diff options
Diffstat (limited to 'Documentation/SECURITY.md')
| -rw-r--r-- | Documentation/SECURITY.md | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/Documentation/SECURITY.md b/Documentation/SECURITY.md index 003eadb..dff2fab 100644 --- a/Documentation/SECURITY.md +++ b/Documentation/SECURITY.md @@ -15,7 +15,7 @@ The KEK is generated from the user password using `scrypt`. File Contents ------------- -All file contents are encrypted using AES-256-GCM. +All file contents are encrypted using AES-256-GCM (Galois/Counter Mode). Files are segmented into 4KB blocks. Each block gets a fresh random 96 bit IV each time it is modified. A 128-bit authentication tag (GHASH) @@ -37,8 +37,11 @@ File Names Every directory gets a 128-bit directory IV that is stored in each directory as `gocryptfs.diriv`. -File names are encrypted using AES-256-CBC with the directory IV as -initialization vector. The Base64 encoding limits the usable filename length -to 176 characters. +File names are encrypted using AES-256-EME (ECB-Mix-ECB wide-block encryption, +see https://github.com/rfjakob/eme for details) with the directory IV +as initialization vector. EME fixes the prefix leak that occours with CBC +encryption.  + +The Base64 encoding limits the usable filename length to 176 characters. |