Valid values: | yes or no or full |
|---|---|
Default value: | no |
If set to yes, files that are compiled into the installation (via [Files] section entries) will be encrypted using XChaCha20 encryption.
If set to full, the entire installation will be encrypted, and the password must be specified using the /PASSWORD= command-line parameter.
If set to yes or full and you call the ExtractTemporaryFile function from the [Code] section prior to the user entering the correct password, the function will fail unless the noencryption flag is used on the [Files] section entry for the file.
If set to yes or full the 256-bit XChaCha20 encryption key is derived from the value of Password using the function specified by EncryptionKeyDerivation.
The 192-bit XChaCha20 encryption nonces are derived from a single random base nonce. For each chunk of compressed data, the compiler combines the base nonce using XOR with the chunk's start offset and the index of its first disk slice. This gives each chunk a unique nonce. Other encrypted data uses a start offset of 0 and reserved negative slice indexes instead.
See also:
Password
EncryptionKeyDerivation