4 ms·
ecryptfs doesn't use loop, rather it acts like a (windows term) file system filter, encrypting every file separately and storing it as a separate file in the un
by blattimwind 7y ago
ecryptfs doesn't use loop, rather it acts like a (windows term) file system filter, encrypting every file separately and storing it as a separate file in the underlying FS.
- tptacek 7y agoIronically, at least as a design (I'm unfamiliar with the implementation), this is probably more secure.
- blattimwind 7y agoProper AEAD becomes a lot simpler, on the other hand a lot of structural information is just plain there.
- tptacek 7y agoThat's a fair point; you'd do better than either design with a true encrypted filesystem.
- Hello71 7y agoassuming you don't care about metadata.
- unilynx 7y agoProbably not... any form of partial encryption (ie not the full block device) needs to make sure no sensitive data leaks outside the encrypted parts (/tmp and swap? /var if you only encrypt /home?) Depending on the implementation the filesystem metadata may also reveal more data than needed. The attacker can probably ignore that 4GB file that wasn't modified for a year (a downloaded ISO image?) but that 20KB file that was recently modified might be that passwords.txt he was looking for..
- tptacek 7y agoIt depends on what your biggest concern is. Large scale metadata analysis is a concern that block-level encryption does a better job of than "file filter encryption" does. Authenticated encryption, which prevents people from bitflipping your init scripts into bindshells if you lose access to your laptop for a few minutes, is something that file encryption addresses and block encryption basically doesn't. The important thing is that you don't really have to choose; a true encrypted filesystem can give you both things. Block-level encryption can't.