Q. What is novel about eCryptfs?
Well, nothing, to be honest. All of the techniques used in eCryptfs
are directly based on cryptographic technology that was widely known
and in practical use in the 1970's.
Security problems often arise when software tries to ``invent its own
crypto'' by deviating from what has been in common practical use for a
lengthy period of time. eCryptfs sticks to tried-and-true encryption
technology.
In terms of per-file key management, eCryptfs simply uses the methods
of PGP (created by Philip Zimmermann in 1991 and formally specified as
a public standard in RFC2440 in 1998) and takes the obvious and
conceptually trivial step of applying those methods within a
filesystem service in the kernel. eCryptfs employs the well-weathered
encryption techniques that have been in common use in the community
for over two decades. Other cryptographic filesystems published and
widely used in the 1990's use the same basic approach to encrypting
files. eCryptfs just happens to be the first such filesystem to make
it upstream in the Linux kernel.
Q. What kernel options do I need to enable to build
eCryptfs?
Code maturity level options --->
[*] Prompt for development and/or incomplete code/drivers
Security options --->
<M> Enable access key retention support
Cryptographic options --->
<M> MD5 digest algorithm
<M> AES cipher algorithms
File systems --->
Miscellaneous filesystems --->
<M> eCrypt filesystem layer support (EXPERIMENTAL)
Recommended .config options (some options not available in older kernels):
CONFIG_EXPERIMENTAL=y
CONFIG_KEYS=y
CONFIG_CRYPTO=y
CONFIG_CRYPTO_ALGAPI=y
CONFIG_CRYPTO_BLKCIPHER=y
CONFIG_CRYPTO_HASH=y
CONFIG_CRYPTO_MANAGER=y
CONFIG_CRYPTO_MD5=y
CONFIG_CRYPTO_ECB=y
CONFIG_CRYPTO_CBC=y
CONFIG_CRYPTO_AES=y
CONFIG_ECRYPT_FS=m
Newer versions of the Linux kernel now have a ``Layered filesystems''
submenu under the ``File systems'' menu, where eCryptfs and Unionfs
reside.
Make certain that you have loaded all of the crypto modules that you
need to run eCryptfs. This includes ecb,
cbc, md5, and at least one popular symmetric
cipher, like aes.
Q. Can I mount eCryptfs with a public key?
You can mount eCryptfs with a public key if you have public key
support (pubkey) in your kernel. You first need to
generate a public/private keypair. Run ecryptfs-manager,
follow the prompts to generate the keypair for the key module of your
choosing, start the ecryptfsd daemon, and then specify
the key module when mounting. For instance, for the OpenSSL key
module, assuming you created your key in
/usb-drive/mykey.pem and you want to do a layover mount
on /secret, run:
# ecryptfsd
# mount -t ecryptfs -o key=openssl:keyfile=/usb-drive/mykey.pem /secret /secret
Q. Why would I want to use public key anyway?
Cryptographic keys derived from passphrases are generally
worthless. Most passphrases that people can reasonably remember lack
even the strength of a 64-bit symmetric key. The idea behind using a
public key is to provide an opportunity for two-factor authentication;
for instance, with OpenSSL RSA, the PEM file is ``something you have''
and the passphrase is ``something you know.'' This works best if you
store your public key and your encrypted files on separate media.
The ``public key'' mode of operation in eCryptfs is actually more
general than public key. It allows for arbitrary key modules to
perform the File Encryption Key (FEK) encryption and decryption. The
key module could do RSA. Or, it could retrieve an employee's key from
a Domino server. Or, it could unseal the key protected by a Trusted
Computing chip, which will only honor the unseal request if the
machine is booted into a trusted state. This TPM-based protection is
actually on the work queue for this year.
Q. Do I have to be root to mount eCryptfs?
eCryptfs mounts can be set up to be done by non-root users. Generally,
you want to perform the initial key generation and mount as the root
user. Then, you can do a mount as a user by putting the appropriate
options in /etc/fstab, adding the keys to the user session keyring
(using ecryptfs-manager), and performing the mount in such a way that
bypasses the mount helper. This is not very well automated in the
current release, but it is possible right now with some manual
steps. The instructions on using the PAM module are contained in the
README and give the steps necessary to set that up; just follow all
the directions except the last PAM step to see how it works:
http://ecryptfs.sourceforge.net/README
In short, you will want something like this in your fstab:
/home/user/secret /home/user/secret ecryptfs
rw,ecryptfs_sig=deadbeefbaadf00d,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,user,noauto 0 0
You need to get the corresponding authentication token for the
ecryptfs_sig into your user session keyring;
ecryptfs-manager and the PAM module can both do this for
you. Alternatively, you can write your own application that calls
ecryptfs_add_passphrase_key_to_keyring() or
ecryptfs_add_key_module_key_to_keyring() in
libecryptfs.so. Then you will want to mount with the -i
option to prevent the mount helper from being called.
Q. How can I find out which features are in my eCryptfs kernel
module?
View the contents of fs/ecryptfs/version_str under your
sysfs mount point (typically /sys). For
instance:
# cat /sys/fs/ecryptfs/version_str
passphrase
pubkey
plaintext passthrough
metadata in extended attribute
In this particular example, the kernel has passphrase support, public
key support, plaintext passthrough support, and support for storing
cryptographic metadata in the extended attribute regions of the lower
files.
Q. What about filename encryption?
The namespace problem arises when we consider the case where two files
have the same unencrypted name. This can be a problem when the user
does not have the key for every file in any given directory. Imagine,
for instance, that Alice creates a file named ``meeting_notes.txt'' in
a shared directory on an NFS server. The filename is encrypted with a
key known only to Alice and Carol. Bob then creates a file in the same
shared NFS directory and also names it ``meeting_notes.txt'',
encrypting the filename with another key only known to Bob and
Carol. Bob's eCryptfs client cannot detect the unencrypted filename
conflict in the namespace because Bob does not have Alice's key.
So two different files that have the same unencrypted name and
different encrypted names appear in the same directory. When Carol,
who has both Alice's key and Bob's key, lists the contents of the
directory, he winds up seeing two different files with the same
filename in the same directory, which is a POSIX violation.
The solution we may implement is to use a separate key just for
filename encryption, requiring all filenames encrypted under any given
directory to be encrypted with that key. Filename encryption is a
planned feature, but there is currently no set date for when it will
be completed.
Q. How can I protect my key?
Make a copy and store it in a physically secure location. For
instance, copy your public/private keypair to a USB flash drive or
write your passphrase onto a sheet of paper. Then, lock the drive and
paper in your desk drawer or put them in a safe deposit box (depending
on the sensitivity of the data that the keys protect). Future versions
of eCryptfs userspace utilities may implement key splitting functions
to provide even more paranoid levels of key protection.
Do not store your keys under the same physical security context in
which you are storing your media. It should be much harder for an
attacker to get to your keys than it is for him to get to your media.
When you use public key mode and generate a new key using
ecryptfs-manager, the generated key file is the one that
you must back up in order to access your files.
When mounting with a new key, I recommend performing a full mount,
creating a new file, unmounting, clearing the user session keyring
(keyctl clear @u), mounting again, and then trying to
access the newly created file. This minimizes the likelihood that you
will mistype a passphrase and create files that you will not be able
to later recover. When mounting in passphrase mode, make sure that the
ecryptfs_sig value matches between mounts. Future versions of eCryptfs
will store a cache of previous ecryptfs_sig values and warn the user
if a mount passphrase does not match any passphrases used for previous
mounts.
Q. I forgot my password/lost my key! What can I do to recover
my data?
Nothing; you're screwed. (Apologies
to Bruce Schneier).
If you have forgotten your passphrase, your only hope is that you
chose a weak passphrase in the first place. There is an outside chance
that you might be able to perform a successful dictionary attack to
recover your passphrase. If you manage to recover your passphrase that
way, then you may as well have not been bothering to encrypt your data
in the first place, since a malicious attacker could have done the
exact same thing to recover your passphrase.
If you selected a strong passphrase or lost your key file, you are
screwed no matter what. Nobody can help you recover your data.
Q. How does eCryptfs compare with other Linux disk encryption
solutions?
eCryptfs is an actual filesystem. Some other popular disk encryption
technologies are not filesystems; they are block device encryption
layers (they provide what appears to be a physical block device to
some actual filesystem). There is no filesystem logic in these
layers. A few of the more well-known block device encryption layers
include dm-crypt, Truecrypt, and Loop-AES. Perhaps the best thing
about block device-layer encryption is that it is an order of
magnitude simpler to implement than filesystem-layer
encryption. Another advantage of block device-layer encryption is that
it will encrypt the entire filesystem, including all of the filesystem
metadata. However, for many use cases, this can turn out to be more of
a disadvantage than an advantage.
While eCryptfs uses a powerful and flexible approach to protecting
filesystem content, block device-layer encryption technology is still
required to protect swap space and certain databases that use their
own block device partition. The table below provides a
compare-and-constrast of the two technologies. I anticipate that block
device encryption will be the best solution for some people, while
stacked filesystem encryption will be the best solution for
others. Sometimes it even makes sense to use them both together, to
combine the comprehensive full-disk encryption of a block device layer
encryption technology with the transparent per-file encryption
provided by eCryptfs (this will result in double-encryption of the
file contents).
| Block Device Encryption |
Stacked Filesystem Encryption |
| Simple in concept and implementation; just transform blocks as
they pass through. |
High level of design complexity; meticulous handling of internal
filesystem primitives required. |
| Must allocate a block device to dedicate for the entire
filesystem. |
Stacks on top of existing mounted filesystems; requires no special
on-disk storage allocation effort. |
| Everything in the filesystem incurs the cost of encryption and
decryption, regardless of the confidentiality requirements for the
data. |
Selective encryption of the contents of only the sensitive
files. |
| Fully protects the confidentiality of the directory structures,
superblocks, file sizes, file permissions, and so forth. |
Cannot keep all filesystem metadata confidential. Since stacked
filesystems encrypt on a per-file basis, attackers will know the
approximate file sizes, for instance. |
| Coarse granularity; only fixed per-mountpoint encryption policies
are possible. |
Fine granularity; flexible per-file encryption policies are
possible. |
| No notion of ``encrypted files.'' Individual files must be
re-encrypted via a userspace application before written to backups,
sent via email, etc. |
Individual encrypted files can be accessed transparently by
applications; no additional work needed on the part of applications
before moving the files to another location. |
| Clients cannot use directly on networked filesystems; encryption
must be set up and managed on the server, or the client must encase
all of his files in a loopback mount, losing the per-file granularity
from the perspective of other clients. |
Clients can stack on locally mounted networked filesystems;
individual files are sent to the server and stored in encrypted
form. |
| Can protect databases that use their own dedicated block device. |
Can only protect databases that write their tables to regular
files in an existing filesystem. |
| Used to protect swap space. |
Not designed to protect swap space; we recommend using block
device encryption to protect swap space while using eCryptfs on the
filesystem. |
| Possible to hide the fact that the partition is encrypted. |
The fact that encrypted data exists on the device is obvious to an
observer. |
| Filesystem-agnostic; any filesystem will work on an encrypted
block device. |
Can only be expected to work with existing filesystems that are
upstream in the official Linux kernel. |
EncFS is another popular cryptographic filesystem that behaves much
like a stacked filesystem. EncFS is a userspace filesystem, and so
individual page reads and writes require additional context switches
between kernel and userspace. One advantage a userspace cryptographic
filesystem is that it is possible to use symmetric ciphers implemented
in userspace libraries, but the frequent context switching impacts
performance. In addition, EncFS uses FUSE, which suffers from the fact
that shared writable memory mappings must be entirely disabled in
order to avoid deadlock on some page swap events.
Q. "ecryptfs_parse_options: Could not find key with
description: [deadbeaf...]"
If the mount fails and the message "ecryptfs_parse_options:
Could not find key with description: [deadbeaf...]" is in
your system logs, then there was a problem inserting your mount key
into your kernel user session keyring.
After a mount attempt, run keyctl_show. You should see
something like this:
# keyctl show
Session Keyring
-3 lswrv---------- 0 0 keyring: _uid_ses.0
2 lswrv---------- 0 0 \_ keyring: _uid.0
892244932 lswrv---------- 0 0 \_ user: deadbeef...
Where deadbeef is the signature that corresponds with
your key. If you don't see this, then there is a problem with your
keyring setup.
If you su to root, be sure to initiate the session by using the -
flag.
Finally, try linking your user keyring into your active session
keyring:
# keyctl link @u @s