1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
gocryptfs Security
==================
gocryptfs builts upon well-known cryptographic primitives: scrypt for
key derivation, AES-GCM for file content encryption and, as a world's
first for encrypted filesystems, EME for file name encryption.
Master Key Storage
------------------
The master key is used to perform content and file name encryption.
It is stored in `gocryptfs.conf`, encrypted with AES-256-GCM using the
Key Encryption Key (KEK). The KEK is generated from the user password
using `scrypt`.
When mounting a filesystem, the user is prompted for the password and
the master key is decrypted:
File Contents
-------------
All file contents are encrypted using AES-256-GCM (Galois/Counter Mode).
Files are segmented into 4KB blocks. Each block gets a fresh random
128 bit IV each time it is modified. A 128-bit authentication tag (GHASH)
protects each block from modifications.
Each file has a header containing a random 128-bit file ID. The
file ID and the block number are mixed into the GHASH as
*additional authenticated data*. The prevents blocks from being copied
between or within files.
To support sparse files, all-zero blocks are accepted and passed through
unchanged.
File Names
----------
Every directory gets a 128-bit directory IV that is stored in each
directory as `gocryptfs.diriv`.
File names are encrypted using AES-256-EME (ECB-Mix-ECB wide-block encryption,
see [github.com/rfjakob/eme](https://github.com/rfjakob/eme) for details) with the directory IV
as initialization vector. EME fixes the prefix leak that occours with CBC
encryption.
The Base64 encoding limits the usable filename length to 176 characters.
Filenames that are longer than that (longer than 255 characters in Base64-
encoded form) use long file name handling (since gocrytfs v0.9).
Long File Name Handling
-----------------------
If the Base64-encoded encrypted name is longer than 255 characters,
it cannot be used as the file name on disk, as Linux filesystems
do not allow names longer than that.
Instead, the encrypted name is hashed, and the file content is stored in
`gocryptfs.longname.[hash]`. The long file name is stored in a support
file, `gocryptfs.longname.[hash].name`.
This method for storing long file names has zero performance impact
for filenames that are <= 176 characters, incurs no extra disk accesses
for opening a file with a long name, and just one extra file read for each
long-name file on readdir(1).
Because the hash is only taken from the encrypted file name, there is no
security penalty for using long names.
|
