From de46599a970e2f0d3372a2ea96a3933102b9364d Mon Sep 17 00:00:00 2001 From: Jakob Unterwurzacher Date: Sun, 24 Apr 2016 12:42:04 +0200 Subject: Describe long file name handling --- docs/img/file-name-encryption.svg | 686 +++++++++++++++++++++----------------- docs/img/longnames.svg | 364 ++++++++++++++++++++ docs/security.md | 23 ++ 3 files changed, 760 insertions(+), 313 deletions(-) create mode 100644 docs/img/longnames.svg (limited to 'docs') diff --git a/docs/img/file-name-encryption.svg b/docs/img/file-name-encryption.svg index 45222e2..49eed5c 100644 --- a/docs/img/file-name-encryption.svg +++ b/docs/img/file-name-encryption.svg @@ -1,6 +1,4 @@ - - + + + + + + + + id="marker9315" + style="overflow:visible"> + transform="matrix(-0.4,0,0,-0.4,-4,0)" /> + refY="0" + refX="0" + id="marker8949" + style="overflow:visible"> + + + + style="fill:#000000;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:1pt;stroke-opacity:1" + transform="matrix(-0.4,0,0,-0.4,-4,0)" /> + orient="auto"> + id="path4311" /> + orient="auto"> + id="path4311-4" /> + id="Arrow1Mend-6" + refX="0" + refY="0" + orient="auto"> + style="fill:#000000;fill-opacity:1;fill-rule:evenodd;stroke:#000000;stroke-width:1pt;stroke-opacity:1" + d="M 0,0 5,-5 -12.5,0 5,5 0,0 Z" + id="path4311-6" /> + id="marker8949-8" + style="overflow:visible"> + id="marker14911-3" + refX="0" + refY="0" + orient="auto"> + d="M 0,0 5,-5 -12.5,0 5,5 0,0 Z" + id="path14913-9" /> + orient="auto"> + id="path14913-3" /> - - - @@ -186,215 +179,282 @@ image/svg+xml - + - - - - Directory X - gocryptfs.diriv - - - AES-256-EME - - - - "letter.doc" - - - lrpyui0m-ypX4u0PNJ... - Master key - - - - IV - - Base64 - - + + + Directory X + gocryptfs.diriv + + + AES-256-EME + + + + "letter.doc" + + + lrpyui0m-ypX4u0J[...] + Master key + + + + IV + + Base64 + + + >255? + + + no + + yes + + long file name handling diff --git a/docs/img/longnames.svg b/docs/img/longnames.svg new file mode 100644 index 0000000..2cf1684 --- /dev/null +++ b/docs/img/longnames.svg @@ -0,0 +1,364 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + Directory X + gocryptfs.longname.[hash].name + + + SHA256 + + + Base64 + + + lrpyui0m-ypX4u0J[...] + + + long name storedin .name file + hash used fort short file name + + gocryptfs.longname.[hash] + file content + + diff --git a/docs/security.md b/docs/security.md index d43201a..fa74294 100644 --- a/docs/security.md +++ b/docs/security.md @@ -51,3 +51,26 @@ encryption. ![](img/file-name-encryption.svg) The Base64 encoding limits the usable filename length to 176 characters. +Filenames that are longer than that (longer than 255 characters in Base64- +encoded form) use long file name handling (since gocrytfs v0.9). + +Long File Name Handling +----------------------- + +If the Base64-encoded encrypted name is longer than 255 characters, +it cannot be used as the file name on disk, as Linux filesystems +do not allow names longer than that. + +Instead, the encrypted name is hashed, and the file content is stored in +`gocryptfs.longname.[hash]`. The long file name is stored in a support +file, `gocryptfs.longname.[hash].name`. + +![](img/longnames.svg) + +This method for storing long file names has zero performance impact +for filenames that are <= 176 characters, incurs no extra disk accesses +for opening a file with a long name, and just one extra file read for each +long-name file on readdir(1). + +Because the hash is only taken from the encrypted file name, there is no +security penalty for using long names. -- cgit v1.2.3