1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
|
Other Projects
==============
There are several open-source file encryption solutions for Linux available. In contrast
to disk-encryption software that operate on whole disks (TrueCrypt, dm-crypt etc), file
encryption operates on individual files that can be backed up or synchronised easily.
This page compares:
* [gocryptfs](https://nuetzlich.net/gocryptfs/) (this project), aspiring successor of EncFS
* [EncFS](https://github.com/vgough/encfs), mature with known security issues
* [eCryptFS](http://ecryptfs.org/), integrated into the Linux kernel
* [Cryptomator](https://cryptomator.org/), strong cross-platform support through Java, WebDAV and [FUSE](https://github.com/SerCeMan/jnr-fuse).
* [securefs](https://github.com/netheril96/securefs), a cross-platform project implemented in C++.
Older versions stored directories in user-space B-trees
([filesystem format 1,2,3](https://github.com/netheril96/securefs/blob/2596467d63631aab264cf7a63de38fd69b2fda78/docs/design.md#full-format-format-version-123)).
The new default since v0.7.0
([filesystem format 4](https://github.com/netheril96/securefs/blob/2596467d63631aab264cf7a63de38fd69b2fda78/docs/design.md#lite-format-format-version-4))
uses normal directory entries.
* [CryFS](https://www.cryfs.org/), result of a master thesis at the KIT University that uses
chunked storage to obfuscate file sizes.
If you spot an error or want to see a project added, please
[file a ticket](https://github.com/rfjakob/gocryptfs-website)!
See also:
* [comparison table in the Arch Linux wiki](https://wiki.archlinux.org/title/Data-at-rest_encryption#Comparison_table)
* [comparison table on cryfs.org](https://www.cryfs.org/comparison#summary)
Overview
--------
<!--
The comparison table is too wide in markdown syntax to be edited sanely,
which is why I converted it to html.
-->
<table>
<tr>
<th></th>
<th>gocryptfs <br> v1.7</th>
<th>encfs <br> v1.9.5</th>
<th>ecryptfs <br> v4.19.0</th>
<th>cryptomator <br> v1.4.6</th>
<th>securefs <br> v0.8.3</th>
<th>CryFS <br> v0.10.0</th>
</tr>
<tr>
<td>First release</td>
<!-- gocryptfs --><td>2015 (<a href="https://github.com/rfjakob/gocryptfs/releases/tag/v0.1">ref</a>) </td>
<!-- encfs --><td>2003 (<a href="https://github.com/vgough/encfs/blob/439c90e040cc04c036ee0791d830779a6d6bf10e/ChangeLog#L1501">ref</a>) </td>
<!-- ecryptfs --><td>2006 (<a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=237fead619984cc48818fe12ee0ceada3f55b012">ref</a>) </td>
<!-- cryptomtr --><td>2014 (<a href="https://github.com/cryptomator/cryptomator/commit/e823bc9f0c11f4a3eaaf29f52f2627dfa8eefea1">ref</a>) </td>
<!-- securefs --><td>2015 (<a href="https://github.com/netheril96/securefs/releases/tag/v0.10">ref</a>) </td>
<!-- cryfs --><td>2015 (<a href="https://github.com/cryfs/cryfs/releases/tag/0.8.0_cryfs">ref</a>) </td>
</tr>
<tr>
<td>Language</td>
<!-- gocryptfs --><td>Go</td>
<!-- encfs --><td>C++</td>
<!-- ecryptfs --><td>C</td>
<!-- cryptomtr --><td>Java</td>
<!-- securefs --><td>C++</td>
<!-- cryfs --><td>C++</td>
</tr>
<tr>
<td>License</td>
<!-- gocryptfs --><td>MIT (<a href="https://github.com/rfjakob/gocryptfs/blob/830cbb7218d61467c011fd5e9d4751e1529677e4/LICENSE">ref</a>) </td>
<!-- encfs --><td>LGPLv3 / GPLv3 (<a href="https://github.com/vgough/encfs/blob/439c90e040cc04c036ee0791d830779a6d6bf10e/COPYING">ref</a>) </td>
<!-- ecryptfs --><td>GPLv2</td>
<!-- cryptomtr --><td>GPLv3 (<a href="https://github.com/cryptomator/cryptomator/blob/f84bb4710fb6aec54649de524f5f1be42632459d/LICENSE.txt">ref</a>) </td>
<!-- securefs --><td>MIT (<a href="https://github.com/netheril96/securefs/blob/2596467d63631aab264cf7a63de38fd69b2fda78/LICENSE.md">ref</a>) </td>
<!-- cryfs --><td>LGPLv3 (<a href="https://github.com/cryfs/cryfs/blob/d96342463088490bc418c7e9df24eb5eef00d90b/LICENSE">ref</a>) </td>
</tr>
<tr>
<td>Development hotspot</td>
<!-- gocryptfs --><td>Austria</td>
<!-- encfs --><td>USA</td>
<!-- ecryptfs --><td>USA (RedHat)</td>
<!-- cryptomtr --><td>Germany</td>
<!-- securefs --><td>China</td>
<!-- cryfs --><td>Germany</td>
</tr>
<tr>
<td>Lifecycle</td>
<!-- gocryptfs --><td>Active</td>
<!-- encfs --><td>Maintenance</td>
<!-- ecryptfs --><td>Active (<a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/fs/ecryptfs">ref</a>) </td>
<!-- cryptomtr --><td>Active</td>
<!-- securefs --><td>Active</td>
<!-- cryfs --><td>Active</td>
</tr>
<tr>
<td>File interface</td>
<!-- gocryptfs --><td>FUSE</td>
<!-- encfs --><td>FUSE</td>
<!-- ecryptfs --><td>In-kernel filesystem</td>
<!-- cryptomtr --><td>FUSE/WebDAV</td>
<!-- securefs --><td>FUSE</td>
<!-- cryfs --><td>FUSE</td>
</tr>
<tr>
<td>Platforms</td>
<!-- gocryptfs --><td>Linux, MacOS, 3rd-party Windows port <a href="https://github.com/bailey27/cppcryptfs">cppcryptfs</a>,
3rd-party Android port <a href="https://github.com/hardcore-sushi/DroidFS">DroidFS</a></td>
<!-- encfs --><td>Linux, MacOS, 3rd-party Windows port</td>
<!-- ecryptfs --><td>Linux</td>
<!-- cryptomtr --><td>Linux, MacOS, Windows</td>
<!-- securefs --><td>Linux, MacOS, Windows</td>
<!-- cryfs --><td>Linux, MacOS, Windows (experimental)</td>
</tr>
<tr>
<td>User interface</td>
<!-- gocryptfs --><td>CLI, 3rd-party GUI (<a href="https://mhogomchungu.github.io/sirikali/">SiriKali</a>)</td>
<!-- encfs --><td>CLI, 3rd-party GUI</td>
<!-- ecryptfs --><td>Integrated in login process</td>
<!-- cryptomtr --><td>GUI, 3rd-party CLI (<a href="https://github.com/cryptomator/cli">ref</a>) </td>
<!-- securefs --><td>CLI, 3rd-party GUI</td>
<!-- cryfs --><td>CLI, 3rd-party GUI (<a href="https://mhogomchungu.github.io/sirikali/">SiriKali</a>)</td>
</tr>
<tr>
<td>Reverse Mode</td>
<!-- gocryptfs --><td>yes (since v1.1, read-only)</td>
<!-- encfs --><td>yes (limited write support)</td>
<!-- ecryptfs --><td>no</td>
<!-- cryptomtr --><td>no</td>
<!-- securefs --><td>no</td>
<!-- cryfs --><td>no</td>
</tr>
</table>
General Security
----------------
| | gocryptfs | encfs default | encfs paranoia | ecryptfs | cryptomator | securefs | CryFS |
| ----------------------- | --------- | ------------- | -------------- | ------------------------------------ | ----------- | -------- | ------- |
| Documentation available | Yes [1] | Yes [2] | Yes [2] | No [4] | Yes [3] | Yes [5] | Yes [6] |
| Password hashing | scrypt | PBKDF2 | PBKDF2 | (none, implemented in external tool) | scrypt | PBKDF2 | scrypt |
References:
[[1]](forward_mode_crypto.md)
[[2]](https://github.com/vgough/encfs/blob/439c90e040cc04c036ee0791d830779a6d6bf10e/DESIGN.md)
[[3]](https://cryptomator.org/architecture/)
[[5]](https://github.com/netheril96/securefs/blob/2596467d63631aab264cf7a63de38fd69b2fda78/docs/design.md#lite-format-format-version-4)
[[6]](https://www.cryfs.org/howitworks)
[[4]](http://ecryptfs.org/documentation.html) actually, there is a lot of ecryptfs documentation, but none of
it seems to describe the used crypto.
File Contents
-------------
| | gocryptfs | encfs default | encfs paranoia | ecryptfs | cryptomator | securefs | CryFS |
| --------------------- | --------- | ----------------------- | ----------------------- | --------------------- | ---------------------- | ---------| --------------------- |
| Tested version | v1.7 | v1.9.5 | v1.9.5 | v4.19.0 | v1.4.6 | v0.8.3 | 0.10.0 |
| | | | | | | | |
| Encryption | GCM [1] | CBC; last block CFB [2] | CBC; last block CFB [2] | CBC | CTR with random IV [3] | GCM | GCM |
| Integrity | GCM | none | HMAC | none | HMAC | GCM | GCM |
| File size obfuscation | no | no | no | yes (4 KB increments) | no [4] | no [5] | yes (chunked storage) |
References:
[[1]](https://github.com/rfjakob/gocryptfs/blob/master/Documentation/file-format.md#file-format)
[[2]](https://github.com/vgough/encfs/issues/9)
[[3]](https://github.com/cryptomator/cryptomator/issues/128#issuecomment-168942517)
[[4]](https://github.com/cryptomator/cryptomator/releases/tag/1.2.0)
[[5]](https://github.com/netheril96/securefs/issues/39)
File Names
----------
| | gocryptfs | encfs default | encfs paranoia | ecryptfs | cryptomator | securefs | CryFS |
| ------------------------ | --------------------- | -------------------- | -------------------- | -------- | ------------ | ------------------ | ------------------ |
| Tested version | v1.4.1 | v1.9.2 | v1.9.2 | v4.12.5 | v1.5.15 AppImage FUSE | v0.7.3-30-g2596467 | 0.9.7-15-g3d52f6a8 |
| | | | | | | | |
| Encryption | EME [4] | CBC | CBC | CBC | AES-SIV | AES-SIV | GCM (dir DB) |
| Prefix leak | no (EME) | no (HMAC used as IV) | no (HMAC used as IV) | yes [2] | no (AES-SIV) | no (AES-SIV) | no (GCM) |
| Identical names leak | no (per-directory IV) | no (path chaining) | no (path chaining) | yes [1] | no [3] {3} | yes [6] | no (GCM) |
| Maximum name length [5] | 255 (since v0.9) {2} | 175 | 175 | 143 | 1024 | 143 | 1024 |
| Maximum path length [5] | 4095 | | | | 4095 | | |
| Directory flattening {1} | no | no | no | no | yes | yes | yes |
References:
[[1]](https://gist.github.com/rfjakob/a04364c55b3ee231078d)
[[2]](https://gist.github.com/rfjakob/61a17bf3c7eb9932d791)
[[3]](https://github.com/cryptomator/cryptomator/commit/3b178030c7a6001c1d070ee181aaae71f760d33f)
[[4]](https://github.com/rfjakob/eme)
[[5]](https://github.com/rfjakob/gocryptfs/blob/master/contrib/maxlen.bash)
[[6]](https://gist.github.com/rfjakob/5ff1591db263d85684ac03fc47009b35)
Notes:
{1} Is the directory tree flattened in the encrypted storage? This
obfuscates the directory structure but can cause problems when
synchronising via Dropbox and similar.
{2} 255 since gocryptfs v0.9, 175 in v0.8 and earlier
{3} cryptomator dropped the use of a random padding in v1.2.0 due to performance concerns.
Performance on Linux
--------------------
All tests are run on tmpfs rule out any influence of the hard disk.
The exact command lines for running the tests are defined in
[canonical-benchmarks.bash](https://github.com/rfjakob/gocryptfs/blob/f0e29d9b90b63d5fbe4164161ecb0e1035bb4af4/tests/canonical-benchmarks.bash).
The box that was used to running the tests has been
upgraded with a new CPU {2}, and unfortunately not all tests have been re-run.
Which CPU was used is noted in the table header.
| | gocryptfs {2} | encfs default {2} | encfs paranoia {1} | ecryptfs {2} | cryptomator {2} | securefs {1} | CryFS {1} |
| ------------------------ | ----------------- | ------------- | ------------------ | --------- | ------------- | ------------------ | ------------------- |
| Tested version | v2.3.2-3-g1a866b7 | v1.9.5 | v1.9.2 | v6.2.13 | v1.5.15 AppImage FUSE | v0.7.3-30-g2596467 | v0.9.7-12-gd9634246 |
| | | | | | | | |
| Streaming write | 482 MiB/s | 122 MiB/s | 51 MiB/s | 323 MiB/s | 57 MiB/s | 132 MiB/s | 69 MiB/s |
| Streaming read | 944 MiB/s | 451 MiB/s | 105 MiB/s | 961 MiB/s | 113 MiB/s | 155 MiB/s | 99 MiB/s |
| Extract linux-3.0.tar.gz | 10.9 s | 13 s | 23 s | 3.9 s | 28 s | 14 s | 41 s |
| md5sum linux-3.0 | 5.1 s | 5.7 s | 10 s | 1.2 s | 15 s | 7.7 s | 42 s |
| ls -lR linux-3.0 | 2.0 s | 2.5 s | 2.9 s | 0.5 s | 4.3 s | 1.2 s | 17 s |
| Delete linux-3.0 | 2.4 s | 3.4 s | 4.4 s | 0.7 s | 10 s | 2.2 s | 21 s |
Notes:
{1} Tested on an Intel Pentium G630 with 2 x 2.7GHz that does NOT have AES instructions<br>
{2} Tested in Intel Core i5-3470 CPU with 4 x 3.20GHz and AES-NI<br>
Performance on Windows
----------------------
All tests were run on a Toshiba-RD400 M.2/NVMe SSD rated 2.6 GB/s read and 1.6 GB/s write random-access speed.
The operating system used was Windows 7 Professional SP1 running on an Intel Core i7-6700 CPU with 4 x 3.40GHz hyperthreaded and AES-NI.
Tests were run using MSYS-CoreUtils 5.97-3-msys-1.0.13 installed using the MinGW installer. The exact command lines for running the tests are defined in
[canonical-benchmarks.bash](https://github.com/rfjakob/gocryptfs/blob/f0e29d9b90b63d5fbe4164161ecb0e1035bb4af4/tests/canonical-benchmarks.bash) with minor
adjustments required to make the test run in this environment.
| | (NTFS) | cppcryptfs | EncFSMP default | EncFS4Win default | cryptomator | securefs | CryFS |
| ------------------------ | --------------- | ------------------------ | ----------------- | ----------------- | ----------------- | ------------- | ----------------- |
| Tested version | v6.1.7601.24382 | v1.4.0.25 | v0.99.1 | v1.10.1-rc14 | v1.4.6 | v0.8.3 | v0.10.0.1201 {1} |
| Based on | - | gocryptfs 1.4 compatible | EncFS 1.9.5 | EncFS 1.9.1 | - | - | - |
| Driver | (Built-in) | Dokany 1.2.2.1000 | PFM 1.0.0.192 {2} | Dokany 1.2.2.1000 | Dokany 1.2.2.1000 | WinFSP 2019.1 | Dokany 1.2.2.1000 |
| User Interface | - | GUI | GUI<br/>(fails to properly display state) | Tray<br />(very basic) | GUI | No {3} | No {3} |
| | | | | | | | |
| Streaming write | 2100 MiB/s {4} | 621 MiB/s | 58 MiB/s | 68 MiB/s | 67 MiB/s | 289 MiB/s | 51 MiB/s |
| Streaming read | 3400 MiB/s {4} | 797 MiB/s | 251 MiB/s | 107 MiB/s | 115 MiB/s | 542 MiB/s | 130 MiB/s |
| Extract linux-3.0.tar.gz | 26 s | 456 s | 793 s | 2121 s | 2497 s | 332 s | 1124 s |
| md5sum linux-3.0 | 51 s | 364 s | 235 s | 1877 s | 1808 s | 235 s | 1254 s |
| ls -lR linux-3.0 | 18 s | 328 s | 166 s | 1269 s | 1722 s | 183 s | 1057 s |
| Delete linux-3.0 | 18 s | 432 s | (427 s) {5} | 1666 s | 2765 s | 260 s | 1007 s |
To the extent this was observed at all during the tests, every one of these
filesystem providers was fully CPU-bound during the small-file tests with
observed disk access speeds never going beyond 15 MiB/s.
Notes:
{1} CryFS considered Windows support “highly experimental” in this version<br />
{2} Closed source component by Pismo Technic Inc<br />
{3} The SiriKali third-part GUI supports CryFS, EncFS4Win and securefs<br />
{4} Yes, these numbers are actually above what the drive is theoretically capable of, so all of these results are likely somewhat skewed<br />
{5} 320 files were not deleted due to *Invalid argument* errors; it is not clear what caused this error, but the logged “Invalid data size, not multiple of block size” messages may indicate corruption
Disk Space Efficiency
---------------------
| | ext4 | gocryptfs | encfs default | encfs paranoia | ecryptfs | cryptomator | securefs | CryFS |
| ------------------------- | --------- | --------- | ------------- | -------------- | --------- | ----------- | ----------------- | ------------------ |
| Tested version | v4.12.5 | v1.4.1 | v1.9.2 | v1.9.2 | v4.12.5 | v1.5.15 AppImage FUSE | 0.7.3-30-g2596467 | 0.9.7-15-g3d52f6a8 |
| | | | | | | | | |
| Empty file {1} | 0 | 0 | 0 | 0 | 8,192 | 88 | 16 | 32,768 |
| 1 byte file {1} | 1 | 51 | 9 | 17 | 12,288 | 137 | 45 | 32,768 |
| 1,000,000 bytes file {1} | 1,000,000 | 1,007,858 | 1,000,008 | 1,007,888 | 1,011,712 | 1,001,576 | 1,006,876 | 1,048,576 {4} |
| linux-3.0 source tree {5} | | | | | | | | |
| ...disk usage {2} | 494 MiB | 512 MiB | 495 MiB | 498 MiB | 784 MiB | 520 MiB | 498 MiB | 1485 MiB |
| ...sum of file sizes {3} | 411 MiB | 416 MiB | 412 MiB | 415 MiB | 784 MiB | 430 MiB | 416 MiB | 1485 MiB |
Notes:
{1} `ls -l` on the encrypted file<br>
{2} `du -sm` on the ciphertext dir, backing filesystem ext4.<br>
{3} `du -sm --apparent-size`.<br>
{4} Counting all 32 chunks ([ref](https://gist.github.com/rfjakob/bdd0ef2bd8f0e94b09ad14f85cd6daec))<br>
{5} Extracted [linux-3.0.tar.gz](https://cdn.kernel.org/pub/linux/kernel/v3.0/linux-3.0.tar.gz)<br>
Filesystem Features
-------------------
Note: To keep the work of maintaining this table under control, I have only
tested selected projects with respect to filesystem features.
Please file a pull request if you can test the other projects!
The backing filesystem is assumed to be ext4.
| | ext4 | gocryptfs | encfs default | encfs paranoia | ecryptfs | CryFS |
| -------------------- | ---- | --------- | ------------- | -------------- | -------- | ----- |
| hard links | yes | yes | yes | no | yes | no |
| extended attributes | yes | yes {1} | yes {2} | yes {2} | ? | ? |
| fallocate | yes | yes | no | no | no | no |
| fallocate KEEP_SIZE | yes | yes | no | no | no | no |
| fallocate PUNCH_HOLE | yes | no | no | no | no | no |
Notes:<br>
{1} Names and values encrypted<br>
{2} Not encrypted<br>
|
