source files if you want to delete the files after they are added in the encrypted archive.
	Check the box Ignore exception list if you want to add all selected files and/or folders in the self-extracting encrypted archive, no matter if they are normally protected from being encrypted by some exclusion rule.
	To compress files before they are encrypted, check the box Use compression.
	To tune the compression Interscope BlackBox will use, select one of the compression modes from the Compress Mode combo box. Choose Fastest to favor compression speed, Maximum to favor size reduction or Normal for a balance between the two (default).
  Feedback


Security set options
 Security set settings

From this page you can configure the security set. This includes the content of the security set and the ways how it can be accessed.

	You can configure how files are added in the security set and how the set can be locked and unlocked:
	Check the box Show item context menu to add selection to security set if you want that a menu item [image] Add to security set…. appear in the context menus of files and folders when you right-click them in Windows Explorer or on the desktop.
	To add files in the security set, click Add Files…, then navigate to the folder that contains your files, select them and click Add. You can only add files from a single folder at once. To add files from multiple folders, repeat this procedure for every folder.
	To add a folder in the security set, click Add Dir…, then navigate to the folder you want, select it and click Add.
	To remove a file or folder from the security set, select it in the list Current security set then click Delete.
	To reset the content (remove all included files and/or folders) of the security set, click Reset.

   Notes

•	It is possible that the menu item [image] Add to security set…. does not appear in the context menu of some objects in Windows Explorer. This is either because the respective file or folder is excluded (protected) from encryption or because BlackBox is configured not to show this item in context menus.

•	Resetting the security set or removing objects from it will not remove them from the disk. Instead, they will remain in the state that the set was in (locked or unlocked) when you removed them.

•	Each time you manipulate the security set, Interscope BlackBox will check that the objects included in the security set still exist on the disk. If any of the items was removed or is inaccessible, your security set will be automatically updated.

•	This page is disabled while the security set Is being locked or unlocked.

  Feedback


Shredder options
 Shredder settings

From this page you can configure the appearance and operation mode of the shredder.

	You can configure the appearance of the shredder, how files are deleted (destroyed) when they are dropped or sent to the shredder as well as how many overwrite steps should be performed during wipe:
	Check the box Show item context menus to delete with wipe if you want that a menu item [image] Wipe Out appear in the context menus of files and folders when you right-click them in Windows Explorer or on the desktop. You can then use this menu item to wipe the selected files and/or folders.
	Check the box Show shredder on desktop if you want to see a shredder icon on your desktop. You can then drag files and/or folders and drop them on the shredder when you want to destroy them.
	Check the box Show shredder in the Send To menu if you want to have an item Shredder in you Send To menu. You can then destroy files and/or folders by right-clicking them, selecting Send To, then Shredder.
	To have BlackBox only delete files when you drop them on the shredder, check the radio button Delete.
	To have BlackBox wipe files before deleting them when you drop them on the shredder, check the radio button Wipe, then delete. • You can also configure the number of overwrite steps to perform when wiping files by entering the number of steps in the Overwrite steps edit box.

   Note

•	If you do not wipe files before they are deleted, it is possible that files or parts or them be recovered using disk editing tools (such as Norton Utilities). Configuring BlackBox in this mode yields the same effect as deleting the file normally or dropping it onto the Recycle Bin. It is highly recommended that you wipe files before deletion.

  Feedback


Configure options
 Configure settings

When you want to configure the way Interscope BlackBox operates, you can bring up the settings dialog by clicking Start, then Programs, then Interscope BlackBox and then BlackBox Settings.

Alternatively, you can get to the settings dialog in several other ways:

•	When encrypting or decrypting files, by using the button Settings in the password dialog.

•	If the shredder is displayed on the desktop, you can click it to open the settings dialog to the page Shredder. Or you can right-click the shredder and select Configure… (it is the default item)

•	If the monitor of the security set is shown in the system tray, you can right-click on its icon and then select Configure… This will open the settings dialog to the page Security Set.

  Feedback


 Encrypt dialog

In this dialog you can provide the password to use to protect (encrypt) the selected files and/or folders, configure how files should be encrypted, whether to create a single file self-extracting encrypted archive from the selected files. You can also see copyright information and license status.

You should at least enter the password you want to use in the edit box labeled Password, and then retype it in the edit box labeled Confirm. When finished entering the password(s) and configuring other settings, click Encrypt to actually encrypt the selected files and/or folders.

	To create a self-extracting encrypted archive that will contain all selected files and/or folders, check the box Encrypt to self-extracting file and then specify a file name (with .exe extension) in the edit box File. You can use the Browse… button to select an existing file (will be overwritten).
	To cancel encryption of the selected files/and or folders (or locking of the security set), click Cancel.
	To configure settings of Interscope BlackBox click on Settings…
	To see copyright information for Interscope BlackBox and to check the status of your license (and trial period) click on About….

   Notes

•	Passwords are case sensitive.

•	In case your copy of Interscope BlackBox is not yet registered, the remaining trial days (or the fact that trial period expired) are shown in the caption of this dialog.

•	You will see this dialog every time you encrypt files and/or folders or when you lock the security set.

  Feedback


 Decrypt dialog

In this dialog you must provide the password that was used to protect (encrypt) the selected files and/or folders, in order to decrypt them and make the data in the files available. You can also configure how files should be decrypted and can see copyright information and license status.

You should enter the password (in case you know it) in the edit box labeled Password. When finished entering the password and configuring other settings, click Decrypt to actually decrypt the selected files and/or folders.

	To configure settings of Interscope BlackBox click on Settings…
	To cancel encryption of the selected files and/or folders (or unlocking of the security set), click Cancel.
	To see copyright information for Interscope BlackBox and to check the status of your license (and trial period) click on About….

   Notes

•	Passwords are case sensitive.

•	In case your copy of Interscope BlackBox is not yet registered, the remaining trial days (or the fact that trial period expired) are shown in the caption of this dialog.

•	You will see this dialog every time you decrypt files and/or folders or when you unlock the security set.

  Feedback


Decrypt dialog (2)
 Decrypt dialog

In this dialog you must provide the password that was used to protect (encrypt) a for a specific file, in order to decrypt it and make the data in the file available. You can also see copyright information and license status.

You should enter the password (for the file displayed in the edit box File) in the edit box labeled Password. When finished entering the password, click Decrypt to actually decrypt the respective file.

	To skip this file (leave it encrypted) and continue decrypting any remaining selected files and/or folders, click Skip.
	To cancel encryption of this file and any remaining files, click Cancel.
	To see copyright information for Interscope BlackBox and to check the status of your license (and trial period) click on About….

   Notes

•	Passwords are case sensitive.

•	In case your copy of Interscope BlackBox is not yet registered, the remaining trial days (or the fact that trial period expired) are shown in the caption of this dialog.

•	You will see this dialog every time you decrypt multiple files and/or folders and at least two of the files that you are decrypting were encrypted using different passwords.

  Feedback


 Overview of BlackBox development

Interscope BlackBox is an open framework for file encryption. It can host encryption engines (aka algorithms or plug-ins) that implement the actual data encryption. By default, BlackBox comes with the standard 56-bit DES engine (this allows for basic security and provides compatibility with .des files encrypted by previous versions of Interscope BlackBox).

Additional encryption engines can be developed by third parties or can be downloaded from the Interscope BlackBox website at http://www.essentialdetails.com/blackbox/enginesp.asp.

Interscope makes freely available all the documentation you might need to write your own encryption engine that you can plug into Interscope BlackBox. To get the BlackBox SDK, point your browser to http://www.essentialdetails.com/blackbox/sdkp.asp.

  Go to Interscope homepage

  Go to Interscope BlackBox homepage

  Get the BlackBox SDK

  Feedback


More information on BlackBox development
 More information

All encryption engines that Interscope BlackBox can host are implemented as COM in-process servers. This makes them very flexible (usable from a large variety of programming languages such as C/C++, Java, Visual Basic, Delphi, etc. and environments such as web or Active Server Pages, Windows Scripting Host source files and a bunch of other scripting clients). It also means that you can write your own engines with whatever tool suits you, as long as it can create COM components.

If you want to use the encryption engines shipped with Interscope BlackBox for custom encryption tasks they are available for licensing. Please send your queries to blackbox@essentialdetails.com.

We also provide on-line technical support relating development of BlackBox compliant encryption engines.

  Go to Interscope homepage

  Go to Interscope BlackBox homepage

  Get the BlackBox SDK

  Feedback


 Current Window Encryption

You can use this feature to encrypt or decrypt the text in a random window. To achieve this, you select the desired window and using BlackBox tray icon menu you select Current Window and the needed operation (encrypt/decrypt).

Encrypt text in the current window

Encrypt text in the current window to file

Decrypt text in the current window

  Feedback


 Clipboard Encryption

You can use this feature to encrypt or decrypt the text in the clipboard. To achieve this, you select the desired window and using BlackBox tray icon menu you select Clipboard and the needed operation.

The text in the clipboard is encrypted with the passphrase you provide. After the encryption completed you can simply paste the encrypted text in your documents.

  Feedback


 Microsoft Word Integration

Using the Word plug-in BlackBox you can now encrypt or decrypt the text in your documents.

 Note:

•	If you want to disable or enable this feature, please go to BlackBox setting dialog box and select Customize from the settings list.

•	You cannot encrypt HTML e-mail.

  Feedback


 Microsoft Outlook Integration

Using the Outlook plug-in BlackBox you can now encrypt or decrypt the text in your e-mails.

 Note:

•	If you want to disable or enable this feature, please go to BlackBox setting dialog box and select Customize from the settings list.

  Feedback


 Microsoft Outlook Express Integration

Using the Outlook Express plug-in BlackBox you can now encrypt or decrypt the text in your e-mails.

 Note:

•	If you want to disable or enable this feature, please go to BlackBox setting dialog box and select Customize from the settings list.

  Feedback


 Command Line Parameters

The command line parameters listed below can be used to start Interscope BlackBox (ibbx.exe). They are not case sensitive, but must appear before any filenames. Surround any parameters containing spaces with quotation marks (“). Using command line with BlackBox allows you to run encryption tasks from your own applications.

Usage: ibbx [/a][/b][/o:n][/l | /u | /c][/e | /d | /f][/g:new_self_extractor][/k:password][/x][filename]

/a - Show the about dialog

/b - Submit defect report

/o - Show settings dialog (followed by optional settings page number)

/d - Decrypt

/e Encrypt

/f - Encrypt to self-extractor (implies /e)

/g - The self-extractor file to create

/l - Lock security set

/u - Unlock security set

/c - Consolidate security set

/k - Specifies password to use

/x - The specified filename designates a temporary file containing a list of files and folders (one per line, folders end in backslash) to process (encrypt/decrypt). File is deleted after processing.

 Note:

•	File and folder names can contain spaces if they are enclosed between quotes (“”). If passwords contain spaces, they must be also quotes, in which case they cannot contain the quote character (“).

•	If might be useful to add the path where ibbx.exe resides to environment variable PATH.

  Feedback


 Auto Update

This new feature of Interscope BlackBox allows you to automatically update your copy of Interscope BlackBox directly from our website.

This update can be manually at your request or automatically. Using BlackBox settings, Automation & Tools/Updates, you can set the options for the auto-update feature.

The Auto Update feature is useful because we constantly improve our existing products and by using it you ensure that you are always using the latest version available.

 Note:

•	You need to have online connectivity in order to use this feature

  Feedback


 Automatically Add New Encryption Engines

Interscope BlackBox can host plug-ins that implement various encryption algorithms, thus giving you the possibility to upgrade the strength and speed of encryption by installing new engines. Usually, the bigger the key size of an engine, the safer (and probably slower) it is.

Here at Interscope, we continuously develop new encryption engines. Also we made freely available on our website the Encryption Engine Software Development Kit allowing other developers to produce new engines. If you need a new and a more powerful engine, you can download and install a new engine.

 Note:

•	By default Interscope BlackBox will only install DES56, due to US export restrictions. But you can easily add new and more powerful encryption engines, using this feature, and downloading directly from our website.

•	You can install and uninstall the encryption engines, independently of Interscope BlackBox. To remove an encryption engine from your computer, go to the Add/Remove Programs control panel applet.

•	To see all engines installed on your computer, look in the Algorithms settings page. Click Start, then Programs, then Interscope BlackBox and then BlackBox Settings.

  Feedback


 Keyboard Shortcuts

Using keyboard shortcuts you can access BlackBox features directly. Just define your own shortcuts and when needed BlackBox features will be available just pressing the respective shortcut.

  Feedback


 System Tray Icon Overview

The system tray context menu allows you to access Current Window and Clipboard text operations, Security Set operations, as well as the BlackBox settings. You can also choose to hide the system tray icon or to refresh the status of the icon.

  Feedback


 Encrypt text

Text encrypt is a new feature that allows you to encrypt text from the current window or from the clipboard. The encrypted text can then be pasted into documents.

Here is a sample of encrypted text using this feature:

----------BEGIN BLACKBOX DATA----------

Version: 4.0.0.1014 (www.essentialdetails.com/blackbox)

Engine: {714DE928-E5DE-4004-B5DE-2420D409DF08},2,192_

Br.sCN1t3BoKLlW.2P.3EgujhQZAr40lO8aVgdYrGMWdIHMKzlpkG4YPeGSz

t5PCeaCw4f8uKZRimGrlpjxzTzyAv7cWpF.ODylf6VEsA2vAhNFFsZkbFPZa

BqrsumbbaFMi9lb8E4KSt43ou2YHIFe2q6CC5xbVhWJm1ar6LzoFEbTfgslB

aMZl7ftM8h0WWKbNBZchp6oxozfdbvSflOLqtggqBCGqn4Hcs8foIUGo1FmJ

VYWe_YvC.cj6FLhDcdTeWRndH1VBI.U6Ty7.j4baFMi9lb8E4KSt43oPCeaC

----------END BLACKBOX DATA----------

   Notes

•	Passwords are case sensitive.

  Feedback


 Encrypt text on clipboard

You can encrypt the content of the clipboard by simply right-clicking on the BlackBox tray icon and selecting the Clipboard/Encrypt command.

You will be required to enter a passphrase and the result will be placed in clipboard. The encrypted text will simply overwrite the plain text.

   Notes

•	Check the appearance setting to make sure the clipboard operations are displayed in the system tray icon context menu.

•	Make sure the content of the clipboard is plain-text. This function will not allow you to encrypt other types of clipboard content.

  Feedback


 Encrypt text on the clipboard to file

You can encrypt the content of the clipboard and place the result in a file by simply right-clicking on the BlackBox tray icon and selecting the Clipboard/Encrypt to File command.

You will be required to enter a passphrase and the result will be placed in to a newly created file.

   Notes

•	Check the appearance setting to make sure the clipboard operations are displayed in the system tray icon context menu.

•	Make sure the content of the clipboard is plain-text. This function will not allow you to encrypt other types of clipboard content.

  Feedback


 Encrypt text in the current window

You can encrypt the content of the clipboard by simply right-clicking on the BlackBox tray icon and selecting the Current Window/Encrypt command.

You will be required to enter a passphrase and the result will be placed in the same window which was used to extract text from. The encrypted text will simply overwrite the plain text.

   Notes

•	Check the appearance setting to make sure the current window operations are displayed in the system tray icon context menu.

  Feedback


 Encrypt text in the current window to file

You can encrypt the content of the clipboard by simply right-clicking on the BlackBox tray icon and selecting the Current Window/Encrypt to File command.

You will be required to enter a passphrase and the result will be placed in a newly created file.

   Notes

•	Check the appearance setting to make sure the current window operations are displayed in the system tray icon context menu.

  Feedback


 Decrypt text

Encrypted text can be decrypted by using the decrypt text command. The encrypted text can be available in clipboard or in a random desktop window.

  Feedback


 Decrypt text on the clipboard

If you have to decrypt some encrypted text you can insert it into the clipboard and then right-click BlackBox tray icon, and select Clipboard/Decrypt… command.

A passphrase will be required and the result in form of a plaintext will replace the original clipboard content.

  Feedback


 Decrypt text in the current window

If you have to decrypt some encrypted text you can make sure the window which contains the respective text is the current one and then right-click BlackBox tray icon, and select Current Window/Decrypt… command.

A passphrase will be required and the result in form of a plaintext will replace the original window content.

  Feedback


 Appearance Settings

From this settings page you can configure the appearance of the files encrypted with Interscope BlackBox in Windows Explorer and on the desktop.

The appearance settings are grouped into Interface Schemes. BlackBox installs three default schemes.

•	The standard interface includes most command integrated discretely in the shell and third-party applications.

•	The minimal interface only enables commands for file encryption and decryption, keeping most of BlackBox’s features hidden.

•	The full interface means that all commands and security-related operations are available, full integration with the windows shell, the desktop and third party applications.

To apply a new scheme you select a new interface scheme from the list and click Apply button.

The current installed interface will be shown along with its appearance details under the Current Summary section.

  Feedback


 Appearance/Shell Settings

The appearance of Windows Shell (Explorer) menus can be configured using this page.

  Feedback


 Appearance/System Tray Settings

The appearance of System Tray Icon and context menus can be configured using this page.

  Feedback


 Security Settings

All security settings as well as predefined security schemes can be easily configured using this page.

  Feedback


 Security/Algorithms Settings

From this page you can select the algorithm to use when encrypting files as well as download and install new encryption algorithms (encryption engines).

	The algorithm (encryption engine that implements the respective algorithm) that will be used to encrypt new files is always highlighted in the engine list. You can change the algorithm to use when encrypting new files:
	In the Installed algorithms list, select the one that you want to use to encrypt new files.
	If you want to be prompted to download and install necessary algorithms when you attempt to decrypt files for which there is no suitable engine installed on your computer, check the box Download and install algorithms on first use.
	To browse the Interscope BlackBox encryption engine library, download and install new algorithms, click Library…

   Notes

•	Changing the encryption algorithm will only affect files that you will encrypt from now on, already encrypted files are not touched. Also, to decrypt files that you already have encrypted or files that you receive from others you will have to install the same algorithm(s) that were used to encrypt the respective files.

•	On systems with many applications installed, it can take some time until BlackBox scans the registry for all installed encryption engines.

  Feedback


 Security/Shredder Settings

From this page you can configure the appearance and operation mode of the shredder.

	You can configure the appearance of the shredder, how files are deleted (destroyed) when they are dropped or sent to the shredder as well as how many overwrite steps should be performed during wipe:
	Check the box Show item context menus to delete with wipe if you want that a menu item [image] Wipe Out appear in the context menus of files and folders when you right-click them in Windows Explorer or on the desktop. You can then use this menu item to wipe the selected files and/or folders.
	Check the box Show shredder on desktop if you want to see a shredder icon on your desktop. You can then drag files and/or folders and drop them on the shredder when you want to destroy them.
	Check the box Show shredder in the Send To menu if you want to have an item Shredder in you Send To menu. You can then destroy files and/or folders by right-clicking them, selecting Send To, then Shredder.
	To have BlackBox only delete files when you drop them on the shredder, check the radio button Delete.
	To have BlackBox wipe files before deleting them when you drop them on the shredder, check the radio button Wipe, then delete. • You can also configure the number of overwrite steps to perform when wiping files by entering the number of steps in the Overwrite steps edit box.

   Note

•	If you do not wipe files before they are deleted, it is possible that files or parts or them be recovered using disk editing tools (such as Norton Utilities). Configuring BlackBox in this mode yields the same effect as deleting the file normally or dropping it onto the Recycle Bin. It is highly recommended that you wipe files before deletion.

  Feedback


 Security/Exclusion Settings

From this page you can specify files and folders that users should not be allowed to encrypt, thus protecting those files and folders.

	You can exclude files and folders from encryptions based on their attributes (hidden and system attributes are considered only), their names or their location (path) in the file system:
	Check the box System files if you want to disallow encryption of files and folders which have the “system” attribute set.
	Check the box Hidden files if you want to disallow encryption of files and folders which have the “hidden” attribute set.
	Check the box if you want to exclude files and folders from encryption based on their names and/or path. Then specify the rules in the list Current exclusion list.
	To add a new exclusion rule in the list, type the rule in the edit box New exclusion rule and then click Insert. Rules can contain the wildcards ? (stands for any character) and * (stands for any group containing zero or more characters).
	To remove an exclusion rule, select it in the list Current exclusion list and then click Remove.
	To sort the exclusion list and make an exclusion rule more important (faster to apply), select it in the list Current exclusion list and click Move Up as many times as necessary. You should move the rules that refer to files and/or folders you use most in front of the list.
	To sort the exclusion list and make an exclusion rule less important, select it in the list Current exclusion list and then click Move Down as many times as necessary.
	To restore the default exclusion rules list, click the button Defaults.

   Notes

•	Interscope BlackBox will first check exclusion by attributes before checking the exclusion rules entered in the Current exclusion list control.

•	To speed up the file system operations that involve displaying context menus, you should sort (optimize) the exclusion rules so that the ones that refer to the folders and file names you use most come first.

  Feedback


 Security/Advanced Settings

From this settings page you can configure how files are processed (encrypted and decrypted) and whether users can encrypt the same file multiple times.

	Interscope BlackBox can encrypt files more than once. When files are encrypted multiple times, you can get the original data only if you decrypt them as many times (in inverse order) as many encryption steps were applied to those respective files. You can enable or disable this behavior:
	Check the radio button Ignore file if you want to only allow encryption of files once.
	Check the radio button Encrypt again if you want to allow encryption of files multiple times.
	Interscope BlackBox can process files via temporary files or in-place. Processing via temporary files means that before a file is encrypted or decrypted, BlackBox will make a temporary copy of it, process that copy, and then replace the original file with the processed temporary copy. When processing in-place files will be encrypted/decrypted directly, without making a temporary copy. You can select how BlackBox should operate:
	Check the radio button In-place encryption/decryption always if you want to force in-place processing of files.
	Check the radio button Temporary file if you want to use temporary files when processing data. • Check the box Process in-place when no space for temporary file if you want to use temporary files but also be able to encrypt/decrypt large files when there is not enough disk space for a temporary copy. • Check the box Ask for confirmation before in-place processing if you also want to be notified (and have a chance to cancel) when BlackBox is about to process any file in-place.
	Interscope BlackBox can store the identity of the users (the login name) who own the data that is encrypted into files. You can enable or disable this feature:
	Tick the box Store user identity in encrypted files if you want to save the identity of the owner in encrypted files.

   Notes

•	When multiple encryption is enabled, even if only you (more exactly, only who knows the password used to encrypt) can access data in your encrypted files, any other user can apply another encryption step to those files, thus rendering them inaccessible to you too (unless of course you find out the new password). Thus, you should set BlackBox not to encrypt files multiple times.

•	Processing files via temporary copies is more fault-tolerant but less secure since data is duplicated (however, after it finishes using the temporary copies, BlackBox will wipe them using the shredder). Processing files in-place requires no additional disk space, but if the machine is powered off or hangs during processing, the data in the file currently being processed is lost (corrupted).

•	If processing files in-place, decryption cannot be cancelled using the Stop button in the progress dialog.

  Feedback


 Customize Settings

Using the checkboxes on this page you can customize the level of integration with third-party products.

  Feedback


 Keyboard Settings

From this page you can customize the keyboard shortcuts.

  Feedback


 Security Set Settings

From this page you can configure the security set. This includes the content of the security set and the ways how it can be accessed.

	You can configure how files are added in the security set and how the set can be locked and unlocked:
	Check the box Show item context menu to add selection to security set if you want that a menu item [image] Add to security set…. appear in the context menus of files and folders when you right-click them in Windows Explorer or on the desktop.
	To add files in the security set, click Add Files…, then navigate to the folder that contains your files, select them and click Add. You can only add files from a single folder at once. To add files from multiple folders, repeat this procedure for every folder.
	To add a folder in the security set, click Add Dir…, then navigate to the folder you want, select it and click Add.
	To remove a file or folder from the security set, select it in the list Current security set then click Delete.
	To reset the content (remove all included files and/or folders) of the security set, click Reset.

   Notes

•	It is possible that the menu item [image] Add to security set…. does not appear in the context menu of some objects in Windows Explorer. This is either because the respective file or folder is excluded (protected) from encryption or because BlackBox is configured not to show this item in context menus.

•	Resetting the security set or removing objects from it will not remove them from the disk. Instead, they will remain in the state that the set was in (locked or unlocked) when you removed them.

•	Each time you manipulate the security set, Interscope BlackBox will check that the objects included in the security set still exist on the disk. If any of the items was removed or is inaccessible, your security set will be automatically updated.

•	This page is disabled while the security set Is being locked or unlocked.

  Feedback


 Self-Extractor Settings

From this page you can control how Interscope BlackBox creates single file self-extracting encrypted archives.

	Self-extracting encrypted archives can contain one or more files, or even whole directory structures, protected by a password. When creating such archives, BlackBox can handle the files that it adds in the archive in several ways:
	Check the radio button Leave source files in original if you want to leave the files you add in the encrypted archive on the disk.
	Check the radio button Leave source files encrypted if you want to leave the files you add in the encrypted archive on the disk, but encrypted with the same password that you used to protect the self-extracting archive.
	Check the radio button Delete source files if you want to delete the files after they are added in the encrypted archive.
	Check the box Ignore exception list if you want to add all selected files and/or folders in the self-extracting encrypted archive, no matter if they are normally protected from being encrypted by some exclusion rule.
	To compress files before they are encrypted, check the box Use compression.
	To tune the compression Interscope BlackBox will use, select one of the compression modes from the Compress Mode combo box. Choose Fastest to favor compression speed, Maximum to favor size reduction or Normal for a balance between the two (default).
  Feedback


 Automation and Tools Settings

Using this settings you can customize the level of automation and other external tools.

  Feedback


 Update Settings

You can use these settings to customize how BlackBox will update itself.

  Feedback


Consolidate Security Set

You can consolidate the security set using this dialog.