summaryrefslogtreecommitdiff
path: root/cryptfs
AgeCommit message (Collapse)Author
2015-11-29OpenDir performance: Read DirIV once and reuse it for all namesJakob Unterwurzacher
Formerly, we called decryptPath for every name. That resulted in a directory walk that reads in all diriv files on the way. Massive improvement for RM and LS (check performance.txt for details) VERSION UNTAR RM LS v0.4 48 5 1.5 v0.5-rc1 56 19 7 v0.5-rc1-1 54 9 4.1 <---- THIS VERSION
2015-11-29Add "-scryptn" option that sets the cost parameter for scryptv0.5-rc1Jakob Unterwurzacher
Use that option to speed up the automated tests by 7 seconds. Before: ok github.com/rfjakob/gocryptfs/integration_tests 26.667s After: ok github.com/rfjakob/gocryptfs/integration_tests 19.534s
2015-11-29tests: add scrypt benchmarkJakob Unterwurzacher
Times the impact of the parameter "N" to scrypt. Results on a 2.7GHz Pentium G630: gocryptfs/cryptfs$ go test -bench=. PASS BenchmarkScrypt10-2 300 6021435 ns/op ... 6ms BenchmarkScrypt11-2 100 11861460 ns/op BenchmarkScrypt12-2 100 23420822 ns/op BenchmarkScrypt13-2 30 47666518 ns/op BenchmarkScrypt14-2 20 92561590 ns/op ... 92ms BenchmarkScrypt15-2 10 183971593 ns/op BenchmarkScrypt16-2 3 368506365 ns/op BenchmarkScrypt17-2 2 755502608 ns/op ... 755ms ok github.com/rfjakob/gocryptfs/cryptfs 18.772s
2015-11-28diriv: fix readdirJakob Unterwurzacher
It decrypted all file names using the root directory iv
2015-11-28diriv: use "DirIV" flag to discern and support mounting old filesystemsJakob Unterwurzacher
2015-11-27Run go fmtJakob Unterwurzacher
2015-11-27diriv: Define "DirIV" feature flagJakob Unterwurzacher
(unused so far)
2015-11-27diriv: Move WriteDirIV() to cryptfs; add locking to Mkdir, RmdirJakob Unterwurzacher
2015-11-27diriv: Convert filename encryption users to dirivJakob Unterwurzacher
2015-11-25diriv: Create gocryptfs.diriv in every directoryJakob Unterwurzacher
2015-11-25Tighten file permissions on gocryptfs.confJakob Unterwurzacher
This file should only be readable by the owner and never be written to.
2015-11-15CipherSizeToPlainSize: Handle illegal statesJakob Unterwurzacher
A file never gets a cipherSize <= HEADER_LEN in normal operation. However, this can happen if header write it interrupted or the underlying filesystem does not support fallocate. Noticed while trying to store a CIPHERDIR in another gocryptfs mount (gocryptfs does not support fallocate)
2015-11-15Add "-extpass" cli option and associated testsJakob Unterwurzacher
2015-11-14Run go fmt and go vetJakob Unterwurzacher
2015-11-09Add "-q" (quiet) flagJakob Unterwurzacher
2015-11-03Centralize path filter decision in CryptFS.IsFiltered()Jakob Unterwurzacher
2015-11-03tests: add config file and feature flags testsJakob Unterwurzacher
2015-11-03config: Introduce ext4-style feature flagsJakob Unterwurzacher
// List of feature flags this filesystem has enabled. // If gocryptfs encounters a feature flag it does not support, it will refuse // mounting. This mechanism is analogous to the ext4 feature flags that are // stored in the superblock. FeatureFlags []string
2015-11-03Fix tests broken by PlaintextNames additionJakob Unterwurzacher
2015-11-03Update USAGE.txtJakob Unterwurzacher
Also run go fmt
2015-11-03Implement PlainTextNames modeJakob Unterwurzacher
Also, forbid access to "gocryptfs.conf" in the root dir.
2015-11-02Bump on-disk version to 2Jakob Unterwurzacher
2015-11-02Add "--plaintextnames" optionJakob Unterwurzacher
Also, gather all the command line arguments into an anonymous struct "args".
2015-11-01Refactor ciphertext <-> plaintext offset translation functionsJakob Unterwurzacher
Move all the intelligence into the new file address_translation.go. That the calculations were spread out too much became apparent when adding the file header. This should make the code much easier to modify in the future.
2015-11-01Add file header (on-disk-format change)Jakob Unterwurzacher
Format: [ "Version" uint16 big endian ] [ "Id" 16 random bytes ] Quoting SECURITY.md: * Every file has a header that contains a 16-byte random *file id* * Each block uses the file id and its block number as GCM *authentication data* * This means the position of the blocks is protected as well. The blocks can not be reordered or copied between different files without causing an decryption error.
2015-11-01Activate block number authenticationJakob Unterwurzacher
2015-10-11main: check directories for existence earlyJakob Unterwurzacher
This prevents that the user enters the password only to get an error later.
2015-10-07Run go fmtJakob Unterwurzacher
2015-10-07Add test.bashv0.1Jakob Unterwurzacher
...also adapt the cryptfs tests for 256 bit long keys
2015-10-07Implement "gocryptfs --passwd" (pasword changing)Jakob Unterwurzacher
2015-10-06Use block number as authentication dataJakob Unterwurzacher
2015-10-06Switch to AES-256Jakob Unterwurzacher
AES-256 seems to be becoming the industry standard. While AES-128 is good enough for tens of years to come, let's follow suit and be extra safe.
2015-10-06Implement proper daemonizationJakob Unterwurzacher
The shell wrapper sends gocryptfs into the background and waits for SIGUSR1
2015-10-04openssl AEAD wrapper: handle authenticated dataJakob Unterwurzacher
2015-10-04Switch nonce generation to purely randomJakob Unterwurzacher
The old implementation of counting up from a random starting point had the problem that is allowed an attacker to find out the write order of the blocks.
2015-10-04Run go fmtJakob Unterwurzacher
2015-10-04intraBlock: Rename Offset to SkipJakob Unterwurzacher
"Offset" is unclear whether it is an offset from the start of file or start of block. "Skip" seems much better.
2015-10-04Add BlockNoPlainOff() and BlockNoCipherOff() + testJakob Unterwurzacher
Also, fix key, it is now []byte, not [16]byte
2015-10-04Fix xfstests generic/030 failureJakob Unterwurzacher
The actual fix is oldSize := f.cfs.PlainSize(uint64(fi.Size())) the rest is logging improvements
2015-10-03debug: log inode number instead of encrypted filenameJakob Unterwurzacher
Makes the log output smaller and more readable.
2015-10-03Implement file hole passtroughJakob Unterwurzacher
Fixes xfstests generic/010 Note that file holes are not authenticated,
2015-09-30Implement Truncate() + TestJakob Unterwurzacher
2015-09-30DecryptBlocks: Don't shadow err variableJakob Unterwurzacher
2015-09-16Fix symlink size reportingJakob Unterwurzacher
2015-09-16symlink encryption: pass ".." and "." through unchangedJakob Unterwurzacher
This fixes relative symlinks: $ tar xf linux-4.2.tar.gz tar: linux-4.2/tools/testing/selftests/powerpc/vphn/vphn.h: Cannot utime: No such file or directory tar: linux-4.2/tools/testing/selftests/powerpc/vphn/vphn.c: Cannot utime: No such file or directory tar: linux-4.2/tools/testing/selftests/powerpc/stringloops/memcmp_64.S: Cannot utime: No such file or directory tar: linux-4.2/tools/testing/selftests/powerpc/primitives/word-at-a-time.h: Cannot utime: No such file or directory tar: linux-4.2/tools/testing/selftests/powerpc/primitives/asm/asm-compat.h: Cannot utime: No such file or directory tar: linux-4.2/tools/testing/selftests/powerpc/copyloops/memcpy_power7.S: Cannot utime: No such file or directory tar: linux-4.2/tools/testing/selftests/powerpc/copyloops/memcpy_64.S: Cannot utime: No such file or directory tar: linux-4.2/tools/testing/selftests/powerpc/copyloops/copyuser_power7.S: Cannot utime: No such file or directory tar: linux-4.2/tools/testing/selftests/powerpc/copyloops/copyuser_64.S: Cannot utime: No such file or directory tar: linux-4.2/arch/powerpc/boot/dts/include/dt-bindings: Cannot utime: No such file or directory tar: linux-4.2/arch/mips/boot/dts/include/dt-bindings: Cannot utime: No such file or directory tar: linux-4.2/arch/metag/boot/dts/include/dt-bindings: Cannot utime: No such file or directory tar: linux-4.2/arch/arm64/boot/dts/include/dt-bindings: Cannot utime: No such file or directory tar: linux-4.2/arch/arm/boot/dts/include/dt-bindings: Cannot utime: No such file or directory tar: Exiting with failure status due to previous errors
2015-09-14Use MarshalIndent for JSON generationJakob Unterwurzacher
2015-09-13Encrypt key with scrypt-hashed passwordJakob Unterwurzacher
2015-09-13Implement json config storage (not yet encrypted)Jakob Unterwurzacher
2015-09-09Fix File.GettAttr() size reportingJakob Unterwurzacher
The too-large reported value broke mmap (applications saw appended zero bytes) Also * Add locking for all fd operations * Add "--debug" command line switch
2015-09-08Explain both frontends in readmeJakob Unterwurzacher
Also, re-enable openssl and disable debug messages so testing gocryptfs is less painful
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-10 19:14:02 +0000