We have to implement a facility to provide download capability of files to a limited group of clients. The information in the files is subject to HIPAA and FERPA guidelines. We will be using SFTP, but want to go further. We want to encrypt the files themselves at 128-bit or higher and then make them self-extracting on the Windows computers of our clients that will download them. This entire operation needs to be scriptable with replaceable parameters since the data source for the files will also generate a password we want to assign to the encrypted zip package. Our site and sources are RHEL 4 and 5 servers. Our clients will be WinXP. We do not want to have to purchase/maintain digital signature certificates. We must to be able to script the encryption and password assignment on the files.

Is there a single-source, multi-platform solution for accomplishing this scenario? Is single-source necessary? Are purchased products necessary?

You can use pgp or Gnu pgp to do the encryption. Doing the encryption on the Linux side is easily scripted. Not sure about the Windows side.

Starting here might help:
http://www.gnupg.org/

The catch here is if you absolutely need to generate self decrypting archives - I've only seen SDA functionality available from the commercial PGP (PGP Corporation, etc) vendors. Also, you will need the command line version if you want to automate (script) the process and licenses are not cheap (unless your mid-large corporation is covering the costs). But it is trivial to wrap sh/bash, Perl, etc. around the pgp executable when using the command line version. An SDK is also available (I think it only supports C on Unix/Linux) if you need it.