xref: /freebsd/contrib/file/magic/Magdir/crypto (revision f5f40dd63bc7acbb5312b26ac1ea1103c12352a6)
1
2#------------------------------------------------------------------------------
3# $File: crypto,v 1.4 2023/07/17 16:41:48 christos Exp $
4# crypto:  file(1) magic for crypto formats
5#
6# Bitcoin block files
70		lelong			0xD9B4BEF9	Bitcoin
8>(4.l+40)	lelong			0xD9B4BEF9	reverse block
9>>4		lelong			x		\b, size %u
10# normal block below
11>0		default			x		block
12>>4		lelong			x		\b, size %u
13>>8		lelong&0xE0000000	0x20000000
14>>>8		lelong			x		\b, BIP9 0x%x
15>>8		lelong&0xE0000000	!0x20000000
16>>>8		lelong			x		\b, version 0x%x
17>>76		ledate			x		\b, %s UTC
18# VarInt counter
19>>88		ubyte			<0xfd		\b, txcount %u
20>>88		ubyte			0xfd
21>>>89		leshort			x		\b, txcount %u
22>>88		ubyte			0xfe
23>>>89		lelong			x		\b, txcount %u
24>>88		ubyte			0xff
25>>>89		lequad			x		\b, txcount %llu
26!:ext	dat
27# option to find more blocks in the file
28#>>(4.l+8)	indirect	x			;
29
30# LevelDB
31-8		lequad		0xdb4775248b80fb57	LevelDB table data
32
33# http://www.tarsnap.com/scrypt.html
34# see scryptenc_setup() in lib/scryptenc/scryptenc.c
350	string		scrypt\0	scrypt encrypted file
36>7	byte		x		\b, N=2**%d
37>8	belong		x		\b, r=%d
38>12	belong		x		\b, p=%d
39
40# https://age-encryption.org/
41# Only the first recipient is printed in detail to prevent repetitive output
42# in extreme cases ("ssh-rsa, ssh-rsa, ssh-rsa, ...").
430	string		age-encryption.org/v1\n age encrypted file
44>25	regex/128	\^[^\040]+	\b, %s recipient
45>>25	string		scrypt
46>>>&0 regex/64		[0-9]+\$	(N=2**%s)
47>>&0	search/256	\n->\040 	\b, among others
48
490	string		-----BEGIN\040AGE\040ENCRYPTED\040FILE-----	age encrypted file, ASCII armored
50